Deloitte VMPO

The Outsourcing Vendor Management Program Office (VMPO): Art, science, and the power of perseverance Never say
never!
Contents
Foreword 1 Executive summary Research overview 2 3
Introduction 4 I. Evolution of VMPO requirements II. VMPO maturity III. VMPO operating models IV. Understanding and managing risk through the VMPO 7 10 19 24
Conclusion 30
Foreword
The outsourcing and offshoring market continues to not only grow, but also evolve with the addition of new technologies (cloud computing) and geographies (China and Brazil, among others), as well as an increasing focus from key stakeholders (regulators). Outsourcing continues to deliver financial benefits, although labor arbitrage appears to be diminishing in importance and is being replaced with a focus on innovation and continuous improvement. The Outsourcing Vendor Management Program Office (VMPO): Art, science, and the power of perseverance is a 2011 Deloitte Consulting LLP report that focuses on the challenges clients face once they have executed their outsourcing transactions and embark on journeys with single or multiple providers. In most instances, this journey begins with transformational programs across multiple business units and/or multiple geographies, which need to be closely managed and monitored to realize cost savings and transformational benefits. This is an area rich with disappointment and unmet expectations and peppered with stories of disastrous, ill-conceived, and poorly managed initiatives that proved to be career-limiting for user and service provider executives alike. Our report aims to shed further light on a critical underlying cause of underperformance and offers practical, executable remedies that can make outsourcing more productive and successful for the enterprises that outsource, the providers that service them, and the executives involved. The following discussion draws on the results of a survey on vendor management practices that polled 27 business and information technology executives at global enterprises. We have also incorporated additional insights gained from a number of outsourcing and vendor management engagements that Deloitte has delivered across the world. In general, we found that a large number of companies are increasingly aware of and understand the importance of vendor management to realizing cost savings from outsourcing and mitigating the applicable risks. However, vendor management practices at the majority of clients remain relatively immature. There is considerable room for improvement, not only in terms of investment in tools and people, but also in service provider relationships. In addition to outlining clients vendor management experiences, this paper also offers our thoughts on leading practices, which we hope you may be able to leverage and implement. We welcome your feedback and comments. Yours truly, Peter Lowes Global Leader, Outsourcing and Shared Services Advisory Services Deloitte Consulting LLP New York, April 2011
As used in this document, Deloitte means Deloitte Consulting LLP, a subsidiary of Deloitte LLP. Please see www.deloitte.com/us/about for a detailed description of the legal structure of Deloitte LLP and its subsidiaries. Certain services may not be available to attest clients under the rules and regulations of public accounting.
The Outsourcing Vendor Management Program Office (VMPO): Art, Science, and the Power of Perseverance
Executive summary
In 2008, a Deloitte outsourcing survey report, Why Settle for Less?, addressed a number of questions regarding the effectiveness of global corporations outsourcing initiatives.1 This report sought to understand the extent to which companies were realizing the financial objectives of their outsourcing programs, as well as the extent to which companies were realizing additional, nonfinancial benefits. The 2008 report did find that a large number of outsourcing companies had realized their financial objectives. However, it also found a surprisingly high number of instances of company-service provider conflict. Many companies expressed disappointment with their service providers ability to provide continuous improvement and technology improvements. The report noted the importance of an effective vendor management (VM) program that can provide the resources and information to clients to not only get what they pay for, but also realize value from the outsourcing transaction. A number of issues raised in the 2008 survey, including ineffective reporting, lack of transparency, and poor communication, continue to exist in the marketplace today. These issues are the focus of the current paper. This paper reports the results of a survey of 27 senior executives whose companies were engaged in major outsourcing initiatives. We explored the extent to which companies have understood the lessons learned from the 2008 study. A major focus of the study was to determine what proportion of companies have established vendor management program offices (VMPOs) to manage their service providers: How likely are companies today to have effective and mature VMPOs in place to manage outsourcing transactions? Below are some specific findings from this survey: 1. There is a growing awareness among companies that in order to realize the benefits of outsourcing, service provider relationships have to be actively managed. Sixty-seven percent of respondents to the current survey reported that they had already established dedicated VMPOs. 2. Even though companies are focusing primarily on traditional VM functions (the majority of respondents
2
to this survey cited activities related to contract management and service performance management as most important), many companies are showing an increased interest in adopting a broad approach to VM. This was evident from the fact that most of the responding companies have adopted practices that incorporate, in some fashion, Deloittes approach to 10 leading-practice VM functions. 3. Despite adopting dedicated VMPOs that focus on broad VM functions, the rate of effectiveness for VMPOs was significantly lower than our experience working with clients would suggest: Only 57 percent of the respondents rated their VMPOs as very effective to effective. The results of our survey, as well as our interactions with clients across industries, indicate that companies still continue to struggle with operating effective VMPOs even though they understand the need for VMPOs and invest in them. Hence, many companies continue to face challenges in managing outsourcing service providers. The question is: Why? Do their struggles reflect an issue of ineffective execution? In our view, companies can no longer solely rely on stringent contractual provisions to manage service providers effectively. Instead, they need to adopt hybrid models in which contracts are managed by effectively operated VMPOs with the applicable investments in tools and people. We believe that if companies invest in the areas identified in this report, they stand a better chance of effectively managing their service providers and realizing the objectives of their outsourcing initiatives. In addition, the design, build, and implementation of flexible and scalable tools and processes within a VMPO can further improve a companys ability to manage multiple service providers and deal with the changing nature of regulatory requirements. When it comes to reaping the benefits of outsourcing: Never say never! By adopting the leading practices revealed in this report, large enterprises can take a major step forward in achieving the full benefits of outsourcing that they have long sought.
Why Settle For Less? Deloitte Consulting 2008 Outsourcing Report, Deloitte Development LLC, 2007. 2
Research overview
Deloitte conducted a survey to test the hypothesis that while companies are increasingly aware of, and understand the need for, dedicated VMPOs to manage their strategic outsourcing, offshoring, and service delivery programs, the maturity of their VM capabilities remains low.
Exhibit 1b. Company respondent prole: Industry
11% 22% 11%
4%
The survey research was supplemented by Deloittes recognized experience in providing services to organizations across various industries that are designing, building, and implementing their VMPO initiatives. Survey respondents included 27 senior executives from various mid-size and large companies headquartered in the United States, Canada, United Kingdom, and other countries (Exhibit 1). The companies were primarily engaged in the outsourcing of information technology (IT) and/or telecom services. Survey participants had significant exposure to the way the service providers in their outsourcing programs were being managed. They were asked a number of questions about how they managed their service providers across their largest outsourcing initiative. On average, the value of the outsourcing programs being managed was approximately U.S. $400 million, with a total contract term of 6.8 years.
Exhibit 1a. Company respondent prole: Country
11%
4% 4% 33% Energy and utilities Telecommunications Banking, nancial services, insurance Life sciences or healthcare Consumer products Industrial products Manufacturing Government
Exhibit 1c. Company respondent prole: IT functions/services outsourced
3% 10% 6%
11%
11%
6% 10% 30% 13% 11% 11% 8% Infrastructure services Network architecture Data security services Telecom services Other
29%
4% 4% 7% 4% Canada Italy Japan Mexico Netherlands Switzerland 11%
11% United Kingdom United States
Application maintenance Application development Data center management Help desk support Call center operations Desktop support
Introduction
The companies surveyed clearly recognized the need for dedicated VMPOs. At first glance, a review of the statistics suggests that companies were actively investing in establishing VMPOs in support of their outsourcing programs, focusing on what Deloitte views as the 10 core VM functional areas (as depicted in Exhibit 2).
When asked how they approached VM within their organizations, 67 percent of executives surveyed said they had implemented dedicated VMPOs that covered leadingpractice VM functions.2
Exhibit 2. Deloittes view of leading-practice VMPO functions placed within IT operating model
IT function operating model Drive value delivery from service providers to IT customers with a focus on the following value objectives: Service quality, cost efficiency, risk management, and agility Strategy and control Align IT strategy and standards with business strategy and control IT value and risk Security management Strategy and program management Business continuity and disaster recovery planning Audit and compliance Operating model components Controls Skill and capabilities Tools and technology Communications Leading-practice VMPO functions Contract management and compliance Manage and track obligations, manage contract compliance Manage contract amendments Financial and commercial management Verify rate and volume invoice charges, ARC/ RRC3 commitments against baselines Track service credits Issue and dispute management Track and report resolution of issue and archive issues Create and manage issue escalation/management process Service performance management Provide dashboard reporting and MIS4 Develop performance management framework for SLAs5 and KPIs6 Perform SLA monitoring, reporting, and trending Service request managements Manage end-to-end process for new service requests Analyze new services against the contract Governance Establish and manage governance process and forums Undertake assessment against outsource objectives Customer management Match IT services to customer needs and manage customer satisfaction Customer relationship management Demand management Product management Manage product innovation and economics and drive consistency in standards
Architectural standards management
C u s t o m e r s
Service delivery management Control and improve timeliness, quality and cost of IT service delivery
Service delivery oversight
Vendor Management Program Office Maintain value focus through effective contract, commercial, and relationship management
Contract management and compliance Multi-service provider integration
Financial and commercial Transition and transformation project management office management (PMO) and oversight Issue and dispute management Service performance management Governance Document management Service request management Service provider risk management
S e r v i c e p r o v i d e r s
Product lifecycle management Service catalog management
Solution advisory Internal IT service delivery
Multi-service provider integration Develop and maintain cross-supplier standards and procedures Develop, negotiate, draft, and execute operating-level agreements (OLAs)
Transition and transformation PMO and oversight Provide transition and transformation planning Provide transition and transformation monitoring and reporting
Document management
Service provider risk management Determine risk analysis approach, tools, and methodology Recommend specific risk indicators, frequency, and metrics to manage, track, and report
Maintain repository of contractual artifacts Perform auditing, updating, and archiving of contracts and VM process documents
eading-practice VMPO L functions referenced in the survey are defined by the Deloitte IT operating model set out in Exhibit 2. 3 Additional resource contribution/reduced resource contribution 4 Management information systems 5 Service-level agreements 6 Key performance indicators
2
The executives surveyed also indicated that the resources performing VM functions were relatively highly skilled, with 40 to 65 percent of respondents rating their VMPO resources at an advanced or master skill level for many VM functions. However, a review of the overall results fails to support the initial impression that respondents are running mature and effective VMPOs. Several contradictory results revealed a conflict between how executives view their VMPO capabilities and the reality of their capabilities in terms of leading-practice VM. For example, 67 percent of the respondents said that they had established a dedicated VMPO that performed many VM functions, yet the percentage of VMPOs that were taking a lead role for some traditional post-contract VM activities was low. It is this contradiction that lends weight to the hypothesis explored by the survey; that while organizations are addressing specific VM functional areas, they in fact still lack the maturity required to run efficient and effective VMPOs that can help organizations to realize the objectives of their outsourcing programs. This report is Deloittes assessment of the survey results on how companies view their VM capabilities. The results are supplemented with Deloittes experiences and insights regarding questions such as: What does it take to build and implement an effective VMPO? What types of resources are required to operate an effective VMPO? What is an effective balance of cross-functional skills and experience needed to run an effective VMPO? How can organizations build a flexible and scalable VMPO and create an effective VM operating model to address new and emerging VM practices, such as supplier risk management and multi-service provider integration? The paper is divided into four sections. Section 1 discusses the evolution of VMPO requirements in light of the changing nature of the outsourcing market, changes in buyer behavior, the shifts in the economic climate over the past few years, changes in regulatory focus, and the increasing need to invest in skills and training to staff VMPO functions.
