Outsourcing: Know your partners' business continuity plans

Widely recognised as a great way to improve efficiency and allow for a focus on core business, outsourcing also presents specific risks to business continuity. That's because an incident at a service provider can have a knock-on effect, interrupting production at your company even though you might have a thorough business continuity plan of your own.

That's according to Peter Westcott, senior Business Continuity Management advisor at ContinuitySA, who advises stringent due diligence in selecting an outsource partners.

"Managing your outsourcing partners is very important to avoid being compromised by an incident that affects them. If they aren't able to recover timeously, the knock-on can be devastating to your ability to continue delivering to the expectations of your clients," he says.

For example, consider the case of the imaginary company United Cellular, which manufactures handsets. It's a highly competitive business with a demanding customer base. Quick turnaround and highest quality are essential - along with a competitive price, of course. To help meet these demanding requirements, United Cellular outsources the manufacture and fitting of the LCD screens to a third party, GCD. Thanks to the large volumes it manufactures, GCD can offer a good price and superb quality.

It's a symbiotic relationship but does United Cellular fully understand the implications of a manufacturing disruption at GCD? Handsets are released to the market at pre-arranged times, and if United Cellular's handsets are not available, the void will be filled by competitors.

"In fact, United Cellular will feel the effects of the stoppage more than GCD itself," Westcott observes. "GCD will still invoice United Cellular for every screen delivered: GCD is affected only by delayed revenue while United Cellular has probably lost a lot of revenue as many customers due for an upgrade will opt for another android handset - consumers are impatient impulse buyers."

This web of interdependencies could be even more complex if, say, GCD had in turn outsourced a part of its manufacturing process, and that supplier experienced a disruption.

It's thus vital, Westcott stresses, that each company ensures that suppliers and outsourcing partners do have proven business continuity plans so as to ensure that its strategic objectives (product delivery expectations) can be met.

"If your supply chain partners do not have proven business continuity plans (think contingency options) in place, you will be impacted at some point," Westcott states. "Their lack of business continuity thus compromises yours."

Owing to the complex interaction of processes, departments and activities that go into the creation of products and services, he says the simple act of outsourcing any one of these aspects can have unexpected consequences. "This means the impact of an outage at a supplier isn't always fully understood. It routinely runs deeper than anticipated, affecting more of your business than is immediately obvious."

This is apparent in the example above; GCD may have been just one of the outsourcing partners, but disruption of its manufacturing process delayed the delivery of United Cellular's flagship product, deemed crucial to the company's survival.

Westcott continues, "The more you outsource, the more complex your business continuity becomes. The interdependencies become a spider's web; trying to understand how everything fits together can take time and effort, but failing to do so will almost always result in an impact on your business."

He adds that most SLAs document turnaround times and uptime, but not recovery time.

Ensuring that business continuity is sufficiently robust thus depends on analysing the recovery capability of outsource partners. "Before selecting an outsource partner, make sure they have a proven business continuity programme by reviewing their business impact analysis documents, business continuity plans and IT disaster recovery plans."

Westcott advises a detailed examination of these documents, but he says some resistance is possible. "You will want to see if the plans speak to the delivery of the product or service your partner provides and upon which you are going to depend, and not just the recovery of a department. By the same token, though, it is important to focus only on those processes that impact on the service offered to your company - your partner will be understandably reluctant to reveal its full business continuity plan."

If the partner cannot commit to recovering within the timeframes you expect, then Westcott is adamant: "Find another outsourcing partner."