UNIVERSITI TEKNOLOGI MARA RISK MANAGEMENT IN INFORMATION TECHNOLOGY OUTSOURCING FRAMEWORK IN MALAYSIA SYARIPAH RUZAINI SYED ARIS

Transcription

1 UNIVERSITI TEKNOLOGI MARA RISK MANAGEMENT IN INFORMATION TECHNOLOGY OUTSOURCING FRAMEWORK IN MALAYSIA SYARIPAH RUZAINI SYED ARIS Thesis submitted in fulfillment of the requirements for the degree of Doctor of Philosophy Faculty of Computer and Mathematical Sciences April 2010

2 Candidate's Declaration I declare that the work in this thesis was carried out in accordance with the regulations of Universiti Teknologi MARA. It is original and is the result of my own work, unless otherwise indicated or acknowledged as referenced work. This topic has not been submitted to any other academic institution or non-academic institution for any other degree or qualification. In the event that my thesis be found to violate the conditions mentioned above, I voluntarily waive the right of conferment of my degree and agree be subjected to the disciplinary rules and regulations of Universiti Teknologi MARA. Name of Candidate Candidate's ID No. Programme Faculty Thesis Title Syaripah Ruzaini Syed Aris Doctor of Philosophy in Information Technology Computer and Mathematical Sciences Risk Management in Information Technology Outsourcing Framework in Malaysia Signature of Candidate Date : April 2010 ii

3 ABSTRACT Outsourcing is becoming a trend nowadays. Malaysia also takes this opportunity and embraces in IT outsourcing. As a result, Malaysia has been ranked as the third most attractive destination for outsourcing after India and China. Despite increasing number of organisations that involve in IT outsourcing, it should be noted that IT outsourcing is not a panacea. It requires effective management in order to prevent projects from failing. This problem has also been reported to happen with the IT outsourcing projects in Malaysia. It is essential to identify, manage and mitigate the risk inherent in IT outsourcing projects. Hence, this research would focuses on managing risk in IT outsourcing projects that would be applied in Malaysian environment. There are two research model used in this study. Research Model 1 is to investigate the factors that influenced the practise of risk management in IT outsourcing phase, evaluation on how organisations practised risk management in IT outsourcing project, identification of success rate and relationship between risk management in IT outsourcing phases and IT outsourcing success. Meanwhile, Research Model 2 determines the ranking of risk factors as assessed by managers in Malaysia. There were 38 risk factors used in this study and managers' perception towards those risks was then measured. The new risk factors as envisioned by the managers were also identified. Results from quantitative study revealed that only 35.6% IT outsourcing projects managed to be delivered successfully. The study revealed that 28.9% of the project success belongs to organisations that practise risk management. The results show that the success of IT outsourcing depends heavily on risk management in IT outsourcing phases. The top three risk factors are service provider's practises of security, service provider's financial condition and monitoring of the project. The survey also revealed that the project with different type of business nature perceived risk factors differently from each other. The qualitative survey showed the new risk factors as envisioned by managers. The factors are type of contract, proposal returned and project usability. The best practises from previous literatures and the findings were then used as a basis for the development of the framework. The framework proposed step-by-step guidelines that need to be taken in managing risk in IT outsourcing projects. The framework could help the organisations to focus on risk management practises while managing IT projects. To present the usability of the framework, it has been tested on a case study. Based on the case study, the organisation had skipped the selection of service provider phase. As a consequence, the organisation faced many problems including the service provider's inability to solve problems. The application of the framework however has allowed them to select service provider with the required knowledge and skills. Furthermore, the framework allows the organisation to focuses on initial study in decision to outsource, develop and sustain relationship with its service provider, manage the contract as well as monitor the service provider in order to reduce risk thus, increase the probability of project success. iii