Section 2 covers our findings and views regarding the maturity of respondents VMPO functions. This section explores the extent to which the respondents had a clear understanding of leading-practice VM and of the requirements for establishing and successfully operating a VMPO. Section 3 discusses the pros and cons of VMPO operating models centralized or decentralized? Dedicated or nondedicated? as well as VMPO maturity, approaches to tools, recruiting, current VMPO practices, and Deloittes view on leading VMPO practices. Section 3 also explores some of the factors that have influenced the need for broad, flexible, and scalable VMPOs, including: 1. Companies have continued to adopt best of breed approaches to outsourcing transactions. They are now seeking to execute multisourcing transactions across a number of service providers, each provider bringing its own specific experience and knowledge to the table. 2. This means that companies need to pay greater attention to how they integrate services across multiple service providers and, in some instances, across multiple geographies to keep service delivery intact from an end-to-end perspective. 3. In addition, governance and change management mechanisms in transition and transformation programs have also become more complex to manage, as several different providers with multiple interdependencies are typically involved. 4. An increase in M&A activity, as well as specific instances of captive centers being divested to third parties, has led to a correspondingly greater need to build effective VMPOs to manage external third parties. Previously, companies could rely on internal service-level agreements (SLAs), typically with minimal governance and penalty mechanisms. Now, they require more formal and commercially astute processes. 5. Advances in technology have seen the introduction of new tools and platforms to manage not only service providers contractual and commercial performance, but also their service delivery performance. This, in turn, has led to an increased focus on skill set development and talent retention. In addition, the continuing demand for global outsourcing transactions across geographies, which require companies and vendors to work across multiple cultures, has led to an increased focus on relationship management.
6. Changes in the economic climate have driven regulators to increase their scrutiny of outsourcing and offshoring transactions. Regulators may focus on processes adopted by companies to define, manage, and evaluate critical suppliers; information security assessments; contingency plans; business plan continuity; roles and responsibilities related to governance frameworks; and, most importantly, data privacy issues. Section 4 discusses the topic of understanding and managing risk through a VMPO in light of changing regulatory conditions as well as changes in buyer behavior. It also provides our views on the multi-service provider integration function, which clients have historically struggled to successfully implement.
I. Evolution of VMPO requirements
Where has the market moved since 2008? One of the conclusions of Deloittes 2008 outsourcing report, Why Settle for Less?, was that certain problems with service provider relationships existed despite the fact that outsourcing was an applicable solution for many companies. Respondents to the 2008 survey were challenged by issues such as inconsistent communication between the company and its service provider, inadequate reporting, absence of clear communication plans, lack of transparency, and poor-quality account management (Exhibit 3).
Exhibit 3. Problems with communication and relationship management
It is therefore unsurprising that, over the past few years, Deloitte has experienced a growing demand for services that can help organizations ascertain the maturity of their VM models and/or help them design, build, and implement leading-practice VM models. Sixty-seven percent of the respondents to the current survey reported that they had already established dedicated VMPOs. Among respondents that did not have a VMPO, 33 percent were currently in the process of creating one. The rest of the respondents cited a lack of resources and experience as the main reason for not establishing a VMPO (Exhibit 4).
Exhibit 4. Reasons for not establishing a dedicated VMPO
Inconsistent communication Reporting Lack of communication plan Lack of transparency Poor account management None Dont know 0% 2% 20%
29% 24% 23% 20% 17% 51%
Lack of resources and expertise
44%
Geographical business spread
33%
Lack of executive support Maintain close proximity with vendors VMPO in implementation process Not thought about VMPO 0% 40% 60% 11% 10% 20% 30%
33%
33%
33%
40%
50%
Source: Why Settle For Less? Deloitte Consulting 2008 Outsourcing Report, Deloitte Development LLC, 2007. Note: Respondents were allowed to select multiple options.
Note: Respondents were allowed to select multiple options.
In addition, the report also concluded that there was a growing awareness among companies that the complexities of managing outsourcing service providers post deal execution were underestimated and poorly managed. When asked what they would do differently if they could start their outsourcing initiative over again, 37 percent of the executives in the 2008 survey said that they would do a better job of planning and staffing for service and contract management. This figure rose to 55 percent among executives who were less than very satisfied with their outsourcing initiatives.7
7
Why Settle for Less?, Deloitte Development LLC, 2007.
As the survey shows, many companies today are implementing dedicated VMPO functions. In doing so, companies often draw on the assistance of third parties that can provide specialized functional know-how and the industry-leading operating practices, processes, models, and tools necessary to create flexible, scalable VM frameworks that can effectively and efficiently manage outsourcing relationships. This trend toward investing in dedicated VMPOs has been fueled by a number of factors, including the increased complexity of todays outsourcing environment (including regulatory and compliance issues) and the growing need to manage multiple service providers that provide varying mixes of products and
7
services across multiple geographies. The survey results reinforce Deloittes experience that organizations are not only recognizing that their traditional VM practices and their VM practitioners related skills are no longer sufficient to meet current demands, but also are actively addressing this concern by investing in tools and people. Almost 70 percent of the surveys respondents invest between 1 percent and 7 percent of the total outsourced contract value on implementing and operating VM functions, as shown in Exhibit 5. This figure is consistent with Deloittes experience with organizations in the marketplace.
Exhibit 5. Investment in VMPO functions (% contract value spend on VM function)
Transition and transformation project management office (PMO) and oversight Document management systems Service request management Service provider risk management (an emerging area of demand) Multi-service provider integration (an emerging area of demand) How have traditional VM practices evolved? The current activity in establishing dedicated VMPOs and the increase in demand for leading-practice VM models reflects companies growing realization of the complexity of todays outsourcing environment. Organizations are being challenged, not only by the shift towards integrated global service delivery models and the management of multiple service providers across multiple geographies, but also by the dynamics within their own organizations. The increasing complexities of outsourcing and offshoring transactions, as well as changes in the regulatory environment, have led to a greater emphasis on relationship management and new methods of working between business units and internal support functions such as legal, tax, risk, and compliance. It has also led to a shift in behavior from a performing culture to a managing culture. For example, whereas client stakeholders would produce both requirements and solutions in an in-house service delivery model, a post-outsourcing environment demands a focus on defining requirements and allowing the service provider to produce the solution. Contracts need to be managed on a daily basis rather than being monitored and periodically amended, and VM models must also now be flexible and scalable to adapt to changing business requirements and external pressures. Effective relationship management is particularly critical in an environment where regulatory and risk pressures are continually increasing as a result of volatile economic conditions. For example, in the financial services industry, regulatory bodies such as the United States Office of the Comptroller of the Currency (OCC) are placing an increasing emphasis on scrutinizing the way organizations track, measure, and report on risks associated with their critical service providers. Regulators are examining the
25%
44% 6%
25% 1% - 3% 4% - 7% >7% Dont know
Our survey also suggests that VM is taking on a broader range of activities than in the past, when VM dealt mostly with basic contract management functions and the management of commercial arrangements with the service provider. Survey respondents indicated that organizations are investing in setting up a variety of VM functions, including: Contract management and compliance Financial and commercial management Issue and dispute management Service performance management Governance
way organizations assess these risks, how they define critical supplier, what internal governance controls and mechanisms they maintain, and the way they manage escalations. Regulators are also focusing on service providers financial and operational viability, their ability to fulfill their contractual obligations, and the effectiveness of their exit and contingency plans. Information security and data privacy controls and processes are another growing area of exposure. Regulators are also focusing on how organizations consolidate risk issues and report them at an enterprise level; in some instances, this occurs through a central reporting utility such as a VMPO that also manages the day-to-day relationship with the service providers. Regulators are examining the way organizations assess these risks, their definition of what a critical supplier is, their internal governance controls and mechanisms, and the way they manage escalations. Regulators are also focusing on service providers financial and operational viability, their ability to fulfill their contractual obligations, and the effectiveness of their exit and contingency plans. Information security and data privacy controls and processes are another growing area of exposure. Regulators are also focusing on how organizations consolidate risk issues and report them at an enterprise level, in some instances through a central reporting utility such as a VMPO that also manages the day-to-day relationship with the service providers. Service providers interest in increasing revenue from their current outsourcing arrangements must also be carefully managed. Failure to implement broad change management and governance frameworks that closely monitor and manage alterations to scope may lead to unexpected costs and, ultimately, to value erosion.
Additionally, the growing complexity of todays outsourcing environment demands new skills in order to effectively manage an outsourcing program. Traditionally, many VMPOs either resided largely within the procurement or sourcing function, or were operated at a basic functional level by business units that required some form of governance in order to effectively perform basic processes (such as managing service levels or managing the delivery of a product). While these functions may have been effective at managing parts of an outsourcing relationship, they have often failed to successfully manage entire outsourcing programs. Effective management of an outsourcing program now requires specific cross-functional skills and experience, specialized toolkits and disciplines, an enterprise view of the outsourcing program, and the ability to manage and integrate a large number of service providers (where required) to deliver an enterprise service. Establishing a dedicated VMPO can support companies effort to recruit, retain, and develop the requisite cross-functional skill sets required to successfully manage the complexity of todays outsourcing programs. The current survey clearly demonstrates that todays executives have built upon the sentiments that executives expressed in Deloittes 2008 outsourcing survey (as summarized at the beginning of this section). In addition, the current survey reinforces Deloittes experience that companies are increasingly investing in broad tools, systems, and processes for VM, as well as building VM organizations that can provide the resources to more efficiently and effectively manage their service providers and achieve their outsourcing objectives.
II. VMPO maturity
Having established that many companies are now actively investing in building VMPOs, we now turn to the question of how they are building and implementing their VMPOs and how effective those VMPOs are. The current survey included a number of questions about which VM functions companies had implemented, how they had prioritized these functions, how effective respondents thought the functions were, how skilled the companys VM resources were, and what operating models were employed for the VM functions. The answers to these questions were core to investigating the extent to which the respondents had a clear understanding of leading-practice VM and of the requirements for establishing and successfully operating a VMPO. How are companies building and prioritizing their VM activities? In Deloittes view, leading-practice VMPOs incorporate the 10 functional areas depicted in Exhibit 2. We asked survey respondents to indicate which of these 10 areas they had adopted for their current service provider engagements. Each of the 10 areas was represented among our respondents; in fact, all but two of the 10 functional areas (multi-service provider integration at 62 percent and transition and transformation oversight at 76 percent) had been adopted by over 80 percent of the respondents. The results are displayed in Exhibit 6. In our view, the most surprising finding was that 62 percent of the respondents were actively addressing multi-service provider integration, and 95 percent of the respondents were addressing service provider risk management both of which are seen as new and emerging areas of VM focus. In Deloittes experience, organizations have typically been slow to recognize the need for investment in these two areas, and most are relatively immature in the related controls and processes. We also asked respondents to rate their VMPOs level of Experience. In most of the VM functions, between 40 percent and 65 percent of the respondents considered their VMPO resources to be at an advanced or master level (Exhibit 7).
Exhibit 6. Involvement in VMPO processes
Contract management Financial and commercial management Issue and dispute management Service performance management Governance Multi-service provider integration Transition and transformation oversight Document management Service request management Service provider risk management 0% Yes No 62 76
95 95 95 100 100 38 19
5 5 5
85 81 95 20% 40% 60%
10 5 19 5 80% 100%
Dont know
Note: Numbers in Exhibit 6 are percentages. Exhibit 7. Resource skill levels in VMPO processes
Contract management Financial and commercial management Issue and dispute management Service performance management Governance 5 Multi-service 11 provider integration Transition and 10 transformation oversight Document management 5 Service request 5 management Service provider 5 risk management 0% Beginner Intermediate
33 30 95 100 38 28 35 48 33 38 20%
29 50 95
33 15
5 5
10 10 100 55 14 5 33
38 28 35 24 38 33 40% 60% Master 5 5 10
5 15 19 19 14
80% 100% N/A
Advanced
Note: Numbers in Exhibit 7 are percentages.
10
Exhibit 8. Importance of VMPO objectives

