Orig­i­nal source pub­li­ca­tion: de Sá-Soares, F., D. Soares and J. Arnaud (2014). Towards a The­ory of Infor­ma­tion Sys­tems Out­sourc­ing Risk. Pro­ceed­ings of the Con­fer­ence on Enter­prise Infor­ma­tion Sys­tems 2014—CEN­TERIS 2014. Tróia (Por­tu­gal).
The final pub­li­ca­tion is avail­able here.

Towards a The­ory of Infor­ma­tion Sys­tems Out­sourc­ing Risk

Fil­ipe de Sá-Soares, Del­fina Soares and José Arnaud

Uni­ver­si­dade do Minho—Depar­ta­mento de Sis­temas de Infor­mação—Cen­tro ALGO­RITMI, Guimarães, Por­tu­gal

1. Introduction

The sur­viv­abil­ity and pros­per­ity of any orga­ni­za­tion depends cru­cially on its capa­bil­ity to per­form a set of activ­i­ties that result in the deliv­ery of a valu­able prod­uct or ser­vice for the mar­ket. In order to enhance their value chain, orga­ni­za­tions use var­i­ous tech­no­log­i­cal and man­age­r­ial solu­tions to sup­port their busi­ness processes. These solu­tions may be devel­oped inter­nally or pro­cured exter­nally to the orga­ni­za­tion, con­fig­ur­ing the two main ways to obtain any type of resources–insourc­ing and out­sourc­ing. Con­fronted with fierce com­pe­ti­tion in the con­text of global eco­nomic and finan­cial crises, com­pa­nies strive for greater effi­ciency and reduced costs, while at the same time try to increase their spe­cial­iza­tion in a lim­ited num­ber of key areas. This state of affairs may tip orga­ni­za­tions to the out­sourc­ing side of the sourc­ing bino­mial, trans­form­ing the out­sourc­ing option in a crit­i­cal strate­gic deci­sion [McIvor 2008].

In the realm of infor­ma­tion sys­tems (IS), out­sourc­ing involves mak­ing arrange­ments with an exter­nal party for the par­tial or total pro­vi­sion of the man­age­ment and oper­a­tion of an orga­ni­za­tion’s infor­ma­tion tech­nol­ogy (IT) assets or activ­i­ties [Kern and Will­cocks 2001]. These arrange­ments take the form of con­tracts that state the agree­ment between two enti­ties: the cus­tomer of the out­sourc­ing ser­vices and the provider (or providers) of those ser­vices.

The rel­e­vance of IS out­sourc­ing is evi­denced by Gart­ner’s fore­casts of a world­wide mar­ket reach­ing $288 bil­lion in 2013 [Gart­ner 2013] and of a growth rate of 5.2% in 2014 [Gart­ner 2014]. It may also be appre­ci­ated by con­sid­er­ing the accu­mu­lated knowl­edge pro­duced on the area (cf. [Dib­bern et al. 2004] and [Lac­ity et al. 2009]).

Prior to embark upon an IS out­sourc­ing project, an orga­ni­za­tion should pon­der the expected costs and ben­e­fits of the out­sourc­ing option. If the orga­ni­za­tion decides to pro­ceed with the out­sourc­ing, the con­sid­er­a­tion of the cost­ben­e­fit rela­tion­ship should per­sist, in order to take into account the ben­e­fits really achieved and the costs incurred. Asso­ci­ated with ben­e­fits and costs of an out­sourc­ing deal there is a set of risks. These risks need to be man­aged if the trans­ac­tion between an out­sourc­ing cus­tomer and one or more out­sourc­ing providers is to be suc­cess­ful.

Var­i­ous stud­ies have been con­ducted on IS out­sourc­ing risks, address­ing issues such as sources of risks, pro­fil­ing and pri­or­i­ti­za­tion of risks, and actions to reduce the impact of risks. To some extent, that col­lec­tion of works forms a frag­mented, although extremely valu­able, set of con­tri­bu­tions. This inter­pre­ta­tion moti­vated us to seek an inte­grated view of IS out­sourc­ing risks. In fact, some authors have already made efforts to that end, such as Bahli and Rivard [2003] who extended the risk assess­ment frame­work used in engi­neer­ing to ana­lyze IS out­sourc­ing risks, sug­gest­ing the need to com­bine risk sce­nar­ios, risk fac­tors, con­se­quences and mit­i­ga­tion mech­a­nisms. This paper builds upon that col­lec­tion of stud­ies and inte­gra­tive efforts. Our goal is to con­trib­ute towards the syn­the­sis of a the­ory of IS out­sourc­ing risk. We believe this the­ory may prove par­tic­u­larly use­ful to prac­ti­tion­ers ana­lyz­ing the fea­si­bil­ity of an IS out­sourc­ing project or steer­ing ongo­ing IS out­sourc­ing trans­ac­tions and to researchers deep­en­ing our under­stand­ing of the IS out­sourc­ing risk man­age­ment process.