4 ACKNOWLEDGEMENTS Alhamdulillah, thank you Allah. The success and the completion of this study would be impossible without the help and guidance from the Most Merciful, the Most Beneficent and the Most Compassionate, the Almighty Allah. I would like to thank my supervisors: Datin Associate Professor Dr. Hajah Noor Habibah Arshad and Associate Professor Dr. Azlinah Mohamed for their help, patience, guidance and encouragement. Their advice and endless support is unforgettable. To all managers that have helped validate and give valuable feedback to the instruments and to managers that have been involved in answering the questionnaire; thank you! Without your help, it is impossible to complete this study. To the individuals that have spent their precious time contributing to in-depth data collection in my research, May Allah Bless you. A special thank to Puan Ruzaidah Mansor of Setiausaha Kerajaan (SUK) Selangor for her guidance and help. I would also like to further acknowledge Puan Halilah Haron for the guidance and advice on the analysis technique. Not forgotten to Associate Professor Hajah Siti Akmar for the willingness to edit the thesis. To all my friends and lecturers of Faculty of Computer and Mathematical Sciences, thank you for the support and prayers. To my beloved husband, Ahmad Ruzaini Kamaruddin and my beloved son, Mir Safiy Al-Bukhary, I love you! Thank you for being so patient and supportive throughout my completion of the study. To my late father, although without you around, your advice always motivate me to complete my study. To my mother, sisters, brothers, nephew and niece, thank you for your endless support and prayers. All of you have encouraged me throughout the study. May Allah bless us. Finally, this work would not have been completed without the ongoing financial assistance from my sponsor, Universiti Teknologi MARA. iv

5 TABLE OF CONTENTS Page TITLE PAGE AUTHOR'S DECLARATION ABSTRACT ACKNOWLEDGEMENTS TABLE OF CONTENTS LIST OF TABLES LIST OF FIGURES LIST OF EQUATIONS ii iii iv v xi xiii xiv CHAPTER 1: INTRODUCTION 1.1 Research Background Problem Statement Aim and Objective of the Research Importance of the Research Usefulness of the Research Novelty of the Research Contribution of the Research Research Approach and Methodology Research Approach Research Methodology Limitation Overview of the Thesis 17 v

6 CHAPTER II: BACKGROUND STUDY ON IT OUTSOURCING 2.1 Introduction IT Outsourcing IT Outsourcing Process Summary of IT Outsourcing Process Success Factors in IT Outsourcing Failure in IT Outsourcing Risks in IT Outsourcing Risk Management Risk Management Process Summary of Risk Management Process Managing Risks in IT Outsourcing Analysis of IT Outsourcing Framework Transaction Cost Theory Agency Theory Relational Exchange Theory Transaction Cost Theory, Agency Theory and Relational Exchange Theory in Previous Research How Theories Support the Proposed Framework Conclusion 72 CHAPTER III: RESEARCH MODEL 3.1 Introduction Research Model Research Model Research Model Methods of Data Collection Target Respondent Research Instrument 88 vi

7 Analysis of the Research Data Conclusion CHAPTER IV : EMPIRICAL ANALYSIS AND DISCUSSION 4.1 Introduction Empirical Analysis and Discussion Respondents' Profile Project Characteristic Reliability Analysis Risk Management in IT Outsourcing Practises Results of Hypotheses Risk Ranking Perception Analysis Factor Analysis for Risk Factor Conclusion 140 CHAPTER V : EXPLORATORY ANALYSIS AND DISCUSSION 5.1 Introduction Exploratory Analysis and Discussion Organisational Background Risk Management in IT Outsourcing Practises How Organisations Define Success Risk in IT Outsourcing Projects Risk Factors Description Risk Category Comparison between Risk Factors List and Literature List Conclusion 192 vii

8 CHAPTER VI: RISK MANAGEMENT IN IT OUTSOURCING FRAMEWORK 6.1 Introduction Risk Management in IT Outsourcing Framework Top Management Support Risk Management IT Committee Risk Management IT Outsourcing Committee Analysis of Decision to Outsource Phase Create Business Case Risk Assessment on Business Case Risk IT Outsourcing Treatment Request for Proposal Selection of Service Provider Phase Proposal Evaluation Risk IT Outsourcing Treatment Contract Management Phase Select Type of Contract Contract Negotiation Risk Negotiation Contract Designing Contract Signing On-Going Monitoring Phase Perform Continuous Monitoring Risk IT Outsourcing Assessment Risk IT Outsourcing Treatment Conclusion 294 viii