Increase operational efciency Manage contract scope and costs Review and approve scope changes Check on contractual obligations Process invoices and payments Perform nancial planning SLA compliance Ensure timely transition of services Governance Performance improvement measures Mitigate conict of interest across vendors Increase collaboration with joint vendor forums Others 0% 22 17 20% 40% 33 35 44 83 60% 80% 100% 37 52 56 46 22 30 37 63 37 37 44 63 44 37 30 15 67 67 37 30 7 26 30 15 44 4 4 44 11 7 37 44 44 47 4 44 7 4 8 4 8 4 7
leading-practice VM functions. In our experience with multiple clients, we have observed that companies are struggling to understand how to build and manage capability in this space. Given that the skills and experience to manage these functions are rare, one might question the depth and breadth of the VM capabilities being provided at our respondents organizations. Are companies really using skilled, experienced resources to effectively manage the leading-practice VM functional areas? Or are they actually embracing these areas utilizing the resources available to them, performing these functions in a reactive, ad hoc manner without sufficient substance to operate effectively? What is clear is that companies are choosing to move into emerging areas of focus for VM. They are also recognizing the need for strong governance over their own internal organizations as well as that of the service provider. The results clearly indicate recognition of the need for multi-service provider integration and risk management (discussed later in Section 3 of this report). However, the question remains: How effective are companies at managing these functions? Although organizations have made headway in identifying and addressing leading-practice VM areas, responses to the survey demonstrate that many companies are still approaching service provider management in a traditional manner, with the majority of respondents citing contract management and service performance management as being the most important aspects of their VM functions. In our experience, service performance management has been a historical area of focus in which processes have often been traditionally executed using standard metrics and measurement techniques such as SLAs and key performance indicators (KPIs). Our work in assisting organizations with their VM efforts suggests that companies should now be considering additional measures and techniques for managing their service providers through multiple levels of governance throughout the organization. This increases the probability that company stakeholder interests will be met and that the strategic value desired from service providers will remain intact. For example, some companies are starting to
Very important Very unimportant
Important N/A
Neutral
Unimportant
When respondents were asked to rate the importance of each VM function, activities related to contract management and service performance management were seen as the most important elements of a VMPO (Exhibit 8). Fifty-two percent of the respondents thought governance was very important, while the importance of activities related to finance and commercial management, transition and transformation oversight, continuous improvement, and multi-service provider integration were evenly distributed across the 30th percentile. A fairly high percentage of respondents were neutral on the importance of reviewing and approving scope changes in a structured manner, performing financial planning, supporting timely transition and transformation, and increasing supplier collaboration by establishing joint forums. What does this tell us? Given the growing complexity of managing todays outsourcing service providers, as well as Deloittes experience with companies VM efforts, it was surprising to see that so many companies had established VMPOs that covered a number of what Deloitte considers to be
11
utilize executive performance indicators (EPIs) to measure and monitor the strategic aspects of their relationships with service providers, rather than measuring only the operational aspects of their partnerships (e.g., attrition rates, volume of incorrect invoicing, and the volume of incorrect change orders). The fact that companies are continuing to adopt and deploy traditional approaches seems inconsistent with our respondents view of their involvement with VM and the level of experience in their VM functions. When viewed in light of the continuing prominence of traditional approaches to VM, cracks in the appearance of the maturity of companies VMPO organizations begin to appear. It could be argued that the traditional areas of contract management and service performance management should still be the highest priority, that organizations are actively performing many leading-practice VM functions, and that they are doing so at an advanced or master level. Certainly, this is how organizations seem to be viewing themselves and their VM capabilities. However, Deloittes experience and understanding of VM capabilities, of the market, and of organizations requirements in this area challenge this belief. In our view, while companies are making large inroads into identifying what they require from their VM capabilities, they have not yet reached a sufficient level of maturity to recognize whether the substance of what they have built will provide them with a sustainable, flexible, and scalable capability that is effectively resourced to deal with changes in business requirements and technology. Recruiting for an effective VMPO Understanding what is required to successfully manage complex outsourcing service provider arrangements is not a straightforward and easy task. As the outsourcing environment continues to increase in complexity, so too do the skills, experience, and qualifications needed to manage it. Vendor managers must move away from traditional mindsets and develop different cross-functional
skills, including relationship management skills, legal skills, financial/commercial skills, and planning and project management skills. VMPO professionals also need to understand risk, contract management, service management, and business development areas. Deloittes 2008 outsourcing report indicated that finding executives with a relevant set of skills for effective vendor management was not easy. In fact, finding resources with an applicable combination of skills at any level is often a challenge. Our experience has shown that organizations often retain existing employees to manage a new service provider, believing that the people who previously performed the outsourced process are suitably qualified to manage the service providers now delivering products and services. In reality, such retained resources often find the transition from a service performance culture to a service management culture extremely difficult. Often, the retained resources tend to dictate solutions to the service provider instead of buying a managed service and an end result. Such behavior can prevent the service provider not only from realizing value from existing obligations, but also from generating value from additional opportunities. It also creates additional management overhead and gives the service provider the opportunity to disclaim liability for poor service, on the grounds that the service provider was not solely responsible for the outcome. Similarly, our experience suggests that approaching service provider management with a traditional procurement mindset is also ineffective. Often, procurement professionals lack the applicable focus, skills, and experience to successfully manage the complexities of new outsourcing arrangements. Specifically, procurement professionals focus largely on negotiating the agreement itself; in their view, the agreement is where the deal is made and where success is measured. Competent VM professionals, on the other hand, consider a deal successful if service providers deliver on their contractual obligations during the contract term and, at the end of the contract term, the service provider has successfully delivered against the organizations objectives.
12
In a fast-paced environment involving complex outsourcing agreements, recruiting and deploying resources with the requisite cross-functional skills can provide the knowledge and experience to protect business-case savings, mitigate risks, and provide visibility into progress through clear communication and reporting, thereby supporting executives in the achievement of their outsourcing agreements objectives. It is this critical yet generally unrecognized fact that can make or break the success of a companys outsourcing program How are companies staffing their VMPOs? Exhibit 9 shows the number of full-time employees (FTEs) our respondents employed on their VMPO teams.
Exhibit 9. Number of resources on VMPO team
the question of whether these resources are actually procurement or service delivery resources undertaking a variety of sourcing, operational, and VM roles. How efficient are these VMPOs, given the size and sheer number of activities that they are performing in both lead and supporting roles? It appears that while many executives believe that they have skilled resources for VM, there may in fact be some confusion as to vendor managers applicable roles and responsibilities, which points to confusion about the skills and experience required to operate VMPOs efficiently and effectively. Approaches to VM tools In our experience, companies often see VM tools as a supplement to their core VM needs rather than as a priority focus area. However, this attitude is changing as the management complexities of outsourcing deals evolve and as executives increasingly look to decrease management overhead and obtain real-time visibility into the current state of their outsourcing programs. The challenge facing both clients and service providers is how to develop and implement a holistic enterprise VM tool to effectively manage the service providers and the services pertaining to a specific outsourcing program. To date, the available software has focused on discrete functions; it has not accommodated a full suite of functionality for VMPO purposes that can adequately track, measure, and report against the metrics associated with each of the 10 VM leading-practice areas. An interesting observation is that some of the more traditional VM functions, such as contract management and issue and dispute management, continue to remain lower priority for technological enablement. This can potentially prevent companies from realizing the full benefits from these traditional core functions. Which functions are companies choosing to focus on with respect to implementing tools? We asked respondents to identify which of seven VM functions were enabled with software tools (Exhibit 10). Interestingly, yet not surprisingly, the responses showed that companies were using tools predominantly in traditional VM areas. Service request workflows, finance and commercial systems,
13
22%
23%
22%
22%
11% 5-10 FTEs 26-50 FTEs 11-20 FTEs >50 FTEs 21-25 FTEs
Upon reviewing the activities being performed by our respondents VMPO resources, it becomes clear that many are taking a lead role in both pre-contract and post-contract execution activities (refer to Exhibits 11 and 12 below).They therefore have broader responsibilities than leading-practice VM roles would recommend. Considering the number of VM activities being performed and the number of resources performing them, along with the finding that only between 5 and 50 percent of our respondents rated their VMPOs as very effective in the various leading-practice areas (Exhibit 13), it can be concluded that many companies are still not effectively recruiting for defined VM functions. This raises
service performance management, and document management were the most common areas of software investment. The results also suggest that companies are becoming increasingly aware of the importance of issue and dispute management: Although only 23 percent of our respondents currently possessed tools to enable issue and dispute management, an additional 14 percent planned to implement tools in this area within the next 12 months. An interesting observation is that some of the more traditional VM functions, such as contract management, remain a lower priority for technological enablement. This can potentially prevent companies from realizing the full benefits from these traditional core functions.