The paper is struc­tured as fol­lows. After this intro­duc­tion, a con­cep­tual scheme for inter­pret­ing the lit­er­a­ture on IS out­sourc­ing risks is pro­posed, fol­lowed by the descrip­tion of the work. Next, a pre­lim­i­nary ver­sion of a cat­a­log of IS out­sourc­ing risks is pre­sented and dis­cussed. Finally, con­clu­sions are drawn and future work is sug­gested.

2. Conceptual Scheme

The aim of this study is to make a con­tri­bu­tion in the domain of IS out­sourc­ing that may assist in the near future in the cre­ation of a the­ory of IS out­sourc­ing risk. As for­mu­lated, this ulti­mate objec­tive builds on three main con­cepts: IS out­sourc­ing, the­ory and risk. As a first step towards that research goal, we will briefly dis­cuss each of these three con­cepts in order to develop a con­cep­tual scheme on which to base the gen­er­a­tion of such the­ory.

IS out­sourc­ing is not a new phe­nom­e­non. Since its emer­gence in the 60s, it has under­gone sev­eral changes: from an empha­sis on time-shar­ing ser­vices, it evolved to the appli­ca­tion ser­vice pro­vi­sion (ASP) model in the late 90s, and then to ser­vice-ori­ented com­put­ing (SOC) and on-demand/util­ity com­put­ing in the begin­ning of this cen­tury [Vas­sil­iadis et al. 2006]. Also, from a geo­graph­i­cal point of view, it has diver­si­fied from domes­tic pro­vi­sion of ser­vices by third par­ties to off­shore out­sourc­ing, where the respon­si­bil­ity for man­age­ment and deliv­ery of IT ser­vices is located in a dif­fer­ent coun­try from that of the cus­tomer [Sab­her­wal 1999].

Whether the pur­pose for out­sourc­ing is the exter­nal­iza­tion of IT infra­struc­ture, appli­ca­tion devel­op­ment, or IS man­age­ment respon­si­bil­i­ties, just to name a few, it is pos­si­ble to con­ceive IS out­sourc­ing as a process com­posed of two main phases: the deci­sion process and the imple­men­ta­tion [Dib­bern et al. 2004]. The deci­sion process phase encom­passes three stages, in which orga­ni­za­tions weight up the advan­tages and dis­ad­van­tages of IS out­sourc­ing, address alter­na­tive out­sourc­ing arrange­ments and finally make the deci­sion after com­par­ing the var­i­ous out­sourc­ing options. The imple­men­ta­tion phase is orga­nized by [Dib­bern et al. 2004] in two stages: how and out­come. The ‘how’ stage includes the selec­tion of the provider and the cus­tomer-provider rela­tion­ship related activ­i­ties, namely rela­tion­ship struc­tur­ing (con­trac­tual process), rela­tion­ship build­ing (strength­en­ing the rela­tion­ship between cus­tomer and provider) and rela­tion­ship man­age­ment (dri­ving the rela­tion­ship in the right direc­tion). The ‘out­come’ stage reflects the con­se­quences of the out­sourc­ing choice that was made, the degree of suc­cess of the arrange­ment and lessons from the out­sourc­ing.

The sec­ond fun­da­men­tal con­cept we review is the­ory. A the­ory is a set of defined and inter­re­lated con­structs that presents a sys­tem­atic view of phe­nom­ena [Ker­linger 1986]. In order to be con­sid­ered a the­ory, a con­cep­tual arti­fact must iden­tify the con­structs that com­pose it, spec­ify the rela­tion­ships among these con­structs, and be so for­mu­lated that these rela­tion­ships are able to be tested, i.e., are fal­si­fi­able [Doty and Glick 1994].

The impor­tance of the­ory may be appre­ci­ated by con­sid­er­ing its pri­mary goals: analy­sis and descrip­tion (descrip­tion of the phe­nom­e­non of inter­est and analy­sis of the rela­tion­ships among con­structs), expla­na­tion (how, why, and when things hap­pen), pre­dic­tion (what will hap­pen if cer­tain pre­con­di­tions hold) and pre­scrip­tion (pro­vi­sion of a recipe to the con­struc­tion of an arti­fact) [Gre­gor 2006]. In this study we are inter­ested in the IS out­sourc­ing phe­nom­e­non from the per­spec­tive of risk, our third fun­da­men­tal con­cept to dis­cuss.

