Outsourcing Risk
Chris, Fraser and Peter discuss risk and outsourcing. Is it possible to reduce the risk through outsourcing?
For more information on Aleph Insights visit our website https://alephinsights.com or to get in touch about our podcast email podcast@alephinsights.com
Transcript
Hello and welcome to the Cognitive Engineering Podcast produced by Tell Me Studios for Aleph Insights. In this series of podcasts we take a look at interesting topics and discuss what we think they tell us about analysis and decision making. I'm Fraser McGruer and I'm here with Peter Coghill and Chris Wragg of Aleph Insights and this week we're talking about outsourcing risk. So Chris can you lead us in, I think you've got an example of a data breach.
Speaker B:Yeah so this was a recent case to do with a company, so this is reported in the media and the story talks about a company called Sabre Hospitality Solutions who produce a platform for sort of travel bookings and a company that used this platform called Carson Wagonlit Travel make travel bookings on behalf of lots and lots of companies and you know large companies with lots of employees and the report suggests that individual personal data from employees of third party companies was leaked through the travel booking platform so it wasn't leaked by the person that these companies subcontracted to but the risk occurred or the data breach occurred at another step removed so you know a company that they hadn't entered into a direct contract with and I just thought it was a really good example of sort of situations where outsourcing services effectively leads to the outsourcing of risk.
Speaker A:Okay all right, nice platform. So it can either be yourself Chris or Peter, yeah one of you develop that a little bit further.
Speaker B:Yeah well so it's not a dissimilar, so this is particularly prevalent in a digitally interconnected world, it's not a massively dissimilar problem to say something like the subprime mortgage crisis where you've got lots of risk or you've got a certain amount of risk out there and it's kind of packaged up in a way that's opaque and that you can't necessarily see where it is, you know you're exposed to risk but it's difficult to determine exactly where it is because it's packaged up in sort of little bits and you know we're all exposed to this risk, it's kind of the phenomenon of cascading risk that when you've got these interconnected systems and globalisation is a good example of this, the very thing that makes us stronger, this interconnectedness also makes us weaker at the same time so you know from everything from things like financial crises and through to sort of political crises like the Arab Spring where interconnectedness of a particular region of the world led to you know contamination of political risk or from you know computer viruses like the wanna cries system and the leakage of that across all the different or want to cry as I like to call it but through to real viruses like you know swine flu or something like that in a global world where people are moving and you know bumping into one another, there's a much greater chance of risk contamination effectively and risk not just being shared and diluted but risk actually being magnified by this sort of... And amplified, so this is so I mean what on the
Speaker A:surface of it looks that could be quite different because we could be talking about as you say a physical virus or it could be in this case we're talking about the outsourcing of risk or it could be as you say like a digital virus actually it's all of them have something in common which is that we live in a more interconnected world than we used to and globalization etc is that fair to say? Yeah yeah that's right and it's particularly pronounced I
Speaker B:think with sort of online digital risk because we are you know we're effectively now living in the digital world kind of cheek by jowl with one another you know it's like it's like an overpopulated shantytown you know and without without sort of proper sanitation we're all going to get cholera or something you know and the same is true in this in this digital world we need some kind of system for digital sanitation. Nice analogy, like it. Peter?