Exhibit 10. Process-level utilization of VMPO tools 50 5 50 9 9 68 68 40 20% 40% 60% 5 64 60 80% 100% N/A 5 23 32 23 27
Pre-contract execution activities should be led by sourcing professionals. This is not to minimize VMs important supporting role in the sourcing process; in fact, in Deloittes experience, many companies are continuing to make the mistake of bringing VM to the table too late. VMs role is to assist the companys sourcing professionals in negotiating specific contract clauses to protect against the risks that commonly arise following execution of the agreement. For example, a VM professional can provide information on how to build effective governance models, change controls, and reporting requirements into the agreement. Bringing a VM professionals knowledge and experience to bear on pre-execution contract activities can be critical to the success of a companys outsourcing program. But despite the importance of involving VM in pre-contract execution activities, VM is still very much in a supporting role. The VM professionals assistance is delivered in the same way that other subject-matter specialists are engaged to define the services and agree on terms within the contract. In contrast, post-contract execution is where the VMPOs core competencies lie: VM professionals take the lead role in making the outsourcing program work. To put it another way, the VMPOs job is to provide effective management so the company can realize the desired value from the outsourcing program. The VMPO should focus on the 10 leading-practice functional areas of VM. It should design the detailed governance model, including guidelines for interactions with the service provider and the roles and responsibilities of the parties involved in the management of the agreement. And it should design and implement processes, systems, and tools to manage the service providers; conduct training; implement effective transition and transformation oversight; and conduct negotiations with service providers (e.g., for new services arising under the agreement, amended services, or any extensions or terminations of the agreement). A VMPOs success can be measured by its ability to reduce cost, increase productivity, achieve flexibility, improve quality, and mitigate risk.
Contract management Financial and commercial management Issue and dispute management Document management Service performance management Service request management Governance Others 0% Yes No, but plan to in the next 12 months 23
36 64 14 59 55
5 5 14 9 5 5 55
No, and no future plans
Dont know
Deloittes view on leading-practice VM Deloitte defines a VMPO as a highly skilled organization whose purpose is to bring maturity and process discipline to strategic outsourcing programs in order to reduce costs, improve productivity and overall performance, preserve business-case savings, and mitigate risks. While it is essential for VM professionals to support pre-contract execution activities, their lead role should be in postcontract execution activities, focusing on managing the agreement in order to meet the outsourcing objectives.
14
The table below summarizes the potential benefits of an effective and dedicated VMPO. Success criteria Reduced cost What an effective VMPO can do Track results versus original business case Determine whether productivity targets and objectives are being met Negotiate changes and manage scope creep Determine leading method for tracking productivity Establish baseline and track progress against contract terms Translate productivity improvements into bottom-line savings or increased capacity Forecast demand and reduce variance Balance flexibility against cost and utilization Utilize contractually committed volumes effectively Potential result without a VMPO Difficult to measure savings year over year; initial savings may not be realized Contracts do not stay static through the term, making original cost savings even harder to track Three to 5 percent annual improvement if mandated; 0 percent improvement if not mandated Difficult to measure/test
Increased productivity
Flexibility
Minimum commitment required to achieve desired rates Short-term rates 30 percent higher r Ineffective utilization of demand and capacity management models Service providers used as staff augmentation Few service level commitments No real opportunity for service providers to innovate Inability to meet cost-saving targets due to delays in programs, scope creep, and escalation delays Dissatisfied internal stakeholders; delays in achieving steady-state status
Improved quality
Encourage utilization of service providers beyond pure staff augmentation Track, report, and improve service levels Determine that quality goals are not excessive Define and implement enterprise methodology for assessing the progress of transition and transformation programs Define governance structure for approving milestone payments, exceptions, and monitoring interdependencies between programs
Risk mitigation
Companies current VM practices How closely did the survey respondents VMPOs align with Deloittes views on leading VM practices? The results continued to build support for the hypothesis that most companies VM maturity remains low. A majority of respondents answered that VM took a lead role in the pre-contract execution activities listed in Exhibit 11 (an average of 55 percent across all activities). Fewer respondents reported that VM took a supporting role (an average of 34 percent across all activities). Five percent of the respondents VMPOs took no role at all in one of the specific pre-contract execution activities one might expect VM to be involved with designing the operating model and governance structure. Clearly, these responses are at odds with Deloittes view that VM is more effective in a supporting role for pre-contract activities rather than in a lead role, and suggest that many VMPOs are acting as sourcing groups in addition to performing VM activities.
Exhibit 11. Pre-contract execution
Create value proposition and business case Create the RFP and analyze responses Conduct due diligence and short-list vendors Draft, negotiate, and execute contract Design target operating model and governance structure Service request management 0% Lead role
55 50 55 59 55 68 20% 40% 60%
32 41 32 32 32 5 23
5 9 9 14 9 5 9 5
80% 100% Dont know
Supporting role
VM not involved
15
With respect to post-contract execution activities, a majority of respondents again indicated that the VMPO took a lead role in nine out of the 16 post-contract execution activities listed in Exhibit 12 (an average of 53 percent across all activities). Interestingly, 36 percent of the respondents, on average, indicated that the VMPO took a supporting role in post-contract execution activities. In other words, where one might expect to see a large discrepancy between VMs level of involvement in preand post-contract activities, the results instead showed very little difference at all. At many companies, the VMPOs played a supporting role in budgeting, forecasting, and tracking business case savings. For activities such as performing risk analyses on the service provider, reviewing and reconciling invoices, and developing and executing operating-level agreements (OLAs) between service providers, there was only a 5 percent difference between the percentage of companies where VM played a lead role and the percentage of companies where VM played a supporting role.
Exhibit 12. Post-contract execution
These results are inconsistent with how an effective VM organization should operate. Clearly, although the majority of our respondents said that they had a dedicated VMPO that performed all functional activities, the high percentage of VMPOs taking a supporting role in these activities would suggest that VMPOs have been disenfranchised in many areas, operating as supporting functions to other areas of the business rather than holding primary responsibility for driving service provider management. A critical question, therefore, is: How effective are the dedicated VMPOs that many of our respondents claim cover all leading-practice VM functions and more? How effective can they be if they take a lead role in pre-contract execution activities and play an almost equal measure of lead and support roles in post-contract execution activities? Exhibit 13 shows respondents ratings of the effectiveness of their VM organizations in a variety of areas. The results were not strongly favorable in any category. On average, across all VM objectives, executives reported that: 57 percent of VMPOs were performing very effectively or effectively
Design systems and tools Train on contract operating model Track, manage, and report on performance Negotiate new service and scope changes Track, manage, and resolve disputes and issues Reconcile invoices and facilitate approvals Provide input to budgeting and forecasting Report on actual vs. business case savings Manage, track, and report adherence to SLAs Develop and maintain cross-supplier standards Develop, negotiate, and execute OLAs Consolidate end-to-end SLA and OLA reporting Plan, monitor, and report transition activities Develop and maintain contractual artifacts Perform risk management analysis Provide overall governance 0% 20%
64 55 59 64 68 50 36 41 50 52 38 45 55 59 48 71 40% 60% 43 33 32 55 55 41 29 5 45 27
32 9 36 23 27 9
5 9 5
34 percent of VMPOs were somewhat effective 3 percent of VMPOs were not effective These results can be interpreted in a number of ways. It could be argued that, because an average of only 3 percent of the executives felt that their VMPOs were not effective, our hypothesis that VMPO maturity remains low is invalid. This result might support the view that the VMPOs that organizations are establishing are in fact leading-practice VMPOs with skilled and experienced resources that work effectively to manage outsourcing programs.
5 5 5 5 9
5 14 24 14 41 32 9 5 9 55 19 80% 55 100%
Lead role
Supporting role
VM not involved
Dont know or N/A
Note: Numbers in Exhibit 12 are percentages. 16
Exhibit 13. Effectiveness of VMPOs in achieving objectives
Exhibit 14. Increase effectiveness of VMPOs
Increase operational efciency Manage contract scope and costs Approve changes with a structured framework Meet contractual obligations Process invoices and payments accurately Perform budgeting and forecasting SLA compliance
23 50 23 32 23 23 27 32
45 27 41 32 27
27 18 32 32
5 5 5 5
Standardized VM processes and tools Increased level of skill-set of VM resources through training and external recruiting Performance of end-to-end VM activities, pre and post-contract execution Establishment of performance metrics for the VM function Alignment of VM activities with overall business objectives Better delineated roles and responsibilities for VM Increased level of executive support within the organization Other 0% 4% 20% 40%
63%
59% 59%
5 14 41 5 9
56%
32 41
23
48%
Ensure timely 14 18 5 9 55 transition of services Resolve issues 9 36 27 27 and provide governance Perform continuous 14 9 5 41 32 improvement measures Mitigate conict 9 18 9 23 41 of interest across vendors Increase collaboration 5 14 14 43 24 with joint vendor forums 0% 20% 40% 60% 80% 100% Very effective Not effective Effective N/A Somewhat effective
41%
33%
60%
80%
Note: Respondents were allowed to select multiple options.
However, if this were true, we would expect to see more than an average of 57 percent of respondents rate their VMPOs as effective to very effective. In our experience, at least 90 percent of dedicated VMPOs with highly skilled resources that employ leading-practice VM tools, systems, processes, and procedures should be rated as effective to very effective at governing outsourcing programs. Are our respondents VMPO organizations being spread too thinly across too many pre-contract and post-contract execution activities? Do their VM resources have the right skills to be performing both pre-contract and post-contract execution activities? Are we, in fact, looking at a situation in which organizations, in aggressively setting up VMPOs, are doing so based on either traditional VM practices or partially informed emerging VM practices? Or do our results simply reflect the lack of objective criteria against which companies can measure the effectiveness of their VMPOs? Perhaps this interpretation would explain why responses to the query on how executives would increase the effectiveness of their VMPO organizations were not high in any category (Exhibit 14).
What can be concluded about the efficiency and effectiveness of companies VMPOs? Our survey results clearly show that executives believe that their companies are operating efficient and effective VMPOs and utilizing skilled resources to do so. A closer look at the results, however, suggests that this belief may be misplaced for the following reasons: a. The large number of resources on the respondents VM teams, and the fact that these resources tend to lead both pre-contract and post-contract execution activities, suggests that confusion may exist with regard to VMPO roles and responsibilities and/or that resources may be being leveraged from across different organizational disciplines. b. Respondents indicated that some emerging VM functions are being managed and staffed with skilled resources, which casts doubt on the respondents understanding of leading practices in these areas. c. While many respondents reported that they utilized highly skilled resources, with between 40 percent and 65 percent rating their resources at an advanced
17
or master level, only 57 percent of respondents, on average, rated their VMPOs as effective or very effective. Based on our experience, the use of such highly skilled resources should have yielded better ratings on effectiveness. Moreover, respondents could not identify any definite means of improving effectiveness. This set of findings raises questions around respondents understanding of the skill sets and disciplines required of VMPO resources, the roles of these resources, and the breadth of their activities. Our findings also raise the issue of whether there exists any established metrics by which VMPO effectiveness is being measured. d. While it was clear that companies are addressing emerging VM focus areas, such as supplier risk management and multi-service provider integration, their responses to questions on the priority of functions and their investment in tools show a traditional rather than a leading-practice approach to VM. It is clear, therefore, that the survey results support our hypothesis that VMPO maturity remains low at many companies, even though they have made great inroads into recognizing and actively establishing VMPOs and believe that they have done so effectively.
Respondents also felt that they were getting a higher return on their VMPO investments. The average cost savings that could be directly attributed to the operation of the VMPO was higher than the average investment required, which would make the VMPO a valuable contributor to a companys success. While cost should not be the ultimate measure of a VMPOs success other factors, such as risk mitigation and avoidance of potential cost overruns, should also play into this evaluation it should certainly be a factor in a VMPOs measurement. We believe that by increasing the maturity of their VMPOs, companies can close the gap between their current operations and leading practices by establishing effective operating models, engaging the right VM functions, and employing resources with the requisite skills and experience. This can allow companies to increase operational efficiency and reduce overhead time.
18
III. VMPO operating models
Deloittes view on VMPO operating models There are no generic models as to how a VM framework should be developed and applied within a company. The questions of whether a VMPO should be retained within an organization; whether some functions should be performed onshore, offshore, or by a third party; and whether the VMPO should operate in a centralized or decentralized fashion will be influenced by a range of factors, including the geography of a companys services/ activities, the service provider mix, the locations where services are being performed, tax structures, the scope of service provider solutions, and the companys strategic direction. In order to determine what operating model would be effective for its business requirements, a company should ask specific questions such as: Is the function manual in nature, and would it be compromised if it were removed from the local site? Is the function responsible for making strategic business decisions on a daily basis? Can the work be delivered globally in a standardized manner? Does the function require organizational decision making for developing and implementing leading practices? A number of challenges and benefits are associated with both a centralized and a decentralized model. Some of the benefits of a centralized model, for example, may include: The ability to leverage the skills of global service providers where skills do not exist at the regional level Greater standardization, leading to greater efficiency and cost savings Establishing accountability for the agreement in one area Aggregation of volume levels, resulting in a stronger negotiating position and greater cost savings
These benefits, however, may be balanced by challenges such as: A lack of buy-in and application of centralized systems and processes by the regions Increased complexity in managing the service provider and the cost of delivery Time zone, cultural, and language differences Changes in legal and regulatory requirements that are difficult to incorporate into the model on an ongoing basis Decentralized operating models, in contrast, can realize benefits such as: Tighter control regarding internal decision making, leading to better alignment of choices with the regional location Tighter control around the service provider and therefore around service delivery Greater flexibility with regard to adopting changes in response to legal or regulatory requirements Clearer and faster communication and collaboration However, a decentralized model can face challenges such as: The inability to benefit from economies of scale and the resulting price and service advantages from global agreements The existence of multiple contracts with the same service provider for the same services across regions, leading to greater management overhead Difficulty in meeting global strategies when regions agree on nonstandardized systems and processes, leading to greater inefficiency and cost Refer to Exhibit 15 for schematic representations of decentralized and centralized frameworks for VM operating models.
19
Exhibit 15. Operating model structure
Decentralized CFO Illustrative
Business unit control
Statutory and regulatory reporting
Product control
MI and decision support
Central functions
Supplier management
Supplier management
Supplier management
Supplier management
Supplier management
Offshore supplier
Centralized CFO Illustrative
Central functions
Product control
Supplier management
Supplier relationship manager
Product control
20
Other choices that need to be carefully considered are whether to retain a VMPO or to outsource some or all of the functions to a third party, as well as where to locate the VMPO (onshore or offshore). Both these topics are addressed later in this section. In any event, the decision as to what operating model would be effective for a company must be carefully considered and made with an appreciation of the different options benefits and challenges. Perhaps most importantly, it must be made with a clear understanding of the risks of each option so these can be carefully managed. What VMPO operating models are companies employing? Our survey showed that 62 percent of the respondents were operating their VMPOs under a centralized model. Twenty-nine percent were operating their VMPOs under a decentralized model, and 10 percent were unsure (Exhibit 16). Interestingly, the number of executives who rated their VMPO as effective closely aligns with the number of companies that had adopted a centralized operating model. Traditionally, centralized operating models have typically provided more control over the outsourced environment. Therefore, it could be argued that our respondents satisfaction with the effectiveness of their VMPO organizations is due in part to their centralized
Exhibit 16. Respondents VMPO operating model 9%
operating models, which is in line with our experience. Placing accountability for the management of service providers in one area, as well as being able to dictate the VMPOs processes, tools, procedures, templates, and requirements for resources skills and experience, could arguably result in a more controlled and broad VMPO. Had the responses been the other way around (i.e., if most of the respondents had adopted a decentralized rather than a centralized model), would the satisfaction of the executives with the effectiveness of their organizations have been even lower? Operating model considerations were often a driving factor behind whether to implement a dedicated versus a nondedicated VMPO. Typically, we have found that clients tend to adopt decentralized models in circumstances where 1) businesses are spread across geographies and 2) service providers are in close proximity to client locations, thereby providing ease of access. Indeed, each of these factors was cited by 33 percent of respondents as a reason for not establishing a dedicated VMPO (Exhibit 4). According to Deloittes view on operating models, however, neither of these reasons should stand in the way of the establishment of a dedicated VMPO. A dedicated VMPO with leading-practice processes, procedures, tools, and templates can deliver more benefits to an organization than would be gained with a nondedicated VMPO. Choosing not to establish a dedicated VM function for the reasons cited by our respondents may only exacerbate issues that typically arise in outsourcing programs, such as inconsistent communication, poor or unreliable reporting, and an underestimation of the complexities of managing outsourced service providers. Certainly, being close to and having easy access to service providers can be beneficial, since it can offer more flexibility. This flexibility and ability to respond quickly to change, however, may result in greater reliance on relationships rather than on formal agreements with service providers, which may in turn lead to potential disputes later as to the substance of an agreement. A dedicated VMPO that acts as an organizations single point of contact for service provider management if it is set up with leading-practice models, systems, and processes can achieve the same flexibility while also providing additional benefits around risk mitigation, cost protection,
21
29%
62%
Centralized
Decentralized
Dont know
and operational efficiencies. Similarly, a dedicated VM function that implements leading practices consistently across a global organization can be of great benefit to the enterprise. A key to achieving success in this case is to foster unity and understanding among the different geographies, as well as to establish common intent and understanding with regard to managing outsourced service providers. Approaches to outsourcing VM functions When asked whether their VM functions were outsourced or retained and whether they were performed onshore or offshore, 93 percent of executives, on average, reported that they had retained their organizations internally. Only 5 to 9 percent of executives responded that the areas of service performance management, multi-service provider integration, transition and transformation oversight, document management, and service request management were being performed by a third party (Exhibit 17). Of these functions, service performance management, multiservice provider integration, transition and transformation oversight, and service request management were being performed offshore.
Exhibit 17. Operation of respondents VMPO processes Service provider risk management Service request management Document management Transition and transformation oversight Multi-service provider integration Governance Service performance management Issue and dispute management Financial and commercial management Contract management 0% In-house Third party 20% N/A 40%
