How to Reduce Risks with Business Process Outsourcing

As our global economy returns to growth, the demand for improved customer service experiences continues to rise. According to the 2020 State of Global Customer Service Report from Microsoft, 55 percent of customers expect better customer service year over year. Globally, 90 percent of consumers believe customer service is somewhat to very important in the choice of a brand.

Outsourcing assists in facing many challenges when it comes to consumer preferences and growing demand. Business Process Outsourcing (BPO) providers offer several benefits, such as cost efficiency, around-the-clock customer service and instant access to expertise. Given this reality, the role of BPO providers in empowering organizational efficiency can’t be understated. However, even as outsourcing becomes more critical, so do the associated risk factors.

Even as the number of companies relying on outsourcing increases, Deloitte estimates that large, multinational businesses that fail to appropriately identify and manage third parties can incur fines, costs and other revenue losses from U.S. $2 to $50 million. Actions under global legislation, such as the U.S. Foreign Corrupt Practices Act, can be far higher, from U.S. $0.5 to $1 billion. These figures are, of course, in addition to the significant reputational damage that an organization will incur.

As you can see, businesses can no longer afford to be in the dark. Business leaders need to make fully informed decisions if they are going to manage and mitigate BPO risks. The first steps towards accomplishing this goal is to understand the nature of the risks they’re up against.

Understanding the Risks of Business Process Outsourcing

The cost-benefit of outsourcing is contingent on two factors:

• BPO partners perform their tasks based on a mutually-agreed standard
• BPO partners follow a predictable and stable workflow at established costs

As long as both these assumptions hold true in practice – everything’s fine. However, when partners deviate on any of these variables, suddenly we’re in trouble. Falling standards and unstable operations can lead to value leakage across the enterprise. Companies immediately begin noticing fall in revenue, a decline in customer service or generally inefficient operations. The result? Losses in both their short and long-term financial performance.

This represents the fundamental risk arising from unhealthy BPO partnerships. As a result, they threaten the integrity of a company’s operating model as well as their brand image. To prevent such risks, companies need to plan ahead. Unfortunately, this is one of the side-effects of a crowded service segment where too many BPO providers can get away with less than desirable performance. High-quality BPO providers are well aware of the pitfalls of transitioning and maintaining quality performance with customer care and technical support services and work with clients to take ownership of the process that truly adds value to a company’s workflow. The real challenge that companies face is in separating the wheat from the chaff and discovering BPO partners that represent quality, leadership and a proactive attitude that isn’t dictated solely by contractual obligations.

The range of risks associated with BPO can be broadly categorized into two segments: operational risks and strategic risks.

Operational Risks in Business Process Outsourcing

Operational risks mainly concern potential slippages in quality and efficiency. While it is expected that there might be some degree of variability in the quality, there remains a very narrow margin for error in today’s customer-centric world. Let’s remember that for modern organizations, the number one priority is customer satisfaction and ensuring a positive customer experience.

Companies should be fully aware that by partnering with a BPO, they are actively relying on a third-party to help them fulfill this obligation but not many know how they do it well.

How to Gain Visibility and Ensure Operational Success

BPO partners should be able to show that their processes not only maintain quality but also address quality inconsistency over time. Companies should have a governance plan in place with their vendors, as well as establish a scheduled reporting process to monitor on-going performance and be proactive with their business reviews. Companies can do this by incorporating performance-based contracts into the partnership that equitably share the risk of low quality with the service partner.

Companies should also do their due diligence and thoroughly research potential partner credentials before signing on the dotted line. Outsourcing service providers with established credentials of excellence and a trustworthy pedigree of clients, are more likely to be reliable and deliver results. In most cases, it’s as simple as asking the service partners to provide references and to follow up with their other customers to seek advice.