Speaker C:Well dim view of the world from Chris there, I just want to take slight issue with something you kind of throw away phrase you used in the your intro Chris about outsourcing risk. Now I don't think you can actually outsource risk I don't think that kind of makes sense so imagine right so you're the you're that company that's providing travel booking services to your clients and in the in order to do that you're outsourcing part of your operation I in this case the platform that you use to conduct those bookings so sort of presumably it's a web websites with web pages with customer facing forms and a database and it's going out to other databases to hotel databases to make bookings and things now you're the the your use so you're so you're using this thing it's all going great but then suddenly you find that some of your clients data has been exposed by this thing below you now I what so what I mean is your you you still own the operational commitment to your customer and as a result of this you your your ability to operate is is is is perhaps curtailed because you can no longer get any more customers can nobody trust you anymore so you're not so you own all the impact of the risk problem the potential problem but by outsourcing part of your operation to somebody else you've out what all you've out you haven't outsourced any of the impact they don't take any of the of the down from the downer from it but you have outsourced the likelihood of it being made to happen so you own the bad bit of the risk and you outsource the bit that's potentially most you'd like to control the most to a company so I
Speaker B:think yeah I mean there's obviously I mean they do get a downside in the in the reputational side of things because it does emerge who who ultimately was was responsible but but yes and I suppose you you also have limited control over it as well and I think I think that I think the
Speaker C:problem but yes is that there's often in because of outsourcing and and supplier consumer relationships there's a there's a assumption that you can outsource the risk that if I give Fraser a job to do and him doing that job enables me to deliver something to my customer then I can just let him crack on and do it and everything will be fine and if it all goes wrong well we're all we're all suffering from planning bias and that's not going to happen but if it is if it does then Fraser will kind of take the fall for it but actually I will also take the fall because I my my my my product or service or good is is is is dependent on Fraser's performance yeah and I and I and I think there's I you know I've seen how contracts relationships and things work they they do try to tackle this they do try to in within the contract more explore potential ways that things could go wrong so that and then there are mechanisms for for recourse so I could delay payments or reduce payments to Fraser if he's not meeting specific targets and things like that but often these they they I find I've found them wanting in the past because they never deal with catastrophic things like if Fraser gives away all my customers data that there's they never bother with that because the chance of it's so slim but it does happen and they often the the way that risk analysis is done is kind of a simple list of things that could go wrong with a bit of you know the kind of traditional red amber green analysis of risk of how how how bad it is at the moment with a simple likelihood likelihood low medium high score and a impact low medium high score and no and not really any more clever than that I mean I think I think the the the kind of
Speaker B:interesting or the the difficult to solve problem here is this this balance between wanting you're outsourcing the thing so you you the whole point is you don't want to have the responsibility of carrying out this activity so in outsourcing you you effectively do want to hand over responsibility uh for the risk but you don't lose the exposure to the risk um so so on the one hand you want them to act autonomously uh and to take care of this thing for you on the other hand you want to check on them and make sure that they're they're doing it properly particularly when it becomes it comes to things like uh you know um personal data yeah and yeah often you'd include sort of
Speaker C:measures of performance so you know uh which include really um seemingly trivial things like does Fraser turn up to the monthly meetings and stuff because that's usually an indicator if people don't turn up to meetings or are late or or don't get on the phone in time it usually means that there's some systemic problem that's it would cause you to distrust them more not that I not that Fraser's ever late and I trust him implicitly but uh but but but so that that does happen so you put measures in and you have you have means of uh imposing sanctions to encourage certain behaviors but what I what I think is missing is some sort of is a more detailed risk analysis more detailed risk modeling and mapping exercise so you can understand as a sort of man in the middle how a system failure a really low level system failure within your supplier would uh would would sort of cascade up and affect your your customer so look just uh aside from the fact
Speaker A:I don't know how comfortable I am sort of being the sort of the the example for sources of risk
Speaker C:in each well you're always the you're always the the example of the butt uh okay but but where does
Speaker A:I leave this it sounds like what we're saying is is oh it's more it's there are more risks now or it's it's there it can be harder to identify what risks there are in a more interconnected world um and but one of the things that Peter says well that may be the case but still you know you've got um a care of duty to your customer or and and you'll be contractually you've still got to sort take care of consider that I mean where do we go from there is it just that it's more complicated