Our results show that the majority of executives who had outsourced their VMPO functions did so because they wished to leverage the experience of a third party and/ or because they had identified a lack of the applicable skill set within their organization to successfully perform the function themselves. Interestingly, the motivating factors for outsourcing VMPO functions differ from those commonly attributed to typical outsourcing initiatives. Specifically, none of the executives cited the need to reduce costs, obtain objectivity, or respond to an internal failure as reasons for outsourcing their VMPO functions. This is in line with Deloittes experience working with organizations over the past two years. While many executives who had not outsourced their VMPO functions said that they would not consider doing so, 41 percent acknowledged that they would either consider it or were unsure. This indicates a possible emerging awareness that outsourcing the VM function may be an attractive option that can allow companies to leverage specialized skills and knowledge. What can be concluded from the nature of the functions that organizations have chosen to outsource? Interestingly, the functions that respondents said they had already outsourced were similar to the functions that respondents said they would choose to outsource if they were to do so in the future. Our conclusion, supported by our experience, is that these functions have increased in management complexity with the advent of global multivendor outsourcing programs. In addition, they are areas of focus for regulators (e.g., for regulations around risk management). They are therefore attractive candidates for transitioning to third parties that have demonstrated core competencies in performing these activities. Organizations should nevertheless take care when making the decision to outsource some of these functions. Service request management, for example, relies on the internal client organization to define its business requirements, and it is central to a companies strategic direction. Therefore, any effort to outsource this function should be approached with caution.
95 91 86 90 77 100 95 91 100 100 60% 80% 9
5 9 5 9 55 14
5 9
100%
22
Companies should be careful when choosing to outsource or offshore VM functions. They should embark on any such program with a deep understanding of the risks associated with this decision. Multi-service provider integration, for example, is a functional area where organizations have struggled to adopt models regarding how service providers will work with each other. Executing OLAs and managing joint supplier governance forums are not trivial tasks. In our experience, clients have typically not considered the complexities of relationships with internal stakeholders and the proximity of service providers when offshoring VM functions to their captive centers.
23
IV. Understanding and managing risk through the VMPO
Why is risk management so critical? A look at supplier risk management and multi-service provider integration One of the specific benefits of an effective VMPO is that it can implement controls and tools that provide information to track, measure, manage, and report the inherent risks of outsourcing transactions in which services are transitioned to a third party. VMPO risk management capabilities have become more critical in light of recent economic conditions that have led to increased regulatory scrutiny, compliance and governance issues, and an increasingly complex outsourcing landscape. How are companies approaching risk management with their VMPOs? What programs are they implementing to manage risk? How are they facing the challenge of managing relationships with multiple suppliers that are often individually responsible for delivering separate elements of an end-to-end service to their customers? Risk management Volatile economic conditions and increasing regulatory pressures are driving demand for broad supplier risk management frameworks that provide the experience and information to address the risk of financial losses, business disruptions, and regulatory interventions. Companies are now asking questions such as: How do we bring our supplier risk management (SRM) capability in line with industry practices to enable effective governance and meet regulatory requirements? What are the specific risk drivers that can provide information to gauge the level of risk associated with our critical suppliers? What preventative or mitigating actions can we take to manage supplier risk? How should we measure and report supplier risk, and what data elements need to be captured? In addition, regulators are asking related questions such as: How do companies define who their critical service providers are?
What are the individual components of risk that determine if a supplier is critical? Does the company have clearly defined and wellunderstood supplier tiers? Does the governance framework have clearly defined roles and responsibilities? To what extent is reporting automated? What tools are utilized? How much business knowledge and core process knowledge has been outsourced? How effective are the companys information security assessments? How is the company addressing business plan continuity? Although our survey did not directly ask respondents about their approaches to service provider risk management, some insights into the maturity of this function can be gained from their responses to other questions. As indicated in Exhibit 18, 95 percent of respondents confirmed that their VMPO performed SRM, and 43 percent of these said that these resources possessed either advanced or master level skills. These percentages seem high, as SRM is an emerging discipline and the skills and experience for leading-practice SRM are difficult to assess.
Exhibit 18. Respondent supplier risk management skill level 62%
9%
29%
62%
62%
Master
Advanced
Intermediate
Beginner
N/A
24
Interestingly, although 95 percent of respondents had a supplier risk management function in place, Deloittes experience suggests that many companies approach to risk within their own organization is immature. In the survey, we tried to assess companies appetite for taking and managing supplier risk. To do this, we asked respondents to indicate how often and when they engaged the legal team in performing VM activities. The responses indicated that companies varied in their utilization of legal resources in VM activities. Some respondents took very little risk and engaged legal resources frequently. Others took on much more risk, performing activities traditionally considered to be within the legal realm with little or no legal support (Exhibit 19). On average, 24 percent of respondents VMPOs often engaged the legal function in activities that, according to leading practice and in our experience, VMPOs should have the competency to manage themselves. These activities included providing information on contract interpretation, negotiating new services or scope changes to existing services, and drafting formal correspondence. This percentage is higher than what we have seen with our clients across industry verticals. While legal involvement in these activities is understandable, VM resources should have the skills and experience to manage these activities independently. The risk to the company of not engaging the legal team in these matters is low, while the impact on operational efficiency is high. On the other hand, 16 percent of respondents, on average, only sometimes, rarely, or never involved legal in matters that are generally considered to be high risk. These include terminating the agreement (entirely or in part), supporting contractual dispute resolution, and reviewing contractual termination rights. One way to interpret these results is that companies underestimate or do not understand the risks of failing to engage legal in such activities. They may also lack clearly defined roles and responsibilities or processes for engaging legal. In summary, our results suggest that, in many cases, VMPOs engagement of the legal function is not aligned with the magnitude of the potential risk.
Exhibit 19. Legal involvement in VMPO processes
Support contractual dispute resolution Terminate entire or part of the contract Review contractual termination rights Invoke contractual remedies Negotiate new scope or changes to existing contract Draft formal correspondence Provide advice on contractual issues and assist in contract interpretation 0%
22 30 37 15 19 26 37
20%
19 11 11 30 22 26 15
40%
22 19 22 26 7 22 19 26
60%
22 22 15 19 15 19
57 4 11 7 7 7 4 7 15 4 7 11
100%
11
80%
Always Often Performed by VM
Sometimes
Rarely
Never
Dont know / NA
Deloittes view on the supplier risk management function Companies are increasingly coming to realize that their supplier risk management frameworks are not broad enough to meet current economic and regulatory pressures. As a result, they are actively seeking information about how to address this weakness to establish flexible, scalable, leading-practice supplier risk management programs. A clear definition of supplier risk tiers is necessary to understand the types of risks, such as information security and business plan continuity, which companies should be assessing prior to executing transactions. Understanding supplier risk at the enterprise level can enable effective management of suppliers across the company as a whole, not just on a supplier-by-supplier basis. Managing at the enterprise level can allow companies to understand where risks can overlap and become concentrated, clarifying how individual suppliers can impact more than their respective lines of business. In addition, regulators are also focusing on the types of data not just the volume of data in the hands of third parties that execute transactions on behalf of a client.
25
Additional areas of risk, set out in Exhibit 20, must be managed using a stringent governance framework with a focus on risk at the enterprise level, line-of-business level, and individual supplier level. This can give a company a holistic view of risks. It can also give lower levels of the organization the information and resources to help them make effective decisions on matters, such as reputational risk and concentration risk, which may expose the enterprise as a whole. Reporting requirements should also be a specific focus area. Organizations should focus not only on the quality and accuracy of data, but also on reporting useful, actionable data and metrics to senior stakeholders.
Exhibit 20. Different risk areas in SRM
Enterprise level
Line-of-business level
Supplier level
Confidentiality of information
Transaction/Operational
Business continuity
Compliance/Legal
Financial stability
Data integrity
Perhaps most importantly, as the economic and regulatory environment continues to change, companies must flex and adapt to accommodate this change. As new risk scenarios arise, companies should be vigilant in identifying challenges and enhancing their regulatory risk definitions in order to improve their supplier risk management practices. For example, risk management processes should be flexible and scalable enough to report metrics at a level of detail in which metric measurements can differentiate between supplier A and supplier B, especially as there are often several different types of critical suppliers. Deloittes experience indicates that by implementing an effective supplier risk management model with applicable processes, systems, tools, and templates, companies can achieve the rigor and structure to effectively identify, manage, and mitigate supplier risk at the enterprise level and address certain questions. Doing so can provide information to companies to: Meet regulatory requirements Standardize and manage operational risk Achieve a strategic and holistic view of risk within a portfolio of providers spread across various functions, services, and geographies Utilize metrics and reports to assess supplier risk at the enterprise, line-of-business, and supplier levels Make applicable management information available to support effective governance, control points, and decision making.