Risk is a word with mul­ti­ple mean­ings. Rec­og­niz­ing the inco­her­ent use of the con­cept, Slovic [1999] iden­ti­fied four main con­cep­tions for risk: a dan­ger­ous activ­ity (“Where is in the list the risk of fly­ing by plane?”), a prob­a­bil­ity (“What is the annual risk of death at eighty?”), a con­se­quence (“What is the risk of let­ting the park­ing meter expire? Answer: be fined!”), and a dan­ger or threat asso­ci­ated to an activ­ity or tech­nol­ogy (“How big is the risk of smok­ing cig­ars?”).

In the lit­er­a­ture it is pos­si­ble to find these dif­fer­ent con­cep­tions of risk. Aubert et al. argue that risk encom­passes the mean­ing of neg­a­tive out­come, such as short­falls in sys­tems per­for­mance, dis­rup­tion of ser­vice to cus­tomer, and loss in inno­v­a­tive capac­ity, and the mean­ing of fac­tors lead­ing to neg­a­tive out­comes, such as a con­tin­u­ing stream of require­ment changes or per­son­nel short­falls, lack of upper man­age­ment com­mit­ment, and busi­ness uncer­tainty [Aubert et al. 1998]. Sim­i­larly, in ISO 31000 stan­dard is observed that risk is often char­ac­ter­ized by ref­er­ence to poten­tial events, con­se­quences, or a com­bi­na­tion of these, being often expressed in terms of a com­bi­na­tion of the con­se­quences of an event and the asso­ci­ated like­li­hood of occur­rence [ISO 2009]. Will­cocks and Lac­ity view risk as a neg­a­tive out­come that has a known or esti­mated prob­a­bil­ity of occur­rence [Will­cocks and Lac­ity 1999]. Bahli and Rivard per­ceive risk as a dan­ger or haz­ard [Bahli and Rivard 2003]. Lac­ity et al. [2009] define risk as the prob­a­bil­ity of an action adversely affect­ing an orga­ni­za­tion. Despite the diver­sity of mean­ings of the term risk, Renn iso­lated a com­mon ele­ment among all def­i­n­i­tions, namely the dis­tinc­tion between real­ity and pos­si­bil­ity [Renn 1992]. Under this assump­tion, that author defined risk as the pos­si­bil­ity that human actions or events lead to con­se­quences that have an impact on what peo­ple value [Renn 1992]. In a sim­i­lar vein, the stan­dard ISO 31000 defines risk as the effect (pos­i­tive and/or neg­a­tive) of uncer­tainty on objec­tives [ISO 2009]. At this point a dis­tinc­tion between risk and uncer­tainty is needed. As soon as 1921, Knight con­trasted between the con­cepts of uncer­tainty and risk, not­ing that the for­mer is present when the like­li­hood of future events is indef­i­nite or incal­cu­la­ble, while the lat­ter is present when future events occur with mea­sur­able prob­a­bil­ity [Knight 1921]. This dis­tinc­tion con­trib­utes to cor­rectly place the role of like­li­hood (prob­a­bil­ity) in risk related con­structs. A final impor­tant deriva­tion from the con­cep­tion of risk by [Renn 1992] is that risks may be con­ceived as men­tal rep­re­sen­ta­tions of threats capa­ble of caus­ing losses or as oppor­tu­ni­ties that can pro­duce gains. This last alter­na­tive view of the con­cept of risk is in sharp con­trast with the com­mon view that asso­ciates risk to haz­ard. In this study we adopted the for­mer view of risk, focus­ing our atten­tion on the pos­si­bil­ity of some unfa­vor­able event or out­come occur in the realm of IS out­sourc­ing. Nev­er­the­less, we will address the use­ful­ness of the alter­na­tive view of risk for the man­age­ment of IS out­sourc­ing in the con­clu­sion sec­tion of this paper.

Given the aim of this study, the review of lit­er­a­ture on the con­cepts of the­ory and risk prompted us to develop a con­cep­tual scheme that could pro­vide a basis for con­struct­ing a the­ory of IS out­sourc­ing risk, by shap­ing and orga­niz­ing our inter­pre­ta­tion of the find­ings in IS out­sourc­ing lit­er­a­ture. To this end, we pro­pose the con­cep­tual scheme illus­trated in Fig­ure 1.

