LegalBytes. Take That Back: Drivers and Considerations for Insourcing. Special Edition

Similar documents
IMAS Regulatory Roundup - Outsourcing, Technology and Data Protection How does it impact fund management companies?

PRINCIPLES ON OUTSOURCING OF FINANCIAL SERVICES FOR MARKET INTERMEDIARIES

Top 10 Tips and Tools for Meeting Regulatory Requirements and Managing Cloud Computing Providers in the United States and Around the World

Effectively using SOC 1, SOC 2, and SOC 3 reports for increased assurance over outsourced operations. kpmg.com

Cloud Computing: Privacy and Other Risks

APES GN 30 Outsourced Services

Mineral Commodities Trading

Oracle ERP Support Benchmark Findings

Annex 1. Contract Checklist for Cloud-Based Genomic Research Version 1.0, 21 July 2015

Making payroll pay Managing risk and compliance in an unprecedented era of change

Cloud Computing: Legal Risks and Best Practices

Common Student Information System for Schools and School Boards. Project Summary

Supplier Relationship Management. ISM Philadelphia, Inc. September 12, 2013

2014 HIMSS Analytics Cloud Survey

Shared services. Getting IT right. A report by Eduserv

OUTSOURCING POLICY

OUTSOURCING REGULATIONS IN THE BANKING AND INSURANCE INDUSTRIES IN ASIA PACIFIC

Wealth Management. Global. Informed choices

Emptoris Contract Management Solution for Healthcare Providers

Personal data and cloud computing, the cloud now has a standard. by Luca Bolognini

CFPB Readiness Series: Compliant Vendor Management Overview

9/14/2015. Before we begin. Learning Objectives. Kevin Secrest IT Audit Manager, University of Pennsylvania

Insights into Cloud Computing

& FINANCIAL SERVICES US TAX & FINANCIAL SERVICES ACROSS THE WORLD. ustaxfs.com

Choosing the Right Master Data Management Solution for Your Organization

Healthcare Outsourcing Overview: Staying Focused in Uncertain Times

The Ultimate Guide to Buying HR Software for your Growing Business. Get your decision right with this step-by-step guide!

Isaac Willett April 5, 2011

The New Third-Party Oversight Framework: Trust but Verify kpmg.com

Baker & McKenzie LLP is a member firm of Baker & McKenzie International, a Swiss Verein with member law firms around the world. In accordance with

Outsourcing and Offshoring A Case Study: Zurich Financial Services

Shared Services. A Huron Service Delivery Design Offering Discussion Document. Megan E. Cluver mcluver@huronconsultinggroup.com

White Paper on Financial Institution Vendor Management

Software Licensing and Pricing Best Practices. Stewart Buchanan June 3, 2009 Gartner Webinar

Managing Outsourcing Arrangements

Managed Security Services

Successful Strategies for Implementing SaaS/Cloud Solutions in Healthcare

GUIDANCE NOTE OUTSOURCING OF FUNCTIONS BY ENTITIES LICENSED UNDER THE PROTECTION OF INVESTORS (BAILIWICK OF GUERNSEY) LAW, 1987

Quick Guide: Managing ICT Risk for Business

APPENDIX 3 TO SCHEDULE 8.1

Risk Management of Outsourced Technology Services. November 28, 2000

CORL Dodging Breaches from Dodgy Vendors

Commercial Software Licensing

LEGAL ISSUES IN CLOUD COMPUTING

Anatomy of an IT Outsourcing Deal. Bruce Laco Deloitte John Pickett IT World Canada Barry Sookman McCarthy Tetrault

A buyer can buy either the shares of the company that owns the target business or simply buy the assets which make up that business:

Services Providers. Ivan Soto

The Use of Cloud Computing for the Storing and Accessing of Client Information: Some Practical and Ethical Considerations

Rapid Dispositions Handbook

Pillsbury Global Sourcing BETTER DESIGN. BETTER DECISIONS. BETTER RESULTS. Pillsbury Winthrop Shaw Pittman LLP

Cloud Computing Risks & Reality. Sandra Liepkalns, CRISC sandra.liepkalns@netrus.com

14 December 2006 GUIDELINES ON OUTSOURCING

How To Plan For Cloud Computing

OBLIGATION MANAGEMENT

Negotiating ERP Implementation Agreements for Success

September Tax accounting services: The impact of transfer pricing in financial reporting

ERP. Key Initiative Overview

A Practical Guide to Legacy Application Retirement

Best Practices in adopting a Shared Services Model August YYYY

Master s Certificate in Public Sector Management

PMO Director. PMO Director

Outsourcing in the Financial Services Industry: Finding Opportunities and Managing Risk. New York. OCC and FRB Guidance on Managing Third-Party Risk

Sales Compensation Automation Trends Survey

Partnership with Industry New Business Model and Service Delivery

VENDOR RISK MANAGEMENT UPDATE- ARE YOU AT RISK? Larry L. Llirán, CISA, CISM December 10, 2015 ISACA Puerto Rico Symposium

Data Management: Considerations for Integrating Compliance Requirements At Home and Abroad. Toronto, Ontario June 14, 2005

Share the webinar Ask a question Votes (polling questions) Rate (before you leave) Attachments (you can download today s presentation)

Promoting Cross Border Data Flows Priorities for the Business Community

Transcription:

LegalBytes Special Edition November 27, 2012 Print version For more information Samuel Kramer T +1 312 861 7960 samuel.kramer@bakermckenzie.com Michael Mensik T +1 312 861 8941 michael.mensik@bakermckenzie.com Take That Back: Drivers and Considerations for Insourcing This past year, Baker & McKenzie conducted a survey of customers and service providers to evaluate what factors drive value in successful outsourcing engagements. Successful managed services go well beyond cost-cutting and standardization, and also include the commitment and buy-in of senior executives; engagement of qualified sourcing advisors, lawyers and subject matter experts; a well drafted scope of work; and meaningful service levels. Outsourcing arrangements can easily fail to live up to expectations without significant alignment of the customer and service provider on a wide range of issues that can become misaligned over time. Your company is in the fourth year of a five year outsourcing deal. Some things have gone well, while other parts have the relationship have gone poorly. You are at an inflection point in the outsourcing life cycle and need to make some decisions. Allow the service agreement to roll over for the built-in additional term, and work on improving the problem aspects of the deal. Enter into negotiations with your service provider for a new outsourcing arrangement with terms that maintain the parts of the deal that are working and terms that address the parts that don't. Or begin gathering requirements for an RFP and test the market for alternative solutions and providers. These are the three "r"s of end-of-term outsourcing engagements - renew, renegotiate or retender. Sometimes companies choose a different path - the fourth "r" of the outsourcing contract life cycle - "reversal". Reversing the outsourcing process, or insourcing the function back in house, can be a viable option for some companies. Where an outsourcing relationship has not met the customer's expectations, it is natural to second guess the original decision to outsource. However, insourcing a function is not a declaration that the original outsourcing decision was mistaken. Any number of drivers can tip the balance in favor of insourcing an outsourced service. These drivers may include: Peter George T +1 312 861 6587 peter.george@bakermckenzie.com The function is now core to the customer's business strategy. A business that undergoes a change of business model to become more reliant on cloud computing for service delivery to its clients may want to insource the management of its IT infrastructure. The function is high touch. The direct outputs of the function are highly visible to key customers or senior executives, requiring greater control of or flexibility in the function than can be accommodated by a service provider. There is a bad cultural fit. The customer and service 1

provider teams have not are unable to work together effectively due to misalignment at the organizational level. Compliance obligations require greater security and other controls. The regulatory environment imposes increasing burdens to maintain the security of data that may undermine the original business case for the outsourcing. Your company has made the decision to insource the outsourced functions from the service provider. It needs to conduct due diligence of the service provider's performance. Although the customer may have a good deal of information on the processes from the initial transition, changes and transformation over the term of the service provider's performance makes detailed diligence and reverse knowledge transfer essential. In planning for insourcing, the customer needs to take into account not only the changes the service provider has made to the functions, but also to recognize that the environment may have changed significantly since the function was originally outsourced, with a new emphasis on cloud computing, mobility, and data flows, to name a few. One of the first considerations in taking back a function in house from a service provider is the staffing plan for the insourced function. In order to ensure service continuity and reacquisition of the "tribal knowledge" of the outsourced process, customers may consider rebadging in-scope service provider employees. Often, service providers resist rebadging their in-scope staff where they are available to be transitioned to other accounts. If the customer has to re-staff the insourced function, it will need substantial cooperation from the service provider, including reverse job shadowing and training on the policies and procedures required to take over the functions during reverse transition. In some cases, the in-scope employees will have rights under local employment law to claim automatic transfer of the employment relationship to the customer. "Reverse TUPE" automatic transfers may put the customer in a bind: take on the transferring in-scope employees at their existing seniority and compensation -- even if those employees contributed to performance problems -- or face potentially expensive severance payments or unjust termination claims. A welldrafted master services agreement should address potential reverse TUPE implications and risks at the outset of the outsourcing. Whether or not the customer takes on board in-scope service provider employees, it is crucial for the service provider to update all policies and procedures manuals for the training of the staff that will be performing the insourced function. Since the customer is as vulnerable during the termination assistance period as it was during the initial transition, the exit plan should properly incentivize the service provider to fully commit to a successful reverse transition of the service back to the customer. Planning for insourcing requires the customer to diligence the then-current solution. What are the post-expiration rights in the service provider's tools? Are they critical to the on-going 2