9 CHAPTER VII: FRAMEWORK APPLICATION IN A CASE STUDY 7.1 Introduction Case Study Description - The Video Conferencing Project Introduction to the Video Conferencing Projects The IT Outsourcing Practises Best Practises in Video Conferencing Project Weaknesses in Video Conferencing Project 13 The Application of Risk Management in IT Outsourcing Framework 7.4 Top Management Support 7.5 Risk Management IT Committee Risk Management IT Outsourcing Board Risk Management IT Outsourcing Steering Committee 7.6 Analysis of Decision to Outsource Phase Create Business Case Risk Assessment on Business Case Risk IT Outsourcing Treatment Request for Proposal 1.1 Selection of Service Provider Phase Proposal Evaluation Risk IT Outsourcing Treatment 7.8 Contract Management Phase Select Type of Contract Contract Negotiation Risk Negotiation Contract Designing Contract Signing 7.9 On-Going Monitoring Phase 7.10 Conclusion ix

10 CHAPTER VIII: CONCLUSION 8.1 Summary of Risk Management in IT Outsourcing Practise Success Rate in IT Outsourcing Factors that Influenced the Practises of Risk Management in IT Outsourcing Phases Risk Management Activities Practise in IT Outsourcing Relationship between Risk Management in IT Outsourcing Phases and IT Outsourcing Success Risk Ranking and Perception Towards Risk Factors New Risk Factors as Envisioned by the Managers Risk Management in IT Outsourcing Framework and its Application Future Works 353 REFERENCES 355 APPENDICES Appendix A : Sample of Questionnaire 377 Appendix B : Results of Empirical Analysis 389 Appendix C : Case Analysis for Organisations 396 Appendix D : Published Works 401 x

11 LIST OF TABLES Table No. Page Table 1.1 Input, Activity and Deliverable of Theoretical Study Phase 12 Table 1.2 Input, Activity and Deliverable of Empirical and 13 Exploratory Study Phase Table 1.3 Input, Activity and Deliverable of Framework 14 Development Phase Table 1.4 Input, Activity and Deliverable of Framework Application 14 Phase Table 2.1 Attributes of Risk Maturity Model 44 Table 2.2 Summaries of Risk in Outsourcing 45 Table 2.3 Risk Factors 46 Table 2.4 Type of Contract Based on Construct from Agency Theory 67 Table 2.5 The Usage of TCT, AT and RET in Previous Research 69 Table 2.6 Questions Arise and the Supporting Theories 71 Table 3.1 Result of Reliability Test for Pilot Study 89 Table 4.1 Demographic Profile and Organizational Background 99 Table 4.2 Project Characteristics 102 Table 4.3 Reason to Outsource 103 Table 4.4 Results for Reliability 104 Table 4.5 The Existence of Risk Management Department by Sector 104 Table 4.6 The Practises of Risk Management in IT Outsourcing 105 Table 4.7 Reasons for not Practising Risk Management in IT 108 Outsourcing Table 4.8 Results of the Test of Association between Factors that 109 Influenced the Practise of Analysis of Decision to Outsource and Analysis of Decision to Outsource Phase Table 4.9 Results of the Test of Association between Factors that 112 Influenced the Practise of Selection of Service Provider and Selection of Service Provider Phase Table 4.10 Results of the Test of Association between Factors that 114 Influenced the Practise of Contract Management and Contract Management Phase Table 4.11 Results of the Test of Association between Factors that 116 Influenced the Practise of On-Going Monitoring and On- Going Monitoring Phase Table 4.12 Clauses Included in the Contract by Types of Projects 120 Table 4.13 Clauses Achieved in the Contract by Types of Proj ects 123 Table 4.14 Projects Outcomes and Risk Management Practices Cross 125 tabulation Table 4.15 Results of Kendall's Tau for Public and Private Sector 127 Table 4.16 Risk Ranking 129 Table 4.17 Test Statistics for Kruskal-Wallis between Project 132 Manager's Years of Working Experience and Risk Factors Table 4.18 Multiple Comparison for Kruskal-Wallis between Project 133 Manager's Years of Working Experience and Risk Factors xi

