Journal of Operational Risk

Risk.net

Outsourcing risk: a separate operational risk category?

Jürgen Bott and Udo Milkau

  • The term ‘outsourcing risk ‘needs caution, as any sourcing includes an operational risk potential.
  • Any entrepreneurial decision for ‘make or buy’ requires due diligence but is not an op-erational risk.
  • Sourcing always is risky but independent from internal or an external sourcing.
  • Multi-sourcing generates a new type of risk emerging from complexity of a sourcing ecosystem.

ABSTRACT

Financial authorities and supervisors have emphasized concerns about outsourcing risk for about a decade. A recent European Banking Authority consultation paper discusses "outsourcing" as a subtopic within "operational risk arising from outsourced services and activities, and whether these can affect the institution's ability to process transactions". However, it remains open whether there is an additional operational risk if one compares internal and external sourcing, qualifying "outsourcing" as a separate risk category. Starting from the perspective of the boundary of a firm (ie, the boundary between internal and external production), this paper identifies three steps in sourcing. First, there is business risk, linked to the ex ante entrepreneurial decision to "make or buy", with the required due diligence to make the "best" selection with regard to the allocation of resources. Second, all sourcing has intrinsic risk, although this is independent of the selection of internal production or external sourcing, ie, the boundary of the firm. Third, multisourcing generates a new type of risk, which emerges from the complexity of the sourcing ecosystem at either provider or firm level.

To continue reading...

You need to sign in to use this feature. If you don’t have a Risk.net account, please register for a trial.

Sign in
You are currently on corporate access.

To use this feature you will need an individual account. If you have one already please sign in.

Sign in.

Alternatively you can request an individual account here: