Orig­i­nal source pub­li­ca­tion: de Sá-Soares, F., D. Soares and J. Arnaud (2014). A Cat­a­log of Infor­ma­tion Sys­tems Out­sourc­ing Risks. Inter­na­tional Jour­nal of Infor­ma­tion Sys­tems and Pro­ject Man­age­ment 2(3), 23–43.
The final pub­li­ca­tion is avail­able here.

A Cat­a­log of Infor­ma­tion Sys­tems Out­sourc­ing Risks

Fil­ipe de Sá-Soares, Del­fina Soares and José Arnaud

Depar­ta­ment of Infor­ma­tion Sys­tems and Cen­ter ALGO­RITMI, Uni­ver­sity of Minho, Guimarães, Por­tu­gal

1. Introduction

The sur­viv­abil­ity and pros­per­ity of any orga­ni­za­tion depends cru­cially on its capa­bil­ity to per­form a set of activ­i­ties that result in the deliv­ery of a valu­able prod­uct or ser­vice for the mar­ket. In order to enhance their value chain, orga­ni­za­tions use var­i­ous tech­no­log­i­cal and man­age­r­ial solu­tions to sup­port their busi­ness processes. These solu­tions may be devel­oped inter­nally or pro­cured exter­nally to the orga­ni­za­tion, con­fig­ur­ing the two main ways to obtain any type of resources—insourc­ing and out­sourc­ing. Con­fronted with fierce com­pe­ti­tion in the con­text of global eco­nomic and finan­cial crises, com­pa­nies strive for greater effi­ciency and reduced costs, while at the same time try to increase their spe­cial­iza­tion in a lim­ited num­ber of key areas. This state of affairs may tip orga­ni­za­tions to the out­sourc­ing side of the sourc­ing bino­mial, trans­form­ing the out­sourc­ing option in a crit­i­cal strate­gic deci­sion [McIvor 2008].

In the realm of infor­ma­tion sys­tems (IS), out­sourc­ing involves mak­ing arrange­ments with an exter­nal party for the par­tial or total pro­vi­sion of the man­age­ment and oper­a­tion of an orga­ni­za­tion’s infor­ma­tion tech­nol­ogy (IT) assets or activ­i­ties [Kern and Will­cocks 2001]. These arrange­ments take the form of con­tracts that state the agree­ment between two enti­ties: the cus­tomer of the out­sourc­ing ser­vices and the provider (or providers) of those ser­vices.

The rel­e­vance of IS out­sourc­ing is evi­denced by Gart­ner’s fore­casts of a world­wide mar­ket reach­ing $288 bil­lion in 2013 [Gart­ner 2013] and of a growth rate of 5.2% in 2014 [Gart­ner 2014]. It may also be appre­ci­ated by con­sid­er­ing the accu­mu­lated knowl­edge pro­duced on the area (cf. [Dib­bern et al. 2004] and [Lac­ity et al. 2009]).

Prior to embark upon an IS out­sourc­ing project, an orga­ni­za­tion should pon­der the expected costs and ben­e­fits of the out­sourc­ing option. If the orga­ni­za­tion decides to pro­ceed with the out­sourc­ing, the con­sid­er­a­tion of the cost-ben­e­fit rela­tion­ship should per­sist, in order to take into account the ben­e­fits really achieved and the costs incurred. Sim­i­larly, an out­sourc­ing provider needs to con­sider the costs and ben­e­fits of start­ing an out­sourc­ing trans­ac­tion with a poten­tial cus­tomer, as well as to track the evo­lu­tion of the costs and ben­e­fits of an ongo­ing out­sourc­ing con­tract. Asso­ci­ated with ben­e­fits and costs of an out­sourc­ing deal there is a set of risks. These risks need to be man­aged if the trans­ac­tion between an out­sourc­ing cus­tomer and one or more out­sourc­ing providers is to be suc­cess­ful.

Var­i­ous stud­ies have been con­ducted on IS out­sourc­ing risks, address­ing issues such as sources of risks, pro­fil­ing and pri­or­i­ti­za­tion of risks, and actions to reduce the impact of risks. To some extent, that col­lec­tion of works forms a frag­mented, although extremely valu­able, set of con­tri­bu­tions. This inter­pre­ta­tion moti­vated us to seek an inte­grated view of IS out­sourc­ing risks. In fact, some authors have already made efforts to that end, such as Bahli and Rivard [Bahli and Rivard 2003] who extended the risk assess­ment frame­work used in engi­neer­ing to ana­lyze IS out­sourc­ing risks, sug­gest­ing the need to com­bine risk sce­nar­ios, risk fac­tors, con­se­quences and mit­i­ga­tion mech­a­nisms. This paper builds upon that col­lec­tion of stud­ies and inte­gra­tive efforts. Our goal is to con­trib­ute towards the syn­the­sis of a the­ory of IS out­sourc­ing risk by com­pil­ing a cat­a­log of IS out­sourc­ing risks. We believe that a the­ory of IS out­sourc­ing risk may prove par­tic­u­larly use­ful to prac­ti­tion­ers ana­lyz­ing the fea­si­bil­ity of an IS out­sourc­ing project or steer­ing ongo­ing IS out­sourc­ing trans­ac­tions and to researchers deep­en­ing our under­stand­ing of the IS out­sourc­ing risk man­age­ment process.