12 Table 4.19 Test Statistics for Mann-Whitney for Organization Sector 134 and Risk Factors Table 4.20 ANOV A for Size of Projects (RM) and Risk Factors 13 5 Table 4.21 Multiple Comparisons for Different Size of Project (RM) 135 and Risk Factors Table 4.22 ANOV A for Business Sectors and Risk Factors 136 Table 4.23 Multiple Comparisons between Different Business Sector 137 and Risk Factors Table 4.24 The Result of Factor Analysis 13 8 Table 4.25 Reliability Statistics for Factor Analysis 139 Table 5.1 Full list of Risk Factors - Cross-Case Analysis 167 Table 5.2 Content Analysis of the Risk Factors 171 Table 5.3 Risk Category and its Associated Risk Factors 187 Table 5.4 Comparison between List from Literature Review and Risk 188 Factors from Content Analysis Table 6.1 Risk Management IT Outsourcing Committee's Job 203 Description Table 6.2 Summary of Key Information, Key Process, Key Personnel 210 and Key Deliverable for Analysis of Decision to Outsource Phase Table 6.3 Proposed Outsourcing Decision based on Transaction Cost 215 Theory Table 6.4 Summary of Step, Key Information, Key Process and Key 221 Deliverable for Risk IT Outsourcing Assessment Process Table 6.5 Likelihood Level and Definition 233 Table 6.6 Impact Level and Definition 234 Table 6.7 Risk Ranking Matrix 235 Table 6.8 Risk Ranking and Definition 235 Table 6.9 Summary of Step, Key Information, Key Process and Key 245 Deliverable for Risk IT Outsourcing Treatment Process Table 6.10 Summary of Key Information, Key Process, Key Personnel 255 and Key Deliverable for Selection of Service Provider Phase Table 6.11 Technical and Financial Proposal Evaluation 269 Table 6.12 Technical and Financial Proposal Evaluation - Final Score 270 Table 6.13 Summary of Key Information, Key Process, Key Personnel 274 and Key Deliverable for Contract Management Phase Table 6.14 Summary of Key Information, Key Process, Key Personnel 290 and Key Deliverable for On-Going Monitoring Phase Table 7.1 Risk Category, Risk Factor and Risk Description in Video 315 Conferencing Project xii

13 LIST OF FIGURES Figure No. Page Figure 1.1 The Research Approach 12 Figure 2.1 Summary of Previous Researchers' Work on IT 35 Outsourcing Process Figure 2.2 Summary of Previous Researchers'Work on Risk 53 Management Figure 2.3 Difference between Managed and Unmanaged Risk 60 Figure 2.4 Risk Management in IT Outsourcing 61 Figure 3.1 Research Model 1 76 Figure 3.2 Research Model 2 86 Figure 4.1 Factors that Influenced the Practise of Risk Management in 118 IT Outsourcing Phases Figure 4.2 The Relationship between Risk Management in IT 128 Outsourcing Phases and IT Outsourcing Success Figure 6.1 Risk Management in IT Outsourcing Framework 197 Figure 6.2 Risk Management IT Committee Organisational Chart 202 Figure 6.3 Analysis of Decision to Outsource Phase 209 Figure 6.4 Risk IT Outsourcing Assessment, Risk IT Outsourcing 223 Treatment Process and Key Personnel Figure 6.5 Risk Category and Risk Factor in IT Outsourcing 228 Figure 6.6 Sample of Risk Assessment Form (RAF) 240 Figure 6.7 Sample of Risk Management Plan (RMP) 241 Figure 6.8 Selection of Service Provider Phase 257 Figure 6.9 Sample of Technical High Level Report 265 Figure 6.10 Sample of Financial High Level Report 266 Figure 6.11 Contract Management Phase 275 Figure 6.12 On-Going Monitoring Phase 291 Figure 7.1 The Mapping of Risk Management IT Outsourcing 303 Committee Organisational Chart with the Real Situation in the Organisation Figure 7.2 Risk Assessment Form (RAF) for Video Conferencing 321 Project Figure 7.3 Risk Management Plan for Video Conferencing Project 324 xiii

