Managing the risks within the supplier domain: black-box versus white-box

Not all risks related to outsourcing can be mitigated in the same manner. Some risks and its mitigation are fully retained within the client company while others can only be mitigated with the cooperation of the external vendor. SAS70, due diligence and audit rights are the most commonly used assurance mechanisms, but are:

• limited in their use (e.g. SAS70 focuses on controls for IT systems which function can have a material effect on financial statements and is thus of limited use to mitigate other types of risks).
• expensive (e.g. both auditing by the companies own auditors or SAS70 statements requires the vendor (and third party auditor) to invest a lot of hours in collecting and presenting evidence. The bill for an SAS70 type II can easily end up in the area of $100-200k.
• showing a snapshot of the situation (e.g. due diligence is typically a one-off exercise which is performed typically as part of the selection or contracting phase, same applies for a SAS70 type I report).

In order to have a more efficient and effective control framework the company should use a combination of expensive assurance mechanisms like third party statements like SAS70, ISA 402 and ISAE 3402 for the area’s of high risk and cheaper alternatives for areas of medium and low risk. See also this post in which I describe at a high level how to the costs related to managing regulatory risk in outsource engagements can be reduced. Part of creating a holistic control framework to manage risk it is important to constantly balance cost and effectiveness.
Describing in contract schedules exactly how the vendor has to execute certain activities prevents the vendor to use its own best practises and is thus expensive. Describing how the output (‘evidence’) for a certain control objective should look like and letting the vendor decide how to come to the result is consequently cheaper than the first option. In other words:

Telling how long and in which pan the cook has to boil the egg versus ordering a half boiled egg
Mitigation of some risks can be done using a ‘black box’ while others cannot. Looking at risks from a ‘black box’ perspective means the client organisation defines requirements or controls that the vendor must adhere to and report on, but with no need to know the internal means of operation.

However, not all risks can however be managed this way. Certain risks require in-depth knowledge of the inside structure and workings of the vendor (medium/high risk) to ensure an acceptable risk level for the client organisation. This is known as a ‘white box’ or ‘glass box’ approach. The two examples below make it more tangible:

• A technology risk is the quality of data that is sent from the vendor to the client organisation. The client organisation cannot handle the quality of data purely as the vendors’ problem as that would lead to a ‘garbage-in/garbage-out’ scenario. The client organisation, however, should look at the quality of data in functional terms (e.g. accuracy, integrity, availability, completeness, and timeliness) and define thresholds or service levels for them. It should be left up to the vendor to operationalise the requirements. In this case, manage this risk as a black box.
• A vendor-related risk is the turnover of its key employees. Key employees possess skills, knowledge or expertise that are so valuable to the client organisation that the client should be able to influence the decision making process of the vendor when it comes to replacing them. Influencing the internal decision-making process of the vendor on this point means managing the risk as a white box.

Managing a risk as a black or white box needs to be reflected in a) the way it is translated into contract clauses and b) the way the vendor is controlled by the retained organisation of the client organisation. Benefits of this differentiation are more focused management attention, less 'control waste' and thus ultimately lower cost—lower cost due to a smaller retained organisation and lower charges from the vendor for risk management related services.