The paper is struc­tured as fol­lows. After this intro­duc­tion, a con­cep­tual frame­work for inter­pret­ing the lit­er­a­ture on IS out­sourc­ing risks is pro­posed, fol­lowed by the descrip­tion of the work under­took. Next, the cat­a­log of IS out­sourc­ing risks derived from the clas­si­fi­ca­tion of the lit­er­a­ture is pre­sented and dis­cussed. Finally, con­clu­sions are drawn, lim­i­ta­tions of the study are acknowl­edged and future work is sug­gested.

2. Conceptual Framework

The aim of this study is to make a con­tri­bu­tion in the domain of IS out­sourc­ing that may assist in the near future in the cre­ation of a the­ory of IS out­sourc­ing risk. As for­mu­lated, this ulti­mate objec­tive builds on three main con­cepts: IS out­sourc­ing, the­ory and risk. As a first step towards that research goal, we will briefly dis­cuss each of these three con­cepts in order to develop a con­cep­tual frame­work on which to base the gen­er­a­tion of such the­ory.

Infor­ma­tion sys­tems out­sourc­ing is not a new phe­nom­e­non. Since its emer­gence in the 1960s, it has under­gone sev­eral changes: from an empha­sis on time-shar­ing ser­vices, it evolved to the appli­ca­tion ser­vice pro­vi­sion (ASP) model in the late 90s, and then to ser­vice-ori­ented com­put­ing (SOC) and on-demand/util­ity com­put­ing in the begin­ning of this cen­tury [Vas­sil­iadis et al. 2006]. Also, from a geo­graph­i­cal point of view, it has diver­si­fied from domes­tic pro­vi­sion of ser­vices by third par­ties to off­shore out­sourc­ing, where the respon­si­bil­ity for man­age­ment and deliv­ery of IT ser­vices is located in a dif­fer­ent coun­try from that of the cus­tomer [Sab­her­wal 1999].

Whether the pur­pose for out­sourc­ing is the exter­nal­iza­tion of IT infra­struc­ture, appli­ca­tion devel­op­ment, or IS man­age­ment respon­si­bil­i­ties, just to name a few, it is pos­si­ble to con­ceive IS out­sourc­ing as a process com­posed of two main phases: the deci­sion process and the imple­men­ta­tion [Dib­bern et al. 2004]. The deci­sion process phase encom­passes three stages, in which orga­ni­za­tions weight up the advan­tages and dis­ad­van­tages of IS out­sourc­ing, address alter­na­tive out­sourc­ing arrange­ments and finally make the deci­sion after com­par­ing the var­i­ous out­sourc­ing options. The imple­men­ta­tion phase is orga­nized by Dib­bern et al. [2004] in two stages: how and out­come. The ‘how’ stage includes the selec­tion of the provider and the cus­tomer-provider rela­tion­ship related activ­i­ties, namely rela­tion­ship struc­tur­ing (con­trac­tual process), rela­tion­ship build­ing (strength­en­ing the rela­tion­ship between cus­tomer and provider) and rela­tion­ship man­age­ment (dri­ving the rela­tion­ship in the right direc­tion). The ‘out­come’ stage reflects the con­se­quences of the out­sourc­ing choice that was made, the degree of suc­cess of the arrange­ment and lessons from the out­sourc­ing. It should be noticed that under­ly­ing this orga­ni­za­tion of the out­sourc­ing process is a cus­tomer cen­tric view, espe­cially in what con­cerns the deci­sion process phase. Although part of the stages may be eas­ily applic­a­ble from the per­spec­tive of the out­sourc­ing providers, these agents have to con­ceive the pre­lim­i­nary phases to the con­trac­tual process from an offer point of view, in the sense of respond­ing to a mar­ket demand orig­i­nat­ing from poten­tial cus­tomers.

The lit­er­a­ture on IS out­sourc­ing is sig­nif­i­cant and diverse. Lac­ity et al. [2009] clas­si­fied 191 papers on IS out­sourc­ing pub­lished between 1990 and 2008 into six top­ics rel­e­vant to prac­tice. The set of top­ics and the asso­ci­ated ques­tions
addressed by researchers are the fol­low­ing:

• Deter­mi­nants of IS out­sourc­ing—Which types of firms are more likely to out­source IS?

• IS out­sourc­ing strat­egy—What is the strate­gic intent behind IS out­sourc­ing deci­sions? What are the strate­gic effects of IS out­sourc­ing deci­sions?

• IS out­sourc­ing risks—What are the risks of IS out­sourc­ing? How are IS out­sourc­ing risks mit­i­gated?

• Deter­mi­nants of IS out­sourc­ing suc­cess—Which prac­tices increase the like­li­hood that a cus­tomer’s out­sourc­ing deci­sion will be suc­cess­ful?

• Cus­tomer and provider capa­bil­i­ties—Which capa­bil­i­ties do cus­tomer firms need to develop to suc­cess­fully engage IS out­sourc­ing providers? Which capa­bil­i­ties do cus­tomer firms seek in an IS out­sourc­ing provider?

• Sourc­ing vari­etals—How do prac­tices dif­fer when pur­su­ing dif­fer­ent types of out­sourc­ing such as off­shore out­sourc­ing, appli­ca­tion ser­vice pro­vi­sion, and busi­ness process out­sourc­ing?

From that review of IS out­sourc­ing lit­er­a­ture, it was pos­si­ble to con­clude that the most researched top­ics have been the deter­mi­nants of IS out­sourc­ing suc­cess and the deter­mi­nants of IS out­sourc­ing, fol­lowed by cus­tomer and provider capa­bil­i­ties. In what con­cerns IS out­sourc­ing risks, those authors note that the cor­re­spond­ing body of lit­er­a­ture encom­passes a “quite intim­i­dat­ing” num­ber of risks. To a cer­tain extent this rein­forces the need to revisit the accu­mu­lated knowl­edge on IS out­sourc­ing risks, with the aim of pro­vid­ing an inte­gra­tive inter­pre­ta­tion for that rich­ness of con­tri­bu­tions.

The sec­ond fun­da­men­tal con­cept we review is the­ory. A the­ory is a set of defined and inter­re­lated con­structs that presents a sys­tem­atic view of phe­nom­ena [Ker­linger 1986]. In order to be con­sid­ered a the­ory, a con­cep­tual arti­fact must iden­tify the con­structs that com­pose it, spec­ify the rela­tion­ships among these con­structs, and be for­mu­lated so that these rela­tion­ships are able to be tested, i.e., are fal­si­fi­able [Doty and Glick 1994].

The impor­tance of the­ory may be appre­ci­ated by con­sid­er­ing its pri­mary goals: analy­sis and descrip­tion (descrip­tion of the phe­nom­e­non of inter­est and analy­sis of the rela­tion­ships among con­structs), expla­na­tion (how, why, and when things hap­pen), pre­dic­tion (what will hap­pen if cer­tain pre­con­di­tions hold) and pre­scrip­tion (pro­vi­sion of a recipe to the con­struc­tion of an arti­fact) [Gre­gor 2006]. In this study we are inter­ested in the IS out­sourc­ing phe­nom­e­non from the per­spec­tive of risk, our third fun­da­men­tal con­cept to dis­cuss.

Risk is a word with mul­ti­ple mean­ings. Rec­og­niz­ing the inco­her­ent use of the con­cept, Slovic [1999] iden­ti­fied four main con­cep­tions for risk: a dan­ger­ous activ­ity (“Where is in the list the risk of fly­ing by plane?”); a prob­a­bil­ity (“What is the annual risk of death at eighty?”); a con­se­quence (“What is the risk of let­ting the park­ing meter expire? Answer: be fined!”); and a dan­ger or threat asso­ci­ated to an activ­ity or tech­nol­ogy (“How big is the risk of smok­ing cig­ars?”). In the lit­er­a­ture it is pos­si­ble to find these dif­fer­ent con­cep­tions of risk. Aubert et al. [1998] argue that risk encom­passes the mean­ing of neg­a­tive out­come, such as short­falls in sys­tems per­for­mance, dis­rup­tion of ser­vice to cus­tomer, and loss in inno­v­a­tive capac­ity, and the mean­ing of fac­tors lead­ing to neg­a­tive out­comes, such as a con­tin­u­ing stream of require­ment changes or per­son­nel short­falls, lack of upper man­age­ment com­mit­ment, and busi­ness uncer­tainty. Sim­i­larly, in ISO 31000 stan­dard is observed that risk is often char­ac­ter­ized by ref­er­ence to poten­tial events, con­se­quences, or a com­bi­na­tion of these, being often expressed in terms of a com­bi­na­tion of the con­se­quences of an event and the asso­ci­ated like­li­hood of occur­rence [ISO 2009]. Will­cocks and Lac­ity [1999] view risk as a neg­a­tive out­come that has a known or esti­mated prob­a­bil­ity of occur­rence. Bahli and Rivard [2003] per­ceive risk as a dan­ger or haz­ard. Lac­ity et al. [2009] define risk as the prob­a­bil­ity of an action adversely affect­ing an orga­ni­za­tion.

Despite the diver­sity of mean­ings of the term risk, Renn [1992] iso­lated a com­mon ele­ment among all def­i­n­i­tions, namely the dis­tinc­tion between real­ity and pos­si­bil­ity. Under this assump­tion, that author defined risk as the pos­si­bil­ity that human actions or events lead to con­se­quences that have an impact on what peo­ple value [Renn 1992]. In a sim­i­lar vein, the stan­dard ISO 31000 defines risk as the effect (pos­i­tive and/or neg­a­tive) of uncer­tainty on objec­tives [ISO 2009]. At this point a dis­tinc­tion between risk and uncer­tainty is needed. As soon as 1921, Knight con­trasted between the con­cepts of uncer­tainty and risk, not­ing that the for­mer is present when the like­li­hood of future events is indef­i­nite or incal­cu­la­ble, while the lat­ter is present when future events occur with mea­sur­able prob­a­bil­ity [Knight 1921]. This dis­tinc­tion con­trib­utes to cor­rectly place the role of like­li­hood (prob­a­bil­ity) in risk related con­structs. A final impor­tant deriva­tion from the con­cep­tion of risk by Renn [1992] is that risks may be con­ceived as men­tal rep­re­sen­ta­tions of threats capa­ble of caus­ing losses or as oppor­tu­ni­ties that can pro­duce gains. This last alter­na­tive view of the con­cept of risk is in sharp con­trast with the com­mon view that asso­ciates risk to haz­ard. In this study we adopted the for­mer view of risk, focus­ing our atten­tion on the pos­si­bil­ity of some unfa­vor­able event or out­come occur in the realm of IS out­sourc­ing. Nev­er­the­less, we will address the use­ful­ness of the alter­na­tive view of risk for the man­age­ment of IS out­sourc­ing in the con­clu­sion sec­tion of this paper.

Given the aim of this study, the review of lit­er­a­ture on the con­cepts of the­ory and risk prompted us to develop a con­cep­tual frame­work that could pro­vide a basis for con­struct­ing a the­ory of IS out­sourc­ing risk, by shap­ing and orga­niz­ing our inter­pre­ta­tion of the find­ings in IS out­sourc­ing lit­er­a­ture. To this end, we pro­pose the con­cep­tual frame­work illus­trated in Fig­ure 1.

Fig­ure 1: Con­cep­tual Frame­work

A dan­ger is a poten­tial cause of a neg­a­tive out­come; it is not, by itself, a real­ized dam­age. A neg­a­tive out­come is an adverse result from which derives an unde­sir­able con­se­quence. An unde­sir­able con­se­quence con­fig­ures an explicit loss to the entity (in this case the orga­ni­za­tion), in terms of tan­gi­ble or intan­gi­ble assets or oppor­tu­ni­ties to reap future ben­e­fits. Both dan­gers and neg­a­tive out­comes are pos­si­bil­i­ties that may cul­mi­nate in unde­sir­able con­se­quences. A neg­a­tive out­come and the orig­i­nat­ing dan­ger are of inter­est to an orga­ni­za­tion due to the unde­sir­able con­se­quences that may entail for the orga­ni­za­tion. Asso­ci­ated with a dan­ger and a neg­a­tive out­come there is a like­li­hood of occur­rence. Dif­fer­ent dan­gers and neg­a­tive out­comes may present dis­tinct lev­els of sever­ity. In con­trast, a fac­tor is an attribute of some entity or sit­u­a­tion that increases the expo­sure of the orga­ni­za­tion to a dan­ger. Con­trary to dan­gers and neg­a­tive out­comes, at a given time a fac­tor has a well deter­mined non-prob­a­bilis­tic value. Finally, a mit­i­ga­tion action con­sists in an act, usu­ally per­formed by the entity that may suf­fer the unde­sir­able con­se­quence, expected to lessen the inten­sity of a neg­a­tive out­come, even­tu­ally nul­li­fy­ing it.