14 LIST OF EQUATIONS Equation No. Page Inequality 4.1 Multiple Comparison for Kruskall-Wallis 133 Equation 6.1 Risk Ranking 231 xiv

15 CHAPTER I INTRODUCTION 1.1 Research Background Outsourcing has become the most popular operation model among multinational companies throughout the world because the benefits are clear. Organisations today are experimenting with outsourcing as a means to operate more effectively in a dynamic marketplace (Tunstall, 2000). Through the utilization of service provider, organisations may reduce cost (Harris, 1996), improve strategic position and ultimately gain competitive advantage (McCray, 1996). Besides, they can also have effective human resources, higher capacity demand and better access to advanced technologies (Lee, Huynh, Kwok & Pi, 2003). According to KPMG (2004), there are two types of outsourcing activities, namely Business Process Outsourcing (BPO) and Information Technology (IT) Outsourcing. As for Asia Pacific, BPO is considered as a more matured activity as compared to IT Outsourcing. Organisations outsource through two main methods. The first one is when large organisations tend to buy internationally-based BPO on providers and use them to replace their own business process departments. The second method is smaller organisations which are generally lack in resources, hire the service of provider as a third party contractor instead of buying their own BPO providers (Sullivan, 2004). Over the last two decades, IT outsourcing has seen the largest volume of outsourcing of all functional areas, in terms of the total dollar volume of contracts signed. IT outsourcing is defined as the practise of commissioning part or all of an 1

16 organisation's IT assets, people and/or activities to one or more external service providers (Lee, Miranda & Kim, 2004). IT outsourcing started with the professional services and facility management services in the financial and operation support areas during the 1960s and 1970s. In 1960s, the computers were large and expensive; therefore, many organisations relied on other professional firms to provide the facilities. In 1970s, due to inadequate supply of IT personnel, managers began to rely on contract programming. At the beginning of 1980s, the arrival of low-cost mini computers and PCs made the outsourcing trend decline. IT was then considered as a valued in-house function. Organisations generally operated their information systems environment on a custom basis, buying standard equipment, system and application software and communications, and assembling them into an infrastructure unique to each organisation. In 1990s, again the outsourcing rose up. Instead of contract programming, outsourcing focused on network and telecommunication management, distributed system integration, application development, and systems operations. Recently, IT outsourcing has become a growing industry and will continue to grow (Lee, Huynh, Kwok & Pi, 2003). Before outsourcing a function, organisations should consider whether it is worth being outsourced. As suggested by Bragg (1998), organisations should start outsourcing with a function that has minimal strategic value and will not present a problem even if the service providers do a poor job of providing the service. If the outsourcing performed well, the organisations will consider moving to another stage: functions with more strategic value. Finally, if it proves to be successful, the organisations will be more likely to move on to outsource more important functions. By following the suggested path, organisations can eventually increase their experience in outsourcing activities. Malaysia has all it takes to attract organisations to invest in outsourcing. The infrastructure is robust, and the fiscal/tax/regulatory environment is sound and