Fig­ure 1: Con­cep­tual Scheme

A dan­ger is a poten­tial cause of a neg­a­tive out­come; it is not, by itself, a real­ized dam­age. A neg­a­tive out­come is an adverse result from which derives an unde­sir­able con­se­quence. An unde­sir­able con­se­quence con­fig­ures an explicit loss to the entity (in this case the orga­ni­za­tion), in terms of tan­gi­ble or intan­gi­ble assets or oppor­tu­ni­ties to reap future ben­e­fits. Both dan­gers and neg­a­tive out­comes are pos­si­bil­i­ties that may cul­mi­nate in unde­sir­able con­se­quences. A neg­a­tive out­come and the orig­i­nat­ing dan­ger are of inter­est to an orga­ni­za­tion due to the unde­sir­able con­se­quences that may entail for the orga­ni­za­tion. Asso­ci­ated with a dan­ger and a neg­a­tive out­come there is a like­li­hood of occur­rence. Dif­fer­ent dan­gers and neg­a­tive out­comes may present dis­tinct lev­els of sever­ity. In con­trast, a fac­tor is an attribute of some entity or sit­u­a­tion that increases the expo­sure of the orga­ni­za­tion to a dan­ger. Con­trary to dan­gers and neg­a­tive out­comes, at a given time a fac­tor has a well deter­mined non-prob­a­bilis­tic value. Finally, a mit­i­ga­tion action con­sists in an act, usu­ally per­formed by the entity that may suf­fer the unde­sir­able con­se­quence, expected to lessen the inten­sity of a neg­a­tive out­come, even­tu­ally nul­li­fy­ing it.

3. Study Description

Hav­ing defined the con­cep­tual scheme, we pro­ceeded to review lit­er­a­ture that explic­itly addressed IS out­sourc­ing risks. In order to pur­sue the goal of gen­er­at­ing a the­ory of IS out­sourc­ing risk, it is essen­tial to take into account the wealth of stud­ies con­ducted in the area. Our pur­pose was to inter­pret the find­ings in the lit­er­a­ture in light of the pro­posed con­cep­tual scheme. We began by con­duct­ing a lit­er­a­ture search in the main sci­en­tific index­ing plat­forms and repos­i­to­ries, such as ISI Web of Knowl­edge, SCO­PUS, Google Scholar, b-on, and AIS Elec­tronic Library. The search cri­te­ria involved look­ing for expres­sions “IS out­sourc­ing”, “IT out­sourc­ing” and “risk” in the title or abstract of papers. The results were screened for rel­e­vance, yield­ing a list of 33 papers. The next step was to char­ac­ter­ize the IS out­sourc­ing risks dis­cussed in those stud­ies. For that mat­ter, we built a repos­i­tory of IS out­sourc­ing risk related ele­ments. These ele­ments were diverse in nature, includ­ing issues such as risk fac­tors, risks, con­se­quences, adverse events, risk mit­i­ga­tion mech­a­nisms, risk man­age­ment strate­gies, risk man­age­ment prac­tices, and risk pro­files. From this rec­ol­lec­tion exer­cise we got 727 risk related ele­ments (cor­re­spond­ing to an aver­age of 22 risk ele­ments per paper, with a min­i­mum of 1 ele­ment and a max­i­mum of 131 ele­ments). To make sense of this set of issues we clas­si­fied them accord­ing to the con­structs found on our con­cep­tual scheme. In addi­tion, we also clas­si­fied each issue accord­ing to the party involved, namely IS out­sourc­ing cus­tomer or IS out­sourc­ing provider. Given the pre­pon­der­ance of issues related to the cus­tomer side (693 risk related ele­ments) to those regard­ing the provider side (34 risk related ele­ments), for this study we con­cen­trated our analy­sis on the for­mer.

After clas­si­fy­ing the issues, we aggre­gated them, by con­dens­ing issues pre­sent­ing sim­i­lar for­mu­la­tions. Spe­cial care was placed in the nam­ing of the con­densed issue, in order to remain faith­ful to the ideas under­ly­ing the orig­i­nal for­mu­la­tions and to min­i­mize phras­ing ambi­gu­ity. Besides the clas­si­fi­ca­tion of each risk ele­ment, we also char­ac­ter­ized them. For that end, we located each of the con­densed issues in the IS out­sourc­ing process, by ask­ing the fol­low­ing ques­tions in accor­dance to the con­struct cat­e­gory under exam­i­na­tion: “When is this unde­sir­able con­se­quence felt more strongly?”, “At what stages this neg­a­tive out­come may result?”, “At what stages this dan­ger can be expe­ri­enced more severely?”, “At what stages this fac­tor has its major impact?” and “When does this mit­i­ga­tion action take place?”. For the unde­sir­able con­se­quences we used the fol­low­ing scale: pre-con­tract (Pre), exe­cu­tion of the con­tract (Exec) and post-con­tract (Post). For the other four con­structs we resorted to Dib­bern et al. [2004] stage frame­work, locat­ing the risk ele­ments in the fol­low­ing IS out­sourc­ing stages: Deci­sion (D), Provider Selec­tion (PS), Rela­tion­ship Struc­tur­ing (RS), Rela­tion­ship Build­ing (RB), Rela­tion­ship Man­age­ment (RM) and Out­comes (O). The nature of the risk ele­ments was also con­sid­ered by iden­ti­fy­ing for each unde­sir­able con­se­quence the cor­re­spond­ing type of loss and for each neg­a­tive out­come, dan­ger, fac­tor and mit­i­ga­tion action their respec­tive foci, i.e., the tar­get object of the ele­ment. For each neg­a­tive out­come and fac­tor we also deter­mined their loci–for the neg­a­tive out­comes accord­ing to the empha­sis of the risk ele­ment, and for the fac­tors if they con­cerned the cus­tomer (Cust), the provider (Prov) or the trans­ac­tion (Tran) that takes place between those two par­ties.

From this clas­si­fi­ca­tion and char­ac­ter­i­za­tion process resulted an arti­fact in the form of a cat­a­log of IS out­sourc­ing risks from the cus­tomer point of view which is pre­sented in the next sec­tion.

4. Catalog of Information Systems Outsourcing Risks

The unde­sir­able con­se­quences for the IS out­sourc­ing cus­tomer con­densed from lit­er­a­ture are shown in Table 1. Of the 17 issues, the loss of crit­i­cal skills and com­pe­tences by the cus­tomer on the domain of the ser­vices out­sourced is the most ref­er­enced (14 authors), fol­lowed by unex­pected tran­si­tion costs of IS ser­vices and loss of con­trol over IS deci­sions. The type of loss most often cited is finan­cial, usu­ally express­ing sit­u­a­tions where the cus­tomer incurs addi­tional costs not expected or not antic­i­pated. The group of unde­sir­able con­se­quences con­cen­trates on the exe­cu­tion phase of the con­tract and on the post-con­tract phase.

Table 1: Cus­tomer-Side Unde­sir­able Con­se­quences

Table 2 groups the issues clas­si­fied as neg­a­tive out­comes. The most reported neg­a­tive out­come relates to the gen­eral nature of the pre­vi­ous dis­cussed finan­cial unde­sir­able con­se­quences, namely the fail­ure by the cus­tomer team respon­si­ble for the gov­er­nance of the trans­ac­tion to con­sider all the costs asso­ci­ated with the pro­vi­sion of IS out­sourc­ing ser­vices. Of all 44 issues, 59% were clas­si­fied in the Ser­vice cat­e­gory, with the out­comes regard­ing non­de­liv­ery or delayed deliv­ery of ser­vices, unsat­is­fac­tory qual­ity of ser­vices and secu­rity breaches in ser­vices con­cen­trat­ing the largest num­ber of ref­er­ences. The sec­ond most rep­re­sented cat­e­gory is Orga­ni­za­tional, which includes the sec­ond most cited neg­a­tive out­come, namely Provider lock-in. As it might be expected, the out­sourc­ing stage that by far brings together more aspects is Out­comes (38 in 44). The stages Deci­sion and Rela­tion­ship Build­ing have no issues, sug­gest­ing the need for more research on the adverse results that an orga­ni­za­tion may face dur­ing the cru­cial peri­ods of decid­ing on out­sourc­ing and lay­ing the foun­da­tions for a smooth rela­tion­ship with the provider.

Table 2: Cus­tomer-Side Neg­a­tive Out­comes

The con­struct with the sec­ond largest num­ber of issues is Dan­ger, with a total of 104, as depicted in Table 3. Although the range of issues is very broad, three foci stand out: Gov­er­nance (26 issues), Provider behav­ior (19 issues) and Con­tract (13 issues). This stresses the chal­lenges cus­tomers face in terms of direct­ing and man­ag­ing the trans­ac­tion, the poten­tial haz­ardous rela­tion­ship with a third party and the cen­tral role of the out­sourc­ing con­tract as the fun­da­men­tal instru­ment that struc­tures and ulti­mately arbi­trates the trans­ac­tion. Con­cern­ing the stages of the out­sourc­ing process we find a more bal­anced dis­tri­bu­tion, although jointly the rela­tional cat­e­gories gather the largest num­ber of ref­er­ences, indi­cat­ing that part of the neg­a­tive out­comes may be traced to rela­tional issues.

Table 3: Cus­tomer-Side Dan­gers

The fifty five fac­tors that have resulted from the inter­pre­ta­tion of the reviewed lit­er­a­ture on IS out­sourc­ing risks are pre­sented in Table 4. This is the con­struct cat­e­gory where the issues have dis­trib­uted more evenly over the six out­sourc­ing process stages. Two fac­tors–expe­ri­ence and exper­tise with IS out­sourc­ing–are present through­out the life­cy­cle of out­sourc­ing, with cus­tomer’s exper­tise being the most cited fac­tor. The major­ity of the fac­tors (30) have locus on the cus­tomer, fol­lowed by 20 fac­tors related to the trans­ac­tion and five fac­tors being attrib­utes of the provider. Con­cern­ing the issues with cus­tomer locus, the two major focus cat­e­gories are Gov­er­nance (14 fac­tors), com­pris­ing a set of issues that shapes the per­spec­tive cus­tomers hold on out­sourc­ing, fol­lowed by Capa­bil­ity (11 fac­tors), as mea­sures of the cus­tomer’s skills and com­pe­tences on IS out­sourc­ing.