Speaker B:and it's more onerous for the provider I mean well I think I think it's trying to because it's because it's so complicated potentially you know if you're a large if you're a large multinational company and you think about your supply chain uh and your supply chain supply chain and so on and so forth and it's probably all circular at some point you're probably providing services for somebody in your supply chain and so on um then it's massively complex and so it's probably beyond the ability of uh people to keep track of and sensibly make um sensibly do risk analysis on and so that's why you know these systems are designed with various sort of fire breaks in them but the problem is at the moment you know systems for you take central government where you know information risk is is of uh you know primary concern mostly what they do to prevent data from from going where it shouldn't is prevent you from from sending that data anywhere or prevent you from using things that are actually quite useful like you know mapping data or you know sharing your location or uh whatever it might be so they're usually prohibitive measures uh and you know um you think you think about someone like um chelsea manning the the reason chelsea manning had access to all of that data was because that data wasn't um allowed to move between the systems automatically it had to be sort of carried physically by a person on a thumb drive between between systems and that in itself created a an extra risk so it's it's i suppose it's creating technologies that um allow the liberal use of useful things but somehow um you know mitigate the the risks that that that poses but isn't the point making sure so the sort of safeguards you've
Speaker A:talked about being in place in central government for example isn't it about making sure that three or four five six steps removed from yourselves that they're doing the same and the challenges
Speaker B:in doing in that in in in accomplishing that yeah exactly and you know there are schemes to to do that like um sort of certification of your digital skills from from government you know that they encourage their supply base to reach a minimum standard of and and that's presumably why they encourage that and invest in in that but um you know it's the extent to which that actually does does protect you and you know and you may well do that with your suppliers but have your suppliers done it with their suppliers that's the that's the issue yeah um we're actually fairly close to
Speaker A:wrapping up um who wants to come in on something ideally especially if it rounds it off well i
Speaker C:don't know if it rounds it off uh unless unless you bird the edges because i'm going to talk about engineering choices and design choices because a lot of risk how how does that get into this so as an engineering choice if you're outsourcing something that you don't want to do yourself um there are ways of designing it and chris has touched on a couple so introducing firebreaks so that you know that um there are control mechanisms that kick in perhaps even physically to prevent a failure of one kind from affecting another but also i mean you can engineer redundancy you can you can you can have two people doing something whereas before there was only one but all these these come at a cost think other design choices which don't necessarily come at a cost are just different ways of slicing the pie so so if you're as a if you're outsourcing your entire it system as the ministry of defense say you could get one supplier to do all of it uh and have one huge overarching contractual agreement with them uh and then potentially a larger degree of opacity to what's going on or you could slice it up and you could you could give smaller chunks to more suppliers to to spread the the way that the the the likelihood of risks comes about so a supplier could go down and uh your your your your system largely stays up just some of it falls apart but then you suddenly get complexity of you then yeah there's a cost of complexity of contracting a cost of coordination etc but there's there's another there's another sort of slight twist where rather than having a clear break between supplier and consumer you can engineer you can engineer supply mechanisms where that line is more blurred and you maintain as the authority part of the responsibility for doing some of the key functions within that and likewise they take on some of the key functions within your organization so that to enable us of team spirit and better communication and all sorts of things but also to manage the risk more intelligently so as the authority you might want to take retain on board those key parts of the system which generate the most risk you know in other words the bits that are most likely to go wrong or that that generate the greatest greatest impact and we see that this is this is happening more and more there's a model of outsourcing it services where key components like the system architecture designing how how something is going to operate and designing how the systems will actually function is retained within the authority because that's often the bit that is unable to respond to changes in the environment okay uh i think final word to you
Speaker B:chris yeah i suppose i suppose this this really uh comes comes back to um an issue of guarding against complacency and uh you know at a very basic level just ensuring that um you know that you're not thinking when you when you outsource a service for something that you aren't uh taking your eye off the ball with regards to um your your risk exposure yeah i think a nice way of doing
Speaker C:that to wrap it with a given analytical bent is there are some analytical methods that we've used lots in the past that can aid in this so simple as part of the contractual dialogue with a supplier why not do some scenario generation dream up all the potential ways that something could go wrong um and look for ways of of engineering the the solution to to mitigate against those okay all
Speaker A:right um we'll finish there um again you're trying to think of something pithy to say well i would say yeah let and when we do future podcasts let's not always blame me okay when we need another we
Speaker C:need another fall guy yeah um you need to hire a roadie you need to have an intern that we can poke fun at yeah well you're the roadie well yeah i end up setting up your mic while you make coffee or something yeah yeah okay well i don't like being the the the butt of jokes to be honest no i'm more than happy i think you're i think you're qualified for that actually yeah i don't
Speaker A:mind happy to be but i don't mind chris doesn't mind being a butt of jokes oh there we go so i feel i feel happy in my um in my role and destiny okay we'll wrap up there thank you as always for the cognitive engineering podcast i'm fraser mcgrew we've been here with chris wragg and peter coghill of aleph insights um thank you and until next time bye