17 affordable (Deliotte Consulting White Paper, 2005). Outsourcing is one way for the government to operate more effectively while saving money (McDougall, 2003). Therefore, Malaysian government actively involves and supports the idea of outsourcing. Malaysian government is also making its way to become a key player in the global outsourcing arena (MITI, 2005). According to the Ministry of International Trade and Industry (MITI), (2005), in its 2004 report, Malaysia has been ranked as the third most attractive destination for outsourcing activities after India and-china. It has been announced that large IT outsourcing contracts include the RM 1.3 billion Maybank deal, the RM 440 million Malaysian Airline System Berhad (MAS) deal and Permodalan Nasional Berhad (PNB) RM 32 million extension contract. Thus, a general trend towards IT outsourcing will continue (AT Kearney, 2009). With the increasing number of organisations that involved in IT outsourcing, many researchers have taken an effort to come up with ways to successfully manage IT outsourcing. It includes the risk management practises (Smith & McKeen, 2004; Linder, 2004), performing initial assessment (McCormack, 2003; Embleton & Wright, 1998; Misra, 2004), meeting the goals and objective of the project (Schwalbe, 2001; Misra, 2004; Feeny, Lacity & Willcocks, 2005), relationship with service provider (Kralovetz, 1996; Saunders, Gebelt & Hu, 1997; Diramualdo & Garbaxani, 1998; Embleton & Wright, 1998; Doherty, 2002; Fjermestad & Saitta, 2005), service provider selection process (Embleton & Wright, 1998) and contract management (Doherty, 2002; Saunders et al., 1999; Jorgensen, 1996). According to Bragg (1998), even though many organisations involved in IT outsourcing, the actual number of IT outsourcing success is low. It shows that while there are many reasons to outsource a function, there are also a number of risks associated with doing so (Bragg, 1998; Kliem, 2002; NISER, 2003). Therefore, it is important for a decision maker to be aware of this risk before making decision to outsource. As stated by McCray (1996), the outsourcing decision is highly situational and generalizations regarding its relative merits are quite difficult to construct. Due

18 to the current environment where technology and market are always shifting, organisations are facing more risks if the outsourcing activity is not managed (Jorgensen, 1996: Funk, Sloan & Zaret, 2003). Outsourcing is a significant investment that will, by necessity, affect the organisations' bottom line, culture, risk profile, customer relationship, flexibility and day-to-day operation. Therefore, quality of the services, relationship between parties, laws and legislation and cost should be taken into consideration in outsourcing activities. At the same time, consideration should also be given to complex risks such as reliability/service ability, availability, contractual obligation and security (KPMG, 2004). Outsourcing can increase a firm's vulnerability to the theft of business secrets, trade practises, proprietary processes or specific to IT outsourcing and reduce integrity of systems security (Downey, 1995). Outsourcing success relies on people as much as technology. However, since technology is relatively reliable and predictable, it is important to focus on people (Vernon, 2004). Successful outsourcing requires complex business relationship that makes business boundaries permeable. These relationships require a significant transfer of sensitive business knowledge, intellectual property and other assets to the service provider. The organisations are then exposed to numerous additional risks that increase the probability and impact of current risk. The minimum risk is that service provider is not able to meet the contract terms. An extreme risk is the service provider performing or failing to perform activities leading to catastrophic consequences. Risk and risk management have been widely studied in various contexts such as finance, economics, insurance, health care, operation research and engineering (Dhar & Balakrishnan, 2006). Each discipline has its own way of analyzing and interpreting risks. Over two decades ago, the application of risk management to IT projects were not quite accomplished (Charette, 1996). However, it is now gaining its popularity. Therefore, Linder (2004) listed managing risk explicitly as one of the critical success factors in effective outsourcing. Reed (2005) agreed when he

19 mentioned that it is important to perform active risk management. Risk management, when effectively applied, can be a powerful tool to make organisations proactively sees the opportunities as well as the risk (Charette, 1996). Even though the importance of risk management is realized, KPMG (2004) revealed that the number of organisations that apply risk management is low due to lack of knowledge. Therefore, there is a need to increase the awareness of the importance of risk management in IT outsourcing as organisations can effectively manage the risks in today's challenging environment. 1.2 Problem Statement IT outsourcing is not a new phenomenon but rather has rooted back to the timesharing service bureaus of the 60s and 70s (McLellan & Marcolin, 1994). It is a topic that received enormous attention in the industry as well as in the research community (Rustagi, 2004). As described by Rustagi (2004), there have been many researches in this area to improve the outsourcing activity. However, most of the researches in outsourcing have only focused on why, how and what have organisations outsourced, the client vendor relationship and the factors influencing the outsourcing success (Rustagi, 2004). Only few literatures emphasize the importance of risk management in IT outsourcing (KMPG, 2004). Outsourcing IT functions may appear to cut cost and maximize profit. However, it can also cause other significant risks if they are not managed effectively. In other words, outsourcing may ultimately increase rather than decrease the total risks. Excess success stories about outsourcing may lead organisations to the conclusion that they must outsource a function when in reality the number of outsourcing success are fewer than reported (Bragg, 1998). Even with the increasing number of organisations that involved in IT outsourcing, many organisations fail to realise the real number of IT outsourcing project that are actually success and the number of failure. Lacity and Hirschheim (1993) mentioned that most of the organisations