3. Study Description

Hav­ing defined the con­cep­tual frame­work, we pro­ceeded to review lit­er­a­ture that explic­itly addressed IS out­sourc­ing risks. In order to pur­sue the goal of gen­er­at­ing a the­ory of IS out­sourc­ing risk, it is essen­tial to take into account the wealth of stud­ies con­ducted in the area. Our pur­pose was to inter­pret the find­ings in the lit­er­a­ture in light of the pro­posed con­cep­tual frame­work. We began by doing a lit­er­a­ture search in the main sci­en­tific index­ing plat­forms and repos­i­to­ries, such as ISI Web of Knowl­edge, SCO­PUS, Google Scholar, b-on, and AIS Elec­tronic Library. The search cri­te­ria involved look­ing for expres­sions “IS out­sourc­ing”, “IT out­sourc­ing” and “risk” in the title or abstract of papers. The results were screened for rel­e­vance, yield­ing a list of 34 papers. The next step was to char­ac­ter­ize the IS out­sourc­ing risks dis­cussed in those stud­ies. For that mat­ter, we built a repos­i­tory of IS out­sourc­ing risk related ele­ments. These ele­ments were diverse in nature and in des­ig­na­tion. Among the risk ele­ments we found denom­i­na­tions such as risk fac­tors, risks, con­se­quences, adverse events, risk mit­i­ga­tion mech­a­nisms, risk man­age­ment strate­gies, risk man­age­ment prac­tices, and risk pro­files. From this rec­ol­lec­tion exer­cise we got 727 risk related ele­ments (cor­re­spond­ing to an aver­age of 22 risk ele­ments per paper, with a min­i­mum of 1 ele­ment and a max­i­mum of 131 ele­ments). To make sense of this set of issues we clas­si­fied them accord­ing to the con­structs found on our con­cep­tual frame­work. In addi­tion, we also clas­si­fied each issue accord­ing to the party involved, namely IS out­sourc­ing cus­tomer or IS out­sourc­ing provider.

After clas­si­fy­ing the issues, we aggre­gated them, by con­dens­ing issues pre­sent­ing sim­i­lar for­mu­la­tions. Spe­cial care was placed in the nam­ing of the con­densed issues, in order to remain faith­ful to the ideas under­ly­ing the orig­i­nal for­mu­la­tions and to min­i­mize phras­ing ambi­gu­ity. Besides the clas­si­fi­ca­tion of each risk ele­ment, we also char­ac­ter­ized them. For that end, we located each of the con­densed issues in the IS out­sourc­ing process, by ask­ing the fol­low­ing ques­tions in accor­dance to the con­struct cat­e­gory under exam­i­na­tion: “When is this unde­sir­able con­se­quence felt more strongly?”, “At what stages this neg­a­tive out­come may result?”, “At what stages this dan­ger can be expe­ri­enced more severely?”, “At what stages this fac­tor has its major impact?” and “When does this mit­i­ga­tion action take place?”. For the unde­sir­able con­se­quences we used the fol­low­ing scale: pre-con­tract (Pre), exe­cu­tion of the con­tract (Exec) and post­con­tract (Post). For the other four con­structs we resorted to Dib­bern et al. [2004] stage frame­work, locat­ing the risk ele­ments in the fol­low­ing IS out­sourc­ing stages: Deci­sion (D); Provider Selec­tion (PS); Rela­tion­ship Struc­tur­ing (RS); Rela­tion­ship Build­ing (RB); Rela­tion­ship Man­age­ment (RM); and Out­comes (O). As pre­vi­ously noted, this stage orga­ni­za­tion of the IS out­sourc­ing process has a fun­da­men­tal cus­tomer cen­tric nature. For that mat­ter, and for those risk ele­ments related to providers, we adapted it, dis­card­ing the first stage (Deci­sion) and main­tain­ing the other five, but with a slight mod­i­fi­ca­tion of the mean­ing of stage Provider Selec­tion. Instead of reflect­ing the issues regard­ing the selec­tion of an IS out­sourc­ing provider by a cus­tomer, it has come to mean the issues regard­ing the attrac­tive­ness of a provider him­self for being selected by a poten­tial cus­tomer.