Table 4: Cus­tomer-Side Fac­tors

The analy­sis of the col­lected works resulted in the con­sol­i­da­tion of 127 mit­i­ga­tion actions which are listed in Table 5. This is the con­struct with the largest pool of instances, although no sin­gle issue clearly stands out over the rest. Yet, the analy­sis by focus shows a strong inci­dence of the mit­i­ga­tion actions in gov­er­nance related prac­tices (Trans­ac­tion Con­trol and Pro­ject Man­age­ment), fol­lowed by the Rela­tion­ship and Capa­bil­ity cat­e­gories. As it might be expected, the stage Out­comes does not con­tain any issue, high­light­ing the rea­son­ing that mit­i­ga­tion actions must be timely imple­mented. A note of cau­tion regard­ing this list is that some of the actions advanced in lit­er­a­ture are actu­ally goals, instead of spe­cific means that may dimin­ish the sever­ity of neg­a­tive out­comes.

Table 5: Cus­tomer-Side Mit­i­ga­tion Actions

5. Conclusion

The search for a the­ory of IS out­sourc­ing risk is a long and dif­fi­cult endeavor. In this paper we attempted to begin attack­ing that chal­lenge by pro­pos­ing a con­cep­tual scheme com­pris­ing the main con­structs of the the­ory and by elab­o­rat­ing a cat­a­log of IS out­sourc­ing risks based on lit­er­a­ture. The move towards the gen­er­a­tion of that the­ory admits (and requests) many future works. At the con­clu­sion of this study we advance five avenues for research. One is to com­pose a cat­a­log of IS out­sourc­ing risks from the provider’s point of view. This would deal with the other party of the out­sourc­ing dyad and allow relat­ing the risk per­spec­tives of the two stake­hold­ers. A sec­ond sug­ges­tion is to com­ple­ment the con­structs dan­ger and neg­a­tive out­come with a risk pro­file. Rec­og­niz­ing the oper­a­tional dif­fi­culty of adopt­ing an approach that could take into account the con­tin­gen­cies of a spe­cific cus­tomer or provider, an alter­na­tive way to assist in risk pro­fil­ing might be to assess the pos­si­bil­ity of dan­gers and neg­a­tive out­comes by index­ing it to the fac­tors. A third pro­posal for future research is to con­duct a field study in order to assess the com­pre­hen­sive­ness of the cat­a­log. This could con­sist on a ret­ro­spec­tive study of a series of IS out­sourc­ing cases in the risk sphere. The fourth propo­si­tion involves equal­iz­ing the gran­u­lar­ity of the issues that instan­ti­ate each of the con­structs that make up the cat­a­log. A final sug­ges­tion derives from the com­ple­men­tary view of risk as oppor­tu­nity that can pro­duce gains. Adopt­ing this view, where IS out­sourc­ing ben­e­fits are con­ceived as (even­tu­ally pos­i­tive) risks, one could extend the the­ory to encom­pass the inter­play between IS out­sourc­ing dan­gers and oppor­tu­ni­ties.

Acknowledgments

This work is funded by FEDER funds through Pro­grama Opera­cional Fatores de Com­pet­i­tivi­dade—COM­PETE and National funds by FCT—Fun­dação para a Ciên­cia e Tec­nolo­gia under Pro­ject FCOMP-01-0124-FEDER-022674.

References

• Abdul­lah, L. M. and J. M. Verner (2012). Analy­sis and appli­ca­tion of an out­sourc­ing risk frame­work. Jour­nal of Sys­tems and Soft­ware 85, 1930–1952.

  Ack­er­mann, T., A. Miede, P. Bux­mann and R. Stein­metz (2001). Tax­on­omy of Tech­no­log­i­cal IT Out­sourc­ing Risks: Sup­port for Risk Iden­ti­fi­ca­tion and Quan­tifi­ca­tion. Pro­ceed­ings of the Nine­teenth Euro­pean Con­fer­ence on Infor­ma­tion Sys­tems.

  Apte, U. M., M. G. Sobol, S. Hanaoka, T. Shi­mada, T. Saari­nen, T. Salmeal and P. J. Vep­salainen (1997). IS out­sourc­ing prac­tices in the USA, Japan and Fin­land: a com­par­a­tive study. Jour­nal of Infor­ma­tion Tech­nol­ogy 12, 289–304.

  Aron, R., E. K. Clemons and S. Reddi (2005). Just Right Out­sourc­ing: Under­stand­ing and Man­ag­ing Risk. Jour­nal of Man­age­ment Infor­ma­tion Sys­tems 22, 37–55.