20 claimed the success at the honeymoon period of IT outsourcing. Problems in IT outsourcing will mostly occurred after that. According to Fowler and Jeffs (1998) and Khaflan (2003), many organisations were trying to hide their failure to prevent the negative effect. In Malaysia, the success and failure rate remains a question. Therefore, it is important to identify the success and failure rate in Malaysia so that managers are aware that IT outsourcing project is not a panacea; it comes together with risk. Therefore, before making the decisions to outsource, it is important to analyze the risk (Funk et. al., 2003; KPMG, 2004). Previous researches have shown that risk management contributes to the probability of project success (Aubert, Dussault, Patry & Smith, 1998; Noor Habibah, Azlinah & Zaiha, 2006 a,b ). Noor Habibah et al. (2006 a ' b ) also mentioned that in Malaysia, only 8% of the respondents practise risk management. Even though the percentage was small, the same research also revealed that only 14.3% of the respondent identified risk management as not important. The small number of percentage indicates that most of the project managers were aware of the importance of risk management practises in minimizing IT project failure. Finding by KPMG (2005) also mentioned that risk management in IT outsourcing awareness is high, but the number of organisations that implement risk management is low. Even though many literatures discuss IT outsourcing risks and mitigation strategies, there are no agreed upon framework or model for assessing IT outsourcing risks (Sullivan & Ngwenyama, 2005). Sullivan and Ngwenyama (2005) also described that outsourcing risk factors are widely acknowledged in the literature but are not fully addressed in the outsourcing guidelines for the decision making and the IT outsourcing engagements. Most of the researchers done previously only stressed on the awareness of risk management in IT outsourcing project. It lacked the step-bystep guidelines to manage risk in IT outsourcing project. Most of the literature addressed one or more of the elements in an isolated manner. Other gaps as mentioned by previous researchers including lack of risk management practises,

21 limited research on setting up the risk management in IT outsourcing committee, lack of risk negotiation and risk sharing elements, lack of enhancement of risk o management practise in each and every phase of IT outsourcing and limited guidelines that have structured flow (Chen et al., 2002; Feldman, 2002; Sullivan & Ngwenyama, 2005; AOICS, 2003; McCormack, 2003; KPMG, 2004; Benedikt & Frank, 2009). From the literature, it can be said that there has never been any specific empirical study on risk management in IT outsourcing carried out in Malaysia. At the same time, it is also reported, there is going to be more emphasis on IT outsourcing in Malaysia in the future (AT Kearney, 2009). Therefore, there is a need to analyse the practises of risk management and the impact of practising risk management so as to increase the awareness of the importance of risk management thus increase its application. There is a need to identify risks from Malaysian perspective so that the risk management strategy undertaken suits the Malaysian environment. With all the issues and affirmation that have been highlighted in managing risk, it is important to create a framework that can overcome the issues. 1.3 Aim And Objectives of the Research The aim of this research is to construct a framework for risk management in IT outsourcing that can aid organisations in identifying and managing risk in IT outsourcing activities in Malaysian context. Specifically, the objectives of the study are: 1. To identify success rate of IT outsourcing 2. To investigate the factors that influenced the practise of risk management in IT outsourcing phases 3. To assess risk management activities practise in IT outsourcing

