Many firms have adopted outsourcing in recent years as a means of governing their information technology (IT) operations. While outsourcing is associated with significant benefits, it can also be a risky endeavour. This paper proposes a scenario-based conceptualization of the IT outsourcing risk, wherein risk is defined as a quadruplet comprising a scenario, the likelihood of that scenario, its consequences and the risk mitigation mechanisms that can attenuate or help avoid the occurrence of a scenario. This definition draws on and extends a risk assessment framework that is widely used in engineering. The proposed conceptualization of risk is then applied to the specific context of IT outsourcing using previous research on IT outsourcing as well as transaction cost and agency theory as a point of departure.
Get full access to this article
View all access options for this article.
References
1.
AlchianA.A., and DemsetzH. (1972). Production, information cost and economic organization. American Economic Review, 62, 777–92.
2.
AshtonT. (1998). Contracting for health services in New Zealand: a transaction cost analysis. Social Science Medicine, 46(3), 357–367.
3.
AubertB.A., RivardS., and PatryM. (1996). A transaction costs approach to outsourcing: some empirical evidence. Information and Management, 30, 51–64.
4.
AubertB.A., PatryM., and RivardS. (1998). Assessing IT outsourcing risk. In Proceedings of the 31st Hawaii International Conference on System Sciences, WatsonH. (ed.) IEEE, Hawaii.
5.
AubertB.A., PatryM., RivardS., and SmithH. (2001). IT outsourcing risk management at British Petroleum. In Proceedings of the 34th Hawaii International Conference on Systems Sciences, WatsonH. (ed.) IEEE, Hawaii, January.
6.
AubertB.A., PatryM., and RivardS. (2002). Managing IT outsourcing risk: lessons learned. In Information Systems Outsourcing: Enduring Themes, Emergent Patterns and Future Directions, HirschheimR.A., HeinzlA., and DibbernJ. (eds) (Springer-Verlag, New York), pp. 155–76.
7.
AubertB.A., PatryM., and RivardS.Gérer le risque d'impartition des technologies de l'information. Gestion.
8.
AubertB.A., HoudeJ.F., PatryM., and RivardS. (2003a). Characteristics of IT outsourcing contracts. In Proceedings of the 36th Hawaii International Conference on System Sciences, SpragueR. (ed.), IEEE, Hawaii.
9.
AubertB.A., PatryM., and RivardS. (2003b). A tale of two outsourcing contracts: an agency-theoretical perspective. Wirtschaftsinformatik, 45(2), 181–90.
10.
AuerJ. (1999). Arbitration could be better alternative in IT contracts disputes. Computerworld, 33(9), 58–9.
11.
BarkiH., RivardS., and TalbotJ. (1993). Toward an assessment of software development risk. Journal of Management Information Systems, 10(2), 203–25.
12.
BarzelY. (1982). Measurement cost and the organisation of markets. Journal of Law and Economics, 25(1), 27–48.
13.
ClarkT.D., ZmudR.W., and McGrayG.E. (1995). The outsourcing of information services: transforming the nature of business in the information industry. Journal of Information Technology, 10(4), 221–37.
14.
CollinsH. (1999). Regulating Contracts (Oxford University Press, Oxford).
15.
CrockerK.J., and ReynoldsK.J. (1993). The efficiency of incomplete contracts: an empirical analysis of air force engine procurement. Rand Journal of Economics, 24, 126–46.
16.
CrossJ. (1995). IT outsourcing: British Petroleum's competitive approach. Harvard Business Review, 73(3), 95–102.
17.
CurrieW., and WillcocksL. (1998). Analyzing four types of IT outsourcing decisions in the context of size, client/supplier interdependency and risk mitigation. Information Systems Journal, 8, 119–143.
18.
De LooffA.L. (1995). Information systems outsourcing decision-making: a framework, organizational theories and case studies. Journal of Information Technology, 10(4), 281–97.
19.
DozL. (1996). The evolution of co-operation in strategic alliances: initial conditions or learning processes?Strategic Management Journal, 17, 55–79.
20.
EarlM.J. (1996). The risks of outsourcing IT. Sloan Management Review, 37(3), 26–32.
21.
EisenhardtK.M. (1989). Agency theory: an assessment and review. Academy of Management Review, 14(1), 57–74.
22.
GenusA. (1997). Unstructuring incompetence: problems of contracting, rust and the development of the Channel Tunnel. Technology Analysis and Strategic Management, 9(4), 419–36.
23.
HarrisA., GiunperoC.L., and HultM.T. (1998). Impact of organisational and contract flexibility on outsourcing contracts. Industrial Marketing Management, 27(5), 373–84.
24.
HeideB., and JohnG. (1988). The role of dependence balancing in safeguarding transaction-specific assets in conventional channels. Journal of Marketing, 52, 20–35.
25.
JohnsonM. (1997). Outsourcing in Brief (Butterworth-Heinemann, Oxford).
26.
KaplanS., and GarrickB.J. (1981). On the quantitative definition of risk. Risk Analysis, 1(1), 11–27.
27.
KernT., and WillcocksL (2002). Exploring relationships in information technology outsourcing: the interaction approach. European Journal of Information Systems, 11, 3–19.