The nature of the risk ele­ments was also con­sid­ered by iden­ti­fy­ing for each unde­sir­able con­se­quence the cor­re­spond­ing type of loss and for each neg­a­tive out­come, dan­ger, fac­tor and mit­i­ga­tion action their respec­tive foci, i.e., the tar­get object of the ele­ment. For each neg­a­tive out­come and fac­tor we also deter­mined their loci—for the neg­a­tive out­comes accord­ing to the empha­sis of the risk ele­ment, and for the fac­tors if they con­cerned the cus­tomer (Cust), the provider (Prov) or the trans­ac­tion (Tran) that takes place between those two par­ties. The iden­ti­fi­ca­tion of the foci and the deter­mi­na­tion of the loci was an induc­tive process, a la grounded the­ory, where cat­e­gories were formed based on the con­cepts cov­ered in each of the risk ele­ments. From this clas­si­fi­ca­tion and char­ac­ter­i­za­tion process resulted an arti­fact in the form of a cat­a­log of IS out­sourc­ing risks which is pre­sented in the next sec­tion. The cat­a­log is orga­nized in two parts, accord­ingly to the per­spec­tive of the out­sourc­ing cus­tomer and from the per­spec­tive of the out­sourc­ing provider. For each party, the risk ele­ments com­pos­ing the con­cep­tual frame­work—unde­sir­able con­se­quences, neg­a­tive out­comes, dan­gers, fac­tors, and mit­i­ga­tion actions—are listed and dis­cussed.

4. Catalog of Information Systems Outsourcing Risks

4.1 Customer Side View

The unde­sir­able con­se­quences for the IS out­sourc­ing cus­tomer con­densed from lit­er­a­ture are shown in Table 1. Of the 17 issues, the loss of crit­i­cal skills and com­pe­tences by the cus­tomer on the domain of the ser­vices out­sourced is the most ref­er­enced (14 authors), fol­lowed by unex­pected tran­si­tion costs of IS ser­vices and loss of con­trol over IS deci­sions. The type of loss most often cited is finan­cial, usu­ally express­ing sit­u­a­tions where the cus­tomer incurs addi­tional costs not expected or not antic­i­pated. The group of unde­sir­able con­se­quences con­cen­trates on the exe­cu­tion phase of the con­tract and on the post-con­tract phase. This set of issues sug­gests that prac­ti­tion­ers may find use­ful to con­sider the over­all risk of an out­sourc­ing trans­ac­tion accord­ing to six types of poten­tial losses, namely in terms of capa­bil­ity and inter­nal con­trol, image and morale, and strat­egy and finance.

Table 1: Cus­tomer-side Unde­sir­able Con­se­quences

Table 2 groups the issues clas­si­fied as neg­a­tive out­comes. The most reported neg­a­tive out­come relates to the gen­eral nature of the pre­vi­ous dis­cussed finan­cial unde­sir­able con­se­quences, namely the fail­ure by the cus­tomer team respon­si­ble for the gov­er­nance of the trans­ac­tion to con­sider all the costs asso­ci­ated with the pro­vi­sion of IS out­sourc­ing ser­vices. Of all 44 issues, 59% were clas­si­fied in the Ser­vice cat­e­gory, with the out­comes regard­ing non-deliv­ery or delayed deliv­ery of ser­vices, unsat­is­fac­tory qual­ity of ser­vices and secu­rity breaches in ser­vices con­cen­trat­ing the largest num­ber of ref­er­ences. The sec­ond most rep­re­sented cat­e­gory is Orga­ni­za­tional, which includes the sec­ond most cited neg­a­tive out­come, namely Provider lock-in. As it might be expected, the out­sourc­ing stage that by far brings together more aspects is Out­comes (38 in 44). The stages Deci­sion and Rela­tion­ship Build­ing have no issues, sug­gest­ing the need for more research on the adverse results that an orga­ni­za­tion may face dur­ing the cru­cial peri­ods of decid­ing on out­sourc­ing and lay­ing the foun­da­tions for a smooth rela­tion­ship with the provider.

Table 2: Cus­tomer-side Neg­a­tive Out­comes

The con­struct with the sec­ond largest num­ber of issues is Dan­ger, with a total of 104, as depicted in Table 3. Although the range of issues is very broad, three foci stand out: Gov­er­nance (26 issues), Provider behav­ior (19 issues) and Con­tract (13 issues). This stresses the chal­lenges cus­tomers face in terms of direct­ing and man­ag­ing the trans­ac­tion, the poten­tial haz­ardous rela­tion­ship with a third party and the cen­tral role of the out­sourc­ing con­tract as the fun­da­men­tal instru­ment that struc­tures and ulti­mately arbi­trates the trans­ac­tion. Con­cern­ing the stages of the out­sourc­ing process we find a more bal­anced dis­tri­bu­tion, although jointly the rela­tional cat­e­gories gather the largest num­ber of ref­er­ences, indi­cat­ing that part of the neg­a­tive out­comes may be traced to rela­tional issues.

