Most IT directors have rejected board-level control of outsourcing relationships

Most IT directors have rejected the idea of a dedicated board-level executive to control outsourcing relationships, despite growing calls for business executives to be more involved in managing IT outsourcing contracts.

In a survey of 100 UK IT directors for Indian outsourcing specialist HCL Technologies, 84 percent were against appointing a chief outsourcing officer. And most IT directors argued that they themselves, and not finance or procurement executives, should represent outsourcing issues at board level.

The findings suggest that IT directors are keen to cling to responsibility for IT outsourcing contracts, either to retain their influence or ensure they themselves are not outsourced.

But Vineet Nayar, chief executive of HCL, said that it was unclear if IT directors will be able to retain this level of control as the role of outsourcing continues to expand. Some experts also argued that IT directors’ lack of expertise in partnership management is partly to blame for the high proportion of outsourcing deals that fail to meet firms’ expectations.

Speaking at Gartner’s European Outsourcing Summit in London last week, Gartner analyst Roger Cox predicted that more IT directors will lose primary responsibility for outsourcing. “IT directors will still be involved in developing [contract] parameters, but increasingly decisions happen at board level,” he said.

Even if IT directors retain responsibility for outsourcing they will have to work more closely with other business executives when managing outsourcing relationships, according to Paul Hoyland of IT services specialist Unisys. “IT directors have to include all the business stakeholders who are going to be affected by a decision to outsource and make them collaborate with the service provider to outline what they require,” he said.

A new publication from the UK’s privacy watchdog has also highlighted the importance of good management controls when outsourcing personal data.

The Information Commissioner’s Office (ICO) said organisations had asked for advice to help them comply with the law when handing over employee data for processing by third parties; and it had also received enquiries from individuals worried about the protection of their personal details in outsourced systems.

According to the guidance, companies must be aware that they are responsible at all times for the security and accuracy of personal information processed by third parties on their behalf. The ICO stressed that businesses will be held liable for breaches of the Data Protection Act even if the outsourced systems are based abroad.

“There have been several highly publicised instances recently [involving outsourcing overseas] which suggest that personal information is not always secure,” said deputy commissioner David Smith.

Smith advised firms to choose outsourcing partners that can be relied upon to take “proper care” of personal information and to establish mechanisms to check data is being properly looked after.

The guidance also encourages firms to check that outsourcers have ensured the reliability of staff, and to insist that security breaches and related problems are reported.

The advice is aimed at smaller firms or those organisations that do not have an in-house data protection specialist. Copies can be downloaded from the ICO web site.