It’s easy to maintain operational performance when everything is going right, but the true resilience of a partnership is only tested when the going gets tough. This is where the provider’s business continuity and disaster management plans come into the picture. A vendor should have contingencies in place that ensure operational performance – from a natural disaster or a major customer disruption. BPO partners should have a plan in place for how they would manage a sudden and unexpected surge in call volumes and manage challenging customer service scenarios.

It is also important to review a service provider’s business continuity and disaster recovery plans to ensure long-term operational performance and financial solvency. Such plans should also make note of the BPO’s backup sites which can be activated quickly in case of emergencies and mitigate any disruption in service. It is critical that all entrusted operations of the BPO can be migrated quickly and efficiently to another location so their client faces minimal downtime.

A BPO’s recovery and backup plans should be clearly established and understood by any organization seeking to rely on them for business-critical operations. Most importantly, even when service providers opt to adopt cost-cutting measures, organizations should ensure that it doesn’t come at the cost of a decline in the quality of deliverables.

Security Risks with BPO Partners

Security risks encompass the assortment of intellectual property protections, privacy requirements and data security that are common to modern companies. As organizations begin to work with BPO companies, there is a degree of overlap in shared information which in many cases is proprietary and privileged. This information can include anything from a company’s own intellectual property such as applications and protocols, to information pertaining to a company’s customer base such as billing information, personal health or financial data, etc.

However, the fear of security breaches and data leakage is an ever-looming threat. Under BPO partnerships, companies have limited control over the BPO’s internal security architecture and privacy protocols and find their data vulnerable. And while signing a confidentiality contract may be a legal recourse to this risk and offer some degree of mitigation, it is not entirely enough. Organizations must make every effort to ensure that the data entrusted to BPO providers is protected and every precaution is in place against potential breaches.

Mitigating Security Risks

The 2020 Cost of a Data Breach by IBM reports that the average cost of a data breach to a U.S. company is $8.64 million. And it takes an average of 280 days to identify and contain a breach. In an era where effective outsourcing requires sharing data, organizations need to take steps that offer them legal protections. Enforcing a strict confidentiality agreement is just the beginning. Prior to any deals with a BPO, organizations should conduct a thorough review of their protocols to ensure they follow industry-class security and privacy practices.

Under these circumstances, a legal agreement should not be the end goal of their security requirements – it should only be the starting point. It may be tempting to take shortcuts and share everything all at once for convenience, but organizations should resist that urge. Companies need to go beyond the fine print and carefully consider every piece of data that they share with a BPO. Instead, they should create a filtered list of only the necessary data items that the BPO needs access to just the necessary moments in order to do their task.

All service agreements should include provisions that allow organizations to conduct IT, security and privacy audits of the BPO at regular periods in order to plug any loopholes or oversights. Such routine audits also ensure that BPO acts in good faith and remains vigilant over the course of the partnership. Organizations should establish clearly documented expectations and objectives to the service provider that feed into KPIs that can be tracked and monitored over time.

To further ensure mitigation, organizations should also ask BPO partners for a service organization control (SOC) report. The report includes details about testing these controls and the subsequent results which indicate the readiness of their data protection and security measures. Depending on the functions, the SOC reports can be either Type I, which deals with financial information or Type II, which involves non-financial information. Additionally, based on their specific use case, BPO companies should meet compliance standards, such as PCI DSS, GDPR, California Consumer Protection Act, SOX compliance, HIPAA, FDCPA and the US-EU Safe Harbour Agreement, among others.

Partnerships Built on Trust

All good businesses are built on trust. And in an increasingly connected business landscape, trust is a commodity worth every penny. With the right BPO partner, organizations don’t have to make the difficult choice of choosing between security, reliable service and trust – they can have all three. Companies need to ask more from their BPO partners and develop partnerships that are built for the long term. By carefully considering the credentials and capabilities of their partners, organizations can rest easy knowing that their brand is in safe hands and that their values are upheld by partnerships built on trust.

Additional Resources:

• Infographic: Chatbots Deliver Speed But Consumers Want Humans
• Infographic: The ROI of Good Customer Service
• Success Story: 1WorldSync