Multi-service provider integration another risk? As the market evolves towards cross-functional service delivery models (Exhibit 21), companies are leveraging multisourcing environments for a variety of reasons. This move towards multi-service provider programs that deliver multiple mixes of products and services in multiple geographies, as well as the combined use of captive, offshore, onshore, and near-shore models, is leading to an increasingly complex service provider environment. Aspects of this complexity include: The increasing focus on creating healthy competition between service providers may lead to disruptive service delivery environments where elements of end-to-end processes are outsourced to several providers. Evolving regulatory requirements and a focus on third-party relationships has increased companies risk exposure. Multiple hand-offs between service providers have led to increased exposures. Often, there is no single point of control with accountability for the end service.
26
Contractual
Risk areas
Reputation
Strategic
Credit
Exhibit 21. Outsourcing market maturity
Staff augmentation
Siloed functional sourcing
Multisourcing (multi-vendor)
Business transformation
80% 70% 60% 50% 40% 30% 20% 10% 0%
76%
48% 34% 34%
3% No single vendor can meet all requirements To mitigate risk Existing relationship with some of the vendors Existing relationship with incumbent vendor(s) Location
5% Other
Source: Why Settle For Less? Deloitte Consulting 2008 Outsourcing Report, Deloitte Development LLC, 2007.
Execution gaps have appeared between service providers, as poor governance and communication can lead to deliverables slipping through the cracks. A lack of alignment between service providers, as well as the inherently siloed nature of multi-service provider environment in the absence of a service integrator role, has been driving inefficiencies, eroding cost savings, and failing to achieve innovation on an enterprise scale. These challenges are now driving companies to seek new methods of managing their service providers. As a result, multi-service provider management has become an emerging area of focus. What are companies looking to achieve from multi-service provider integration? Essentially, executives are focusing on increased governance over their service providers, seeking to establish a centralized function to coordinate and manage its service providers in the outsourcing chain. By establishing such a function, executives are seeking to achieve:
Designated accountability for delivery Increased operational efficiency Alignment between their business units and the outsourced functions Successful execution of programs of work Increased risk visibility Increased resource utilization A focus on innovation and continuous improvement Effective end-to-end service delivery from many of the providers in its service chain Deloittes view on the service integration function A service integration function should effectively establish a common platform that allows an organization to integrate and execute multi-service provider programs while focusing on service delivery and value generation. As shown in Exhibit 22, service integration functions should provide end-to-end governance, integrate service delivery across both insourced and outsourced entities, and establish cross-supplier operational level agreements across programs.
27
Exhibit 22. Service integration functions Service integration function (SIF) building blocks SIF functions
Description
To align project portfolio and services to enterprise strategy, risk, and security requirements To map end-to-end service levels, monitor crosssupplier performance, and manage transition
en
Portfolio management Security and risk management Service delivery Performance management Transition and transformation management Governance Strategy and architecture Process development and monitoring Quality and compliance management
Se
em
ag
rvi ce
an
an
ra m
ag em
Pr og
en
C Governance
To provide governance, define OLAs/SLAs, test alignment to IT strategy, and develop cross-supplier processes
ion
an
ag
em
en
at
The core elements of a service integration function are: Program management Service management Quality and compliance Innovation management Governance Effective execution of these capabilities can enable an effective service delivery environment with clear roles, responsibilities, and accountabilities, as well as a strong measurement and reporting capability across the outsourcing program life cycle. An effective service integration function can also enable companies to more efficiently adopt and integrate various industry-leading practices and frameworks. Perhaps most importantly, an
Inn
ov
Qu ali ty an dc om pli an ce
28
To define quality objectives and adherence to standards, and manage quality assurance for end-to-end IT service portfolio To drive holistic innovation across service providers and derive value from outsourced initiatives
Innovation and continuous improvement
effective service integration function can identify service delivery risks where several providers are involved in an end-to-end process. How are companies approaching multi-service provider integration? The survey results reinforce Deloittes experience of how companies are approaching multi-service provider integration. While the demand for a solution for managing multiple service providers is becoming a hot topic in the market, many companies do not fully understand how to achieve effective multi-service provider integration, and many may not appreciate the risks associated with lacking a service integrator function. While 77 percent of our respondents had more than two service providers involved in their outsourcing program (refer to Exhibit 23), fewer respondents VM functions performed multi-service provider integration than any other of the 10 leadingpractice VM areas (Exhibit 6). This may be because service integration was the activity most likely to sit outside of VM.
Exhibit 23. Number of service providers involved in the outsourcing program
23%
23%
16% 19%
19% 1 2 to 3 4 to 5 6 to 10 >10
Interestingly, service integration was the only function for which none of our respondents felt they had master-level resources. Indeed, many executives felt that their VM organizations were only somewhat effective in service integration. We view it as a positive sign that VMPOs are managing service integration at all. However, in order to successfully deliver an outsourcing program and mitigate the risks inherent in a situation where each service provider works independently against their respective agreements, companies must place the multi-service provider integration function wholly within one area and agree on roles and responsibilities, operational-level agreements, and joint performance metrics. Doing this can provide the information to the service integration function support end-to-end service without the need for significant executive management overhead.
29
Conclusion
Changes in both buyer behavior and supplier solutions will continue to evolve in the coming years due not only to technological innovations but also to the changing balance between risk appetite and increasing demand for shareholder returns. The complexities of executing outsourcing and offshoring transactions are continuing to be offset by a number of leading-practice standards in terms of contracting vehicles and language. However, clients must also realize that the corresponding risks of outsourcing remain. They continue to evolve and becoming more challenging as new services appear and additional geographies begin to supply services. Clients would do well to appreciate and understand that investing in tools and people and building an effective
vendor management function now can allow them to not only manage the risks of today but can also suitably equip them with a platform to more effectively manage emerging risks. Such investments should also include flexible and scalable operating models that can allow changes in business demand to be more efficiently executed. The financial and nonfinancial benefits of outsourcing remain. However, the question also remains as to whether clients are suitably equipped to realize these benefits through a vendor management program office. We remain optimistic, and we hope this report provides both inspiration and guidance to those who are passionate about making outsourcing work within their enterprises. As we stated up front, Never say never! Despite the challenges, outstanding business performance improvement through outsourcing can be achieved.
Acknowledgement Deloitte would like to acknowledge the work of Ajay Bolina, the principal investigator who led the development and publication of this report, and his dedicated team around the world. Without them, this report would not have been possible. Ajay Bolina Senior Manager Outsourcing Advisory Services Deloitte Consulting LLP Office: +1 973 602 5635 abolina@deloitte.com
30
Contacts
For further information, please contact: United States and Latin America (other than Mexico) Peter Lowes Principal Outsourcing Advisory Services Leader Deloitte Consulting LLP New York, NY +1 212 618 4380 plowes@deloitte.com Canada Colleen Gordon Associate Partner Outsourcing Advisory Services Deloitte Inc. Toronto, ON +1 416 601 6739 cogordon@deloitte.ca Mexico Jorge Gutirrez Director Deloitte Mexico Aguascalientes , Mexico +52 449 910 8656 jogutierrez@deloittemx.com Asia/Pacific and Australasia (Other than Japan) Peter Barta Principal Deloitte Services Pty Ltd Melbourne, Australia +61 3 9671 6699 pbarta@deloitte.com.au Japan Koji Miwa Partner Deloitte Tohmatsu Consulting Co., Ltd. Tokyo, Japan +81 3 4218 7142 kmiwa@tohmatsu.co.jp
United Kingdom and EMEA (Other than Italy, Switzerland and the Netherlands) Neville Howard Partner Deloitte MCS Ltd. London, U.K. +44 0 20 7303 7252 nhoward@deloitte.co.uk Switzerland Fabrizio Napolitano Director Deloitte Consulting AG Zurich Switzerland +41 44 421 6766 fnapolitano@deloitte.ch Italy Massimo Tomasi Partner Deloitte Consulting S.P.A. Milano, Italy +39 0283323428 matomasi@deloitte.it Netherlands Stef Oud Partner Deloitte Consulting B.V. Eindhoven, Netherlands +31 65 2048996 soud@deloitte.nl
31
Country consulting leadership: EMEA Consulting Leader EMEA Consulting Deputy Leader Austria Belgium Central Europe* CIS** Denmark East Africa*** Finland France Germany Greece Ireland Israel Italy Luxembourg Malta Middle East**** Netherlands Norway Pakistan Portugal South Africa Spain Sweden Switzerland Turkey UK West and Central Africa***** John Kerr Eric Delgove Georg Krause Stephan Raemaekers Rick Olcott Zagreb Mark Franklin Morten Ry John Kiarie Lauri Byckling Christian Chattey Heribert Pabst Chris Konstantinou David Hearn Michal Simler Pierluigi Brienza Thierry Hoeltgen Steve Cachia Nader Srouji Mario van Vliet Sjur Gaaseide Asad Ali Shah Nuno Belo Louis Geeringh Jose Luis Diaz Cepero Per-Ola Olsson David Owen Ugur Suel David Owen Joseph Olofinsola
* Central Europe: Albania, Bosnia and Herzegovina, Bulgaria, Croatia, Czech Republic, Estonia, Hungary, Latvia, Lithuania, Macedonia, Moldova, Poland, Romania, Serbia and Montenegro, Slovakia and Slovenia. ** CIS (Commonwealth of Independent states): Azerbaijan, Belarus, Georgia, Kazakhstan, Kyrgyzstan, Russia, Ukraine, Uzbekistan. *** East Africa: Kenya, Mauritius, Tanzania, Uganda, Zambia **** Middle East: Bahrain, Jordan, Kuwait, Lebanon, Qatar, Saudi Arabia, United Arab Emirates, Yemen ***** West and Central Africa: Cameroon, Ghana, Nigeria, The Gambia For additional contact information, please go to www.deloittte.com. Click on Contact and select Office-Phone Locator.
32
33
This publication contains general information only and is based on the experiences and research of Deloitte practitioners. Deloitte is not, by means of this publication, rendering business, financial, investment, or other professional advice or services. This publication is not a substitute for such professional advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified professional advisor. Deloitte, its affiliates, and related entities shall not be responsible for any loss sustained by any person who relies on this publication. Copyright 2011 Deloitte Development LLC. All rights reserved. Member of Deloitte Touche Tohmatsu Limited