A com­ple­men­tary analy­sis of the cus­tomer-side dan­gers is to sort the issues by stage of the IS out­sourc­ing process. Based on the risk ele­ments found in lit­er­a­ture, this reveals a dom­i­nance of gov­er­nance focus issues dur­ing the deci­sion, rela­tion­ship build­ing, and rela­tion­ship man­age­ment stages; a con­junc­tion of capa­bil­ity, gov­er­nance, and provider behav­ior issues dur­ing the provider selec­tion stage; the rel­e­vance of provider capa­bil­ity dur­ing rela­tion­ship struc­tur­ing; and the impact of provider behav­ior issues, closely fol­lowed by con­tract and gov­er­nance related issues on the out­comes of an IS out­sourc­ing process for the cus­tomer.

Table 3: Cus­tomer-side Dan­gers

The fifty five fac­tors that have resulted from the inter­pre­ta­tion of the reviewed lit­er­a­ture on IS out­sourc­ing risks are pre­sented in Table 4. This is the con­struct cat­e­gory where the issues have dis­trib­uted more evenly over the six out­sourc­ing process stages. Two fac­tors—expe­ri­ence and exper­tise with IS out­sourc­ing—are present through­out the life­cy­cle of out­sourc­ing, with cus­tomer’s exper­tise being the most cited fac­tor. The major­ity of the fac­tors (30) have locus on the cus­tomer, fol­lowed by 20 fac­tors related to the trans­ac­tion and five fac­tors being attrib­utes of the provider. Con­cern­ing the issues with cus­tomer locus, the two major focus cat­e­gories are Gov­er­nance (14 fac­tors), com­pris­ing a set of issues that shapes the per­spec­tive cus­tomers hold on out­sourc­ing, fol­lowed by Capa­bil­ity (11 fac­tors), as mea­sures of the cus­tomer’s skills and com­pe­tences on IS out­sourc­ing.

To a cer­tain extent, this list of fac­tors pro­vides a means for a cus­tomer to eval­u­ate its cur­rent stand with respect to the ful­fill­ment of the con­di­tions for enabling a suc­cess­ful IS out­sourc­ing trans­ac­tion. Indeed, by self-diag­nos­ing itself in the major­ity of the fac­tors, and by judg­ing provider related char­ac­ter­is­tics and out­sourc­ing trans­ac­tion fea­tures, the cus­tomer may get a bet­ter under­stand­ing of the present weak­nesses and be in a bet­ter posi­tion to decide if meets the con­di­tions to go ahead with the out­sourc­ing or if is able to improve cer­tain attrib­utes in order to com­pen­sate some imbal­ance both in terms of know-how or power in rela­tion to the provider.

Table 4: Cus­tomer-side Fac­tors

The analy­sis of the col­lected works resulted in the con­sol­i­da­tion of 127 mit­i­ga­tion actions which are listed in Table 5. This is the con­struct with the largest pool of instances, although no sin­gle issue clearly stands out over the rest. Yet, the analy­sis by focus shows a strong inci­dence of the mit­i­ga­tion actions in gov­er­nance related prac­tices (Trans­ac­tion Con­trol and Pro­ject Man­age­ment), fol­lowed by the Rela­tion­ship and Capa­bil­ity cat­e­gories. As it might be expected, the stage Out­comes does not con­tain any issue, high­light­ing the rea­son­ing that mit­i­ga­tion actions must be timely imple­mented.

A note of cau­tion regard­ing this list is that some of the actions advanced in lit­er­a­ture are actu­ally goals, instead of spe­cific means that may dimin­ish the sever­ity of neg­a­tive out­comes. This implies that some items clas­si­fied as risk mit­i­ga­tion actions would ben­e­fit from a con­cretiza­tion, by indi­cat­ing spe­cific actions that might con­trib­ute to the achieve­ment of the for­mu­lated goal. Indeed, for some of these items, it might be pos­si­ble to inter­pret them as inverse neg­a­tive out­comes.

Table 5. Cus­tomer-side Mit­i­ga­tion Actions

4.2 Provider Side View

The analy­sis of the col­lected lit­er­a­ture clearly showed an imbal­ance between the works that iden­tify IS out­sourc­ing risk ele­ments related to the cus­tomers and those related to providers. Indeed, of the 34 papers ana­lyzed, only four list risks from the per­spec­tive of the provider, and of those, only two are totally ded­i­cated to the risks of IS out­sourc­ing from the stand­point of providers. Actu­ally, of the 727 risk ele­ments that we found in the lit­er­a­ture, 693 con­sist of issues related to the cus­tomer, and only 34 regard the provider side (a pro­por­tion of 19:1). Con­se­quently, the rich­ness and diver­sity of the cat­a­log from the provider side is much lower when com­pared to the cus­tomer side. Although this might be under­stand­able, given the greater num­ber of poten­tial cus­tomers in the mar­ket in com­par­i­son to the num­ber of providers, we argue for the need to per­form fur­ther research on IS out­sourc­ing risks from the provider’s stand­point.