  Aubert, B. A., M. Patry and S. Rivard (1998). Assess­ing the risk of IT out­sourc­ing. CIRANO—Cen­tre interuni­ver­si­taire de recher­ché en analyse des organ­i­sa­tions. https://depot.eru­dit.org/bit­stream/000399dd/1/98s-16.pdf

  Bahli, B. and S. Rivard (2003). The infor­ma­tion tech­nol­ogy out­sourc­ing risk: a trans­ac­tion cost and agency the­ory-based per­spec­tive. Jour­nal of Infor­ma­tion Tech­nol­ogy 18, 211–221.

  Bahli, B. and S. Rivard (2005). Val­i­dat­ing mea­sures of infor­ma­tion tech­nol­ogy out­sourc­ing risk fac­tors. Omega 33, 175–187.

  Beulen, E., P. van Fen­ema and W. Cur­rie (2005). From Appli­ca­tion Out­sourc­ing to Infra­struc­ture Man­age­ment: Extend­ing the Off­shore Out­sourc­ing Ser­vice Port­fo­lio. Euro­pean Man­age­ment Jour­nal 23, 133–144.

  Chou, D. C. and A. Y. Chou (2009). Infor­ma­tion sys­tems out­sourc­ing life cycle and risks analy­sis. Com­puter Stan­dards & Inter­faces 31, 1036–1043.

  Cullen, S., P. B. Sed­don and L. P. Will­cocks (2005). IT out­sourc­ing con­fig­u­ra­tion: Research into defin­ing and design­ing out­sourc­ing arrange­ments. Jour­nal of Strate­gic Infor­ma­tion Sys­tems 14, 357–387.

  Cur­rie, W. L. (1998). Using mul­ti­ple sup­pli­ers to mit­i­gate the risk of IT out­sourc­ing at ICI and Wes­sex Water. Jour­nal of Infor­ma­tion Tech­nol­ogy 13, 169–180.

  Dhar, S. and B. Bal­akr­ish­nan (2006). Risks, Ben­e­fits, and Chal­lenges in Global IT Out­sourc­ing: Per­pec­tives and Prac­tices. Jour­nal of Global Infor­ma­tion Man­age­ment 14, 39–69.

  Dib­bern, J., T. Goles, R. Hirschheim and B. Jay­ati­laka (2004). Infor­ma­tion Sys­tems Out­sourc­ing: A Sur­vey and Analy­sis of the Lit­er­a­ture. The DATA BASE for Advances in Infor­ma­tion Sys­tems 35, 6–102.

  Doty, D. H. and W. H. Glick (1994). Typolo­gies as a Unique Form of The­ory Build­ing: Towards Improved Under­stand­ing and Mod­el­ing. Acad­emy of Man­age­ment Review 19, 230–251.

  Earl, M. J. (1996). The Risks of Out­sourc­ing IT. Sloan Man­age­ment Review 37, 26–32.

  Fan, Z. P., W. L. Suo and B. Feng (2012). Iden­ti­fy­ing risk fac­tors of IT out­sourc­ing using inter­de­pen­dent infor­ma­tion: An extended DEMA­TEL method. Expert Sys­tems with Appli­ca­tions 39, 3832–3840.

  Gandhi, S. J., A. Gorod and B. Sauser (2012). Pri­or­i­ti­za­tion of out­sourc­ing risks from a sys­temic per­spec­tive. Strate­gic Out­sourc­ing: An Inter­na­tional Jour­nal 5, 39–71.

  Gart­ner (2013). Press Release—Gart­ner Says World­wide IT Out­sourc­ing Mar­ket to Reach $288 Bil­lion in 2013. Gart­ner, July 17.

  Gart­ner (2014). Fore­cast Analy­sis: IT Out­sourc­ing, World­wide, 1Q14 Update. Gart­ner, April 14.

  Gon­za­lez R., J. Gasco and J. Llopis (2009).Infor­ma­tion sys­tems out­sourc­ing rea­sons and risks: an empir­i­cal study. Inter­na­tional Jour­nal of Human and Social Sci­ences 4, 181–192.

  Gon­za­lez, R., J. Gasco and J. Llopis (2005). Infor­ma­tion sys­tems out­sourc­ing risks: a study of large firms. Indus­trial Man­age­ment & Data Sys­tems 105, 45–62.

  Gre­gor, S. (2006). The Nature of The­ory in Infor­ma­tion Sys­tems. MIS Quar­terly 30, 611–642.

  ISO (2009). ISO 31000—Risk man­age­ment—Prin­ci­ples and guide­lines. Inter­na­tional Orga­ni­za­tion for Stan­dard­iza­tion.