28.
KernT., WillcocksL., and LacityM.C. (2002a). Application service provision: risk assessment and mitigation. MIS Quarterly Executive, 1(2), 47–69.
29.
KernT., WillcocksL., and Van HeckE. (2002b). The winner's curse in IT outsourcing: strategies for avoiding relational trauma. California Management Review, 44(2), 47–69.
30.
KeyR. (1995). Outsourcing: how to contract with third party vendors. ABA Bank Compliance, 16(4), 5–12.
31.
KleinB., CrawfordG., and AlchianA. (1978). Vertical integration, appropriable rents, and the competitive contracting process. The Journal of Law and Economics, 1, 297–326.
32.
KlepperR., and JonesO.W. (1998). Outsourcing Information Technology, Systems & Services (Prentice-Hall, Upper Saddle River, NJ).
33.
KossA.P., and EatonC.B. (1997). Co-specific investments, hold-up and self-enforcing contracts. Journal of Economic Behaviour & Organisation, 32(3), 457–70.
34.
LacityM.C., and HirschheimR. (1993). Information Systems Outsourcing: Myths, Metaphors and Realities (John Wiley & Sons, Chichester).
35.
LacityM.C., and WillcocksL.P. (2000). Inside IT Outsourcing: A State-of-Art Report (Templeton College, Oxford).
36.
LacityM.C., and WillcocksL.P. (2001). Global Information Technology Outsourcing: Search for Business Advantage (John Wiley & Sons, Chichester).
37.
LacityM.C., and WillcocksL.P. (2002). Application service provision: risk assessment and mitigation. MIS Quarterly Executive, 1(2), 113–26.
38.
LacityM.C., WillcocksL.P., and FeenyD.F. (1995). IT outsourcing: maximize flexibility and control. Harvard Business Review, 73(3), 85–93.
39.
LeiferR., and MillsK. (1996). An information processing approach for deciding upon control strategies and reducing control loss in emerging organizations. Journal of Management, 22(1), 113–138.
40.
LowellM. (1992). Managing your outsourcing vendor in the financial services. Journal of Systems Management, 43(5), 23–33.
41.
McFarlanW., and NolanL. (1995). How to manage an IT outsourcing alliance. Sloan Management Review, 36(2), 9–23.
42.
MacNeilI. (1983). Values in contract: internal and external. Southern California Law Review, 78, 340–9.
43.
MarchJ., and ShapiraZ. (1987). Managerial perspectives on risk and risk taking. Management Science, 33, 1404–18.
44.
MilgromP., and RobertsJ. (1992). Economics, Organisation, and Management (Prentice-Hall, Englewood Cliffs, NJ).
45.
MorrisseyJ. (2003). Not paying off. Modern Healthcare, 33(19), 3.
46.
NgwenyamaK.O., and BrysonN. (1999). Making the information systems outsourcing decision: a transaction cost approach to analyzing outsourcing decision problems. European Journal of Operational Research, 115(2), 351–67.
PillingB.K., CrosbyL.A., and JacksonD.W. (1994). Relational bonds in industrial exchange: an experimental test of the transaction cost economic framework. Journal of Business Research, 30, 237–51.
49.
PorterM. (1985). Competitive Advantage Creating and Sustaining Superior Performance (The Free Press, New York).
50.
RichardsonJ. (1993). Parallel sourcing and supplier performance in the Japanese automobile industry. Strategic Management Journal, 14(5), 339–350.
51.
SappingtonD. (1991). Incentives in principal–agent relationships. Journal of Economic Perspectives, 3(2), 45–66.
52.
ScheierR.L. (1996). Outsourcing's fine print. Computerworld, 30(34), 70.
53.
ThompsonL.R., HigginsA.C., and HowellM.J. (1994). Influence of experience on personal computer utilization: testing a conceptual model. Journal of Management Information Systems, 11(1), 167–87.
54.
Van der VliertE. (1998). Motivating effects of task and outcome interdependence in work teams. Group and Organisation Management, 23(2), 124–143.
55.
Vincent-JonesP. (2000). Contractual governance: institutional and organizational analysis. Oxford Journal of Legal Studies, 20(3), 317–51.
56.
WalkerG., and PoppoR. (1991). Profit centers, single-source suppliers, and transaction costs. Administrative Science Quarterly, 36, 66–87.
57.
WalkerG., and WeberD.A. (1984). Transaction cost approach to make-or-buy decisions. Administrative Science Quarterly, 29(3), 373–91.
58.
Wall Street Journal (2001). EEDS wins contract extension for Xerox project. 29 November, B8.
59.
WhiteR., and JamesB. (1996). The Outsourcing Manual (Gower Publishing Limited, Hampshire, England).
60.
WillcocksL., LacityM., and KernT. (1999). Risk mitigation in IT outsourcing strategy revisited: longitudinal case research at LISA. Journal of Strategic Information Systems, 8, 285–314.
61.
WilliamsonO.E. (1985). The Economic Institutions of Capitalism (Sage Free Press, New York).
62.
WyboD.M., and GoodhueL.D. (1995). Using interdependence as a predictor of data standards: theoretical and measurement issues. Information and Management, 29(6), 317–29.
