Not too long ago, a California software developer outsourced some of its coding work to an Indian subcontractor in an effort to reduce costs and was pleased with the results. About a month later, however, an employee of the Indian firm tried to sell several thousand lines of the company's code to one of the software developer's rivals.
More and more companies are outsourcing work overseas as a way to manage costs and stretch already-thin IT dollars. Historically, routine business functions, including basic manufacturing and call center jobs, were primarily outsourced overseas. Today, many organizations are considering outsourcing white-collar engineering and application development jobs overseas as well, since networking technology greatly facilitates sending large volumes of data around the globe to places such as China, India and Russia. India has been a recent focus because of its large English-speaking population and its skills in the IT area.
The trend toward outsourcing overseas is expected to continue in the coming years and perhaps even accelerate. Forrester Research Inc. has estimated that 3.3 million jobs will move offshore by 2015. Meanwhile, a March survey of 216 U.S. chief financial officers by Financial Executives International and Duke University's Fuqua School of Business found that 27% planned to increase the amount of work sent offshore. Among companies that already employed workers outside the U.S., 61% said they expect to increase their offshore employment, while only 4% expect to decrease their number of offshore employees.
Offshore outsourcing can help lower costs for many companies. But, as the California software developer cited above discovered, outsourcing isn't risk-free. Although many offshore subcontractors can provide outstanding work, problems can arise from misunderstandings about the work to be performed. The U.S. client may expect that the work will be done by specific people and that certain performance standards will be met. A subcontractor's failure to meet those standards and expectations can throw a client's projects behind schedule and over budget. Companies depending on work from their foreign subcontractors could wind up with hefty losses and a damaged reputation if the work is late and the quality falls short of expectations.
There are also serious privacy and information security risks involved with outsourcing overseas. U.S. companies that outsource work to foreign firms run the risk of violating U.S. privacy laws. For example, the UC San Francisco Medical Center discovered last October that its confidential patient records weren't as secure as it believed. The hospital had hired a medical transcriber to work with sensitive patient information. That work was then passed on through a long chain of subcontractors in the U.S. until it finally ended up with a woman in Pakistan. Upset about overdue payment for her work, the woman threatened to post the confidential records on the Internet unless the hospital helped her collect. She was later paid and didn't post the records on the Internet.
The case attracted the attention of U.S. lawmakers, who are now pushing for stricter privacy laws for U.S. companies that hire foreign firms. Sen. Bill Nelson (D-Fla.) is drafting legislation that would make U.S. businesses legally liable if a foreign contractor abuses American privacy laws. The bill could also give the U.S. government a role in deciding which foreign countries have strict enough privacy protections before U.S. companies can outsource private consumer information. California, which is home to many major high-tech companies, is looking at similar legislation, as are other states. For its part, India doesn't have a data privacy law, but it has been working on developing one.
As organizations seek to have higher-value work done overseas, the protection of their intellectual property becomes even more critical. Organizations must balance the risks of accidental disclosure or outright theft with future cost savings. Although the theft of intellectual property is a problem in the U.S. as well, the offshore outsourcing of software development opens up new areas of risk. Again, just as with data privacy, U.S. companies may have fewer legal protections in foreign countries. To protect themselves, companies should conduct thorough audits of their subcontractors to identify the main risks and then take steps to mitigate them.
Before signing on the dotted line with any subcontractor, companies should consider the use of a trusted intermediary. Consultants can provide an invaluable service to companies that want to outsource work offshore. They can run interference and handle contractual issues. But those services come at a price, and for some smaller companies, it may not be a realistic option.
Companies dealing directly with offshore subcontractors should be sure to:
- Select business partners carefully. Conduct thorough due diligence using established criteria and pay close attention to the following:
- Local representation: Determine the extent and the authority of the U.S. representatives of overseas subcontractors.
- Partner's use of subcontractors: Determine the extent of use of subcontractors and their locations.
- Insurance protection: Require evidence of liability and insurance against errors and omissions.
- Case-law decisions: Determine the competency of local courts.
- Turnover ratio: Look at the company's results on an overall and a project basis.
- Track record: Ask for references from previous and current customers.
- Build the relationship slowly. Send work to subcontractors gradually to allow time to build trust and gain confidence that the work will be done well and meet expectations.
- Set objective, measurable performance standards for all subcontracted work and manage the project in line with established metrics. If necessary, hire an experienced project manager as a liaison between parties. The performance standards must be clear, realistic and objective, but flexible enough to allow for changes when necessary.
- Use extreme care in sending proprietary or sensitive information to foreign subcontractors. Be aware that management may be held liable if a foreign subcontractor releases sensitive customer or patient information. Think twice before releasing information to a subcontractor that could put the company's integrity and reputation at risk.
- Draft a strong, solidly written contract. Spell out in concrete terms exactly what work will be outsourced, who owns the work and who will perform the work. Outline precisely what tasks the contractor is expected to perform and when those projects are to be completed. Good, solid contracts are the first line of defense against theft of intellectual property.
Visit the subcontractor's location. Before outsourcing to an overseas contractor, visit or have a trusted intermediary visit the location where the work is to be performed. This will help bridge cultures and goes a long way toward establishing a stronger working relationship. During the visit, ensure that the following issues are addressed:
- Physical safeguards (such as building access, sprinkler systems and housekeeping).
- Physical and information security.
- Infrastructure status (such as power, telephone service and water).
- Disaster recovery plan.
Outsourcing work overseas has become easier in recent years, and more and more businesses are likely to take advantage of the cost savings that can be gained from using overseas subcontracts. Companies should, however, make sure that those savings don't come at the cost of disappointed expectations, damage to their reputations, loss of intellectual property or even legal action over privacy concerns. By moving carefully, a company can make sure the rewards outweigh the risks.