  Iacovou, C. L. and R. Nakatsu (2008). A Risk Pro­file of Off­shore-Out­sourced Devel­op­ment Pro­jects. Com­mu­ni­ca­tions of the ACM 51, 89–94.

  Juri­son, J. (1995). The role of risk and return in infor­ma­tion tech­nol­ogy out­sourc­ing deci­sions. Jour­nal of Infor­ma­tion Tech­nol­ogy 10, 239–247.

  Ker­linger, F. R. (1986). Foun­da­tions of Behav­ioral Research, third edi­tion. Orlando: Har­court Brace Jovanovich Col­lege Pub­lish­ers.

  Kern, T. and L. P. Will­cocks (2001). The Rela­tion­ship Advan­tage: Infor­ma­tion Tech­nolo­gies, Sourc­ing, and Man­age­ment. Oxford: Oxford Uni­ver­sity Press.

  Kern, T., L. P. Will­cocks and M. C. Lac­ity (2002). Appli­ca­tion Ser­vice Pro­vi­sion: Risk Assess­ment and Mit­i­ga­tion. MIS Quar­terly Exec­u­tive 1, 113–126.

  Khidzir, N. Z., A. Mohamed and N. H. Arshad (2013). ICT Out­sourc­ing Infor­ma­tion Secu­rity Risk Fac­tors: An Exploratory Analy­sis of Threat Risks Fac­tor for Crit­i­cal Pro­ject Char­ac­ter­is­tics. Jour­nal of Indus­trial and Intel­li­gent Infor­ma­tion 1, 218–222.

  Knight, F. H. (1921). Risk, Uncer­tainty, and Profit. Hart, Boston: Houghton Mif­flin Com­pany.

  Lac­ity, M. C. and R. Hirschheim (1993). The Infor­ma­tion Sys­tems Out­sourc­ing Band­wagon. Sloan Man­age­ment Review 35, 73–86.

  Lac­ity, M. C., S. A. Khan and L. P. Will­cocks (2009). A review of the IT out­sourc­ing lit­er­a­ture: Insights for prac­tice. Jour­nal of Strate­gic Infor­ma­tion Sys­tem 18, 130–146.

  McIvor, R. (2008). What is the right out­sourc­ing strat­egy for your process? Euro­pean Man­age­ment Jour­nal 26, 24–34.

  Renn, O. (1992). Con­cepts of Risk: A Clas­si­fi­ca­tion. In Krim­sky, S. and S. Gold­ing (Eds.), Social The­o­ries of Risk, 53–79. West­port: Praeger.

  Sab­her­wal, R. (1999). The role of trust in out­sourced IS devel­op­ment projects. Com­mu­ni­ca­tions of the ACM 42, 80–86.

  Sak­thivel, S. (2007). Man­ag­ing Risk in Off­shore Sys­tems Devel­op­ment. Com­mu­ni­ca­tions of the ACM 50, 69–75.

  Slovic, P. (1999). Com­ment: Are triv­ial risks the great­est risks of all? Jour­nal of Risk Research 2, 281–288.

  Tafti, M. H. A. (2005). Risks fac­tors asso­ci­ated with off­shore IT out­sourc­ing. Indus­trial Man­age­ment & Data Sys­tems 105, 549–560.

  Vara­jão, J., C. Pereira, L. Ama­ral and S. Cas­tro (2011). Out­sourc­ing de serviços de sis­temas de infor­mação na banca em Por­tu­gal. Com­put­er­world.

  Vara­jão, J., R. Gonçalves, L. Bar­roso and L. Ama­ral (2006). Out­sourc­ing de serviços de sis­temas de infor­mação. Revista Diri­gir, 93.

  Vas­sil­iadis, B., A. Ste­fani, J. Tsak­nakis and A. Tsaka­lidis (2006). From appli­ca­tion ser­vice pro­vi­sion to ser­vice-ori­ented com­put­ing: a study of the IT out­sourc­ing evo­lu­tion. Telem­at­ics and Infor­mat­ics 23, 271–293.

  Whit­ten, D. and R. L. Wake­field (2006). Mea­sur­ing Switch­ing Costs in IT Out­sourc­ing Ser­vices. Jour­nal of Strate­gic Infor­ma­tion Sys­tems 15, 219–248.

  Will­cocks, L. P. and M. C. Lac­ity (1999). IT out­sourc­ing in insur­ance ser­vices: risk, cre­ative con­tract­ing and busi­ness advan­tage. Infor­ma­tion Sys­tems Jour­nal 9, 163–180.

  Will­cocks, L. P., M. C. Lac­ity and T. Kern (1999). Risk mit­i­ga­tion in IT out­sourc­ing strat­egy revis­ited: lon­gi­tu­di­nal case research at LISA. Jour­nal of Strate­gic Infor­ma­tion Sys­tems 8, 285–314.