Deloitte VMPO

Загружено:

Сведения о документе

Авторское право

Доступные форматы

Поделиться этим документом

Поделиться или встроить документ

Параметры публикации

Этот документ был вам полезен?

Это неприемлемый материал?

Авторское право:

Доступные форматы

Deloitte VMPO

Загружено:

Авторское право:

Доступные форматы

The Outsourcing Vendor Management Program Office (VMPO): Art, science, and the power of perseverance Never say

Foreword 1 Executive summary Research overview 2 3

Exhibit 1b. Company respondent prole: Industry

11% 22% 11%

Exhibit 1c. Company respondent prole: IT functions/services outsourced

4% 4% 7% 4% Canada Italy Japan Mexico Netherlands Switzerland 11%

11% United Kingdom United States

Product lifecycle management Service catalog management

Solution advisory Internal IT service delivery

I. Evolution of VMPO requirements

29% 24% 23% 20% 17% 51%

Lack of resources and expertise

Geographical business spread

Note: Respondents were allowed to select multiple options.

Why Settle for Less?, Deloitte  Development LLC, 2007.

25% 1% - 3% 4% - 7% >7% Dont know

II. VMPO maturity

Exhibit 6. Involvement in VMPO processes

85 81 95 20% 40% 60%

38 28 35 24 38 33 40% 60% Master 5 5 10

80% 100% N/A

Note: Numbers in Exhibit 7 are percentages.

Exhibit 8. Importance of VMPO objectives

Very important Very unimportant

Note: Numbers in Exhibit 8 are percentages.

No, and no future plans

Note: Numbers in Exhibit 10 are percentages.

Exhibit 11. Pre-contract execution

55 50 55 59 55 68 20% 40% 60%

80% 100% Dont know

Note: Numbers in Exhibit 11 are percentages.

Dont know or N/A

Note: Numbers in Exhibit 12 are percentages. 16

Exhibit 13. Effectiveness of VMPOs in achieving objectives

Exhibit 14. Increase effectiveness of VMPOs

Note: Respondents were allowed to select multiple options.

Note: Numbers in Exhibit 13 are percentages.

III. VMPO operating models

Exhibit 15. Operating model structure

Decentralized CFO Illustrative

Business unit control

Statutory and regulatory reporting

MI and decision support

Centralized CFO Illustrative

Business unit control

Statutory and regulatory reporting

MI and decision support

Supplier relationship manager

Supplier relationship manager

Supplier relationship manager

Business unit control

Statutory and regulatory reporting

MI and decision support

95 91 86 90 77 100 95 91 100 100 60% 80% 9

Note: Numbers in Exhibit 17 are percentages.

IV. Understanding and managing risk through the VMPO

Exhibit 19. Legal involvement in VMPO processes

Always Often Performed by VM

Note: Numbers in Exhibit 19 are percentages.

Exhibit 20. Different risk areas in SRM

Exhibit 21. Outsourcing market maturity

Siloed functional sourcing

80% 70% 60% 50% 40% 30% 20% 10% 0%

48% 34% 34%

Why Settle for Less?, Deloitte Development LLC, 2007.

Innovation and continuous improvement