22 4. To investigate the relationship between the practises of risk management in IT outsourcing phases and IT outsourcing success o 5. To rank the risk factors from previous studies and investigate the organisation's perception regarding those risk factors 6. To identify new risk factors in IT outsourcing as envisioned by the IT managers in Malaysia 7. To construct framework for risk management in IT outsourcing 8. To apply the framework in a case study 1.4 Importance of the Research The IT outsourcing in Malaysia started when Central Bank of Malaysia (Bank Negara) has been pushing local banks to seek out for outsourcing partners to handle non-critical functions of the business (ITworld, 2002). The pioneer of IT outsourcing is Bumiputra-Commerce Bak (BCB) (recently known as CIMB) that took its step to outsource its IT function to EDS. Since that, other organisations followed their step with Maybank, Malaysian Airline System (MAS) and Permodalan National Berhad (PNB) as among the organisations that signed for large IT outsourcing contracts. The government of Malaysia has actively involves and supports the idea of outsourcing (MITI, 2005). According to the MITI (2005), Malaysia has been ranked as the third most attractive destination for outsourcing after India and China. A research done by AT Kearney (2009) shows that there is going to be more emphasis on IT outsourcing in Malaysia in the future. Since the IT outsourcing trends in Malaysia is continuously growing, it is important that IT outsourcing projects are properly managed (KPMG, 2004). It is important that risk to be identified and managed. This research is therefore is important to help the organisations to identify risk in IT outsourcing and to manage the risk thus contribute to the success of IT outsourcing project. 8

23 In ability to deliver the objectives of this research, mixed method techniques is used. The usage of quantitative research method allow establishment of a clear purpose, ensuring testability, replicability, precision and confidence, objectivity, generalisability and parsimony (Sekaran, 1992). Meanwhile, the usage of qualitative research method allows the in-depth and detail exploration to be conducted (Patton, 1990). In the quantitative method, questionnaire is used because it is the best way to collect information from a large pool of respondent (Malhotra, 1996). The questionnaire is designed and distributed to top managers in both private and public organisations that involved in IT outsourcing. In qualitative method, interview is conducted because it is one of the best ways to understand a respondents' past experience, thought and attitudes (Guba & Lincoln, 1981). The interview was conducted with top managers from nine organisations. 1.5 Usefulness of the Research The study provides empirical data on the success and failure rate in IT outsourcing projects in Malaysia. This information is very useful since it is important to know the success rate for IT outsourcing in Malaysia as it allows the organisations to realise that IT outsourcing project may fail especially without the presence of risk management activity. The study revealed that risk management in IT outsourcing phases contributed to the success of IT outsourcing. This finding will allow the organisations to realise the importance of risk management to be adopted in IT outsourcing project to reduce and manage risk and to increase the probability of success. The study provides list of risk factors that represents Malaysian environment. Some of the risk factors have never raised the attention of the other researchers. The list of risk factors will be very useful to be used as a tool and guideline to help organisations to identify risk in the IT outsourcing project. The risk management in 9

24 IT outsourcing framework proposed in the study can be useful for providing guidelines for managing risk in IT outsourcing project. 1.6 Novelty of the Research The novelty of this research includes the success rate of IT outsourcing project. There has never been any specific empirical study on success and failure rate in IT outsourcing in Malaysia thus contributed to the originality of this research. There is no research so far in Malaysia that investigated the relationship between risk management and IT outsourcing success in Malaysia. This study conducted the investigation thus contributed to the novelty of the research. The study has identified new risk factors as envisioned by the managers in Malaysia. These new risk factors have contributed to the originality of the study. There are not many researches that focus on the step-by-step guidelines to manage risk in IT outsourcing. Therefore, this research focuses on holistic and integrated approach in managing risk in IT outsourcing thus contributed to the novelty of the research. 1.7 Contribution of the Research Towards the development of the framework, empirical works have been conducted. The finding of the research has contributed to the success rate of IT outsourcing. Factors that influenced the practises of risk management in IT outsourcing phases in Malaysia are also revealed. The finding also provides the assessment of risk management activities practises in IT outsourcing in Malaysia. The research also contributes by providing empirical support to establish the relationship between risk management in IT outsourcing phases and IT outsourcing success. Besides that, the 10