performance of the service? Will the customer have to reengineer the solution and acquire a substitute tool set prior to the expiration of termination assistance services? Or does the master services agreement provide for post-expiration rights in the service provider tools after the service provider has fully disengaged? The cost of providing the service in-house may increase where the customer needs to acquire new software tools and stand up customer specific hardware, especially if it was receiving services from the service provider from a highly leveraged infrastructure. Preparing the customer's infrastructure to accommodate the insourced function also must be part of the planning process. In reacquiring outsourced HR services, for example, implementing HR modules in ERP systems may add significant costs in additional license fees and extend the duration of the outsourcing until upgraded functionality is fully implemented. Taking over the outsourced function has implications for contractual rights beyond service provider tools. Are there key subcontractors or other third party providers currently providing some portion of the services? Will those relationships transfer to the customer as part of the insourcing? Were key customer contracts assigned to the service provider that need to be reconveyed to the customer? The customer's due diligence exercise should extend to the entire third party network -- the service provider's "extended enterprise" - that is used to perform the outsourced function. Re-acquisition of the outsourced function routinely involves transfers of large amounts of data -- historical data, performance data and personal data -- from the service provider to customer. Especially where data transfers cross borders, customers will need to consider data privacy laws, including security obligations, in taking over control and custody of data. The data environment may be significantly more complex than at the outset of the outsourcing if the service provider has distributed the functions across multiple geographies, and data needs to be repatriated to the original customer locations. In addition to data security, the customer will have to diligence other internal controls in the service provider environment. The outsourced function may be heavily reliant on internal controls in effect in the service provider environment. The customer may have to replicate the control environment of the service provider, at least in the short term, in order to maintain compliance, including for ISO compliance and internal auditing purposes. Part of the insource planning should include the steps necessary to maintain appropriate controls during reverse transition and conform the function to the customer's control environment. Bringing the outsourced function back in house creates an opportunity for the customer to assess where that function should fit within its organization. Should it be a decentralized function performed in each region or country, or should it be consolidated into a shared services platform for the benefit of the whole organization? Does the customer entity providing the services have the legal, regulatory and financial capacity to perform the insourced services? Will they performed in the 3

same manner as previously performed by the service provider? Will quality or performance and service levels still be monitored and measured on the function is in-house? Insourcing also raises issues for internal accounting. Will the chargeback mechanisms used by the service provider be maintained after the function goes back in house? Will operations have sufficient visibility into the internal consumption of service to be able to allocate charges across the customer enterprise? Or will the service be folded under existing intercompany service agreements? What are the possible direct and indirect tax implications of the in-sourced delivery model that need to be identified and accommodated so as to avoid problems down the road? The decision to unwind an outsourcing arrangement and take it back in house may be the right answer for an organization, but cannot be taken lightly or in reaction to unmet customer expectations. Significant planning and organizational preparation is required to successfully insource a function, including: Diligencing the service provider environment prior to commencement of termination assistance. Providing meaningful incentives for the service provider to invest in a successful reverse transition. Consideration of the employment, security and other compliance implications of migrating the services from a third party back in-house. Determining how the services will be provided from within the organization and how they will be accounted for. Proper planning and diligence, together with organizational commitment, can successfully migrate an outsourced service back to the customer's operations. Without this commitment of resources and effort up front, the insourced solution is as vulnerable to failure to live up to expectations as the initial outsourcing. Subscribe to more publications Privacy Policy www.bakermckenzie.com Baker & McKenzie International is a Swiss Verein with member law firms around the world. In accordance with the common terminology used in professional service organizations, reference to a "partner" means a person who is a partner, or equivalent, in such a law firm. Similarly, reference to an "office" means an office of any such law firm. This may qualify as "Attorney Advertising" requiring notice in some jurisdictions. Prior results do not guarantee a similar outcome. Before you send e-mail to Baker & McKenzie, please be aware that your communications with us through this message will not create a lawyer-client relationship with us. Do not send us any information that you or anyone else considers to be confidential or secret unless we have first agreed to be your lawyers in that matter. Any information you send us before we agree to be your lawyers cannot be protected from disclosure. 4

5