Legally speaking: what not to do when outsourcing operations
First published in The Royal Gazette, Legally Speaking, November 2022
In the course of my career, I have drafted, negotiated or otherwise provided commercial and legal advice concerning well more than 300 outsourcing contracts of all types.
Whether as inter-company shared service contracts among affiliates or with commercial outsourcing service providers, there are several important contracting mistakes that are pervasive but easily avoided.
When pricing an inter-company outsourcing service agreement with an affiliate, whether as a domestic or cross-border transaction, many clients forget that fair market value pricing is fundamentally premised on a comparison with arms-length commercial outsourcing agreements.
Service pricing is always a function of both the services to be performed and all the contractual obligations that the parties assume. Commercially normal terms and conditions will include a wide range of standard risk management terms, performance warranties, comprehensive and detailed performance specifications, allocation of risk and liability, and professional service quality provisions.
Commercial outsourcing service agreements are routinely, almost without exception, more than 100 pages long, including performance appendices. So, if your inter-company outsourcing agreement is not a pillar of commercial market comparison — at worst, written on the back of a napkin — then you may want to reassess whether the transfer pricing is truly on-market for that particular quality of agreement.
Second, every customer is subject to a plethora of third-party confidentiality, data protection, cybersecurity, operational governance, information integrity and privacy-related obligations, laws and regulations.
Whether those are imposed by your trading partners, your auditors, by stock exchanges, one or more regulators or by statutes of general application, your company will remain directly responsible and liable for compliance with all of those duties, obligations and requirements regardless of who operates what aspects of your enterprise.
Even though you can outsource parts, or all, of your operations to downstream third-party service providers, you cannot delegate any of your upstream compliance accountability to your outsourcing service providers. Therefore, the only way for your enterprise to avoid being caught in the middle between satisfying those upstream obligations and your service provider’s conduct is by ensuring that all upstream third-party, legal and regulatory obligations are completely flowed down to the service provider via express contractual obligations, duties and requirements.
As examples: how can a highly regulated enterprise possibly comply with its obligations to notify its regulators of a cybersecurity breach if its outsourcing service provider isn’t contractually required to disclose those incidents when they occur; and, how can you ensure that a service provider will permit a service quality inspection by one of your regulators if the contract doesn’t require that assistance?
Perhaps the leading cause of dispute and litigation across all forms of outsourcing transactions arises due to the failure of the parties to stipulate comprehensive, detailed and clear operational, technical and functional service quality and performance requirements, including those that arise as legal compliance requirements.
Indeed, regulatory requirements can create a large inventory of required outsourcing services that must be performed. The more objectively and empirically those service performance requirements are stated in the service contract, the less likelihood there will be for service performance misunderstanding.
Although that contracting mistake may be more prevalent in affiliated company service arrangements, it is a rampant deficiency across far too many commercial outsourcing transactions.
Operational activities of many enterprises, such as banks and insurance companies, can be highly complex and depend upon detailed operational processes.
Therefore, properly articulated outsourcing service performance requirements may reasonably reach well more than many dozens of pages in length, often due to the insistence of the commercial service provider who seeks to minimise service misunderstandings as well as facilitate the calculation of reasonable service pricing.
Lastly, parties who outsource any part of their operations, whether IT or otherwise, are very well advised to on-board all services with acceptance testing processes, service quality verification, and with ongoing performance quality monitoring – which may include inspection and auditing – that are tied to contractual rights for service performance correction and improvement as needed.