An illus­tra­tion of the above men­tioned sit­u­a­tion is that for providers we only cat­e­go­rized one risk ele­ment as an unde­sir­able con­se­quence and one risk ele­ment as a neg­a­tive out­come, both of which were found on Cullen et al. [2005]. The unde­sir­able con­se­quence was for­mu­lated as “No economies of scale from shar­ing assets with other cus­tomers”, it is located at the exe­cu­tion phase and it is a finan­cial type of loss. The neg­a­tive out­come was phrased as “Staff adopts cus­tomer’s cul­ture rather than provider’s cul­ture”, it is located at the Rela­tion­ship Build­ing stage, it has a locus on Per­son­nel and a focus on Cul­ture.

In what con­cerns dan­gers, the analy­sis resulted in 10 issues, listed on Table 6. Three of those issues have a focus on Capa­bil­ity, two on the Envi­ron­ment, and two on Gov­er­nance. With the excep­tion of two issues, the other dan­gers have an impact on the out­comes stage. None of the dan­gers were placed on the Provider Selec­tion or Rela­tion­ship Struc­tur­ing stages. The set of dan­gers are based on the works [Aun­dhe and Matthew 2009] and [Alexan­drova 2012], the two stud­ies that con­tem­plated the IS out­sourc­ing risk topic from the per­spec­tive of the provider.

Table 6: Provider-side Dan­gers

The provider-side fac­tors are in num­ber of 13 and show a more bal­anced dis­tri­bu­tion between the five stages of the IS out­sourc­ing process from the per­spec­tive of the provider, as can be observed in Table 7. Their locus is also well dis­trib­uted between Cus­tomer, Provider and Trans­ac­tion. In terms of focus we found Capa­bil­ity has the most rep­re­sented class.

Finally, regard­ing mit­i­ga­tion actions, we found just one work that explic­itly advanced mech­a­nisms for providers to reduce the impact of IS out­sourc­ing risks. The six issues, listed in Table 8, have all dif­fer­ent focus, and none has an impact on the stages of Rela­tion­ship Struc­tur­ing and Rela­tion­ship Build­ing. Although some of the risk mit­i­ga­tion actions may have an impact on more than one stage, all of them were clas­si­fied as enabling the reduc­tion of risk on the Out­comes stage of IS out­sourc­ing.

Table 7: Provider-side Fac­tors

Table 8: Provider-side Mit­i­ga­tion Actions

5. Conclusion

The search for a the­ory of IS out­sourc­ing risk is a long and dif­fi­cult endeavor. In this paper we attempted to begin attack­ing that chal­lenge by pro­pos­ing a con­cep­tual frame­work com­pris­ing the main con­structs of the the­ory and by elab­o­rat­ing a cat­a­log of IS out­sourc­ing risks based on lit­er­a­ture. This cat­a­log is struc­tured in two parts—the cus­tomer­side view and the provider-side view, which in turn are com­posed by five sets of clas­si­fied risk ele­ments, namely dan­gers, neg­a­tive out­comes, fac­tors, mit­i­ga­tion actions, and unde­sir­able con­se­quences.

For prac­ti­tion­ers this cat­a­log offers a sys­tem­atic review and clas­si­fi­ca­tion of the IS out­sourc­ing risks found on the lit­er­a­ture. This arti­fact may prove use­ful for those con­sid­er­ing out­sourc­ing the man­age­ment or oper­a­tion of theirs IT assets or activ­i­ties, those seek­ing to mar­ket their out­sourc­ing ser­vices, and those that already embarked in such a trans­ac­tion. By fore­see­ing impor­tant ele­ments influ­enc­ing the suc­cess of an out­sourc­ing process, the arti­fact may assist prac­ti­tion­ers per­form­ing the cor­re­spond­ing IS out­sourc­ing risk analy­sis, self-diag­nos­ing weak­nesses, draw­ing atten­tion to pos­si­ble future trou­bles, and help­ing to under­stand how cer­tain out­comes mate­ri­al­ized.

For researchers, we think that the cat­a­log can form a basis on which to build research efforts that may finally lead to the syn­the­sis of an IS out­sourc­ing risk the­ory. The cat­a­log was devel­oped accord­ing to a con­cep­tual frame­work that we believe cap­ture the main dis­tinc­tions of the risk con­cept. More­over, the cat­a­log holds on an exten­sive review of the exist­ing lit­er­a­ture that explic­itly addressed IS out­sourc­ing risks, not only list­ing, but also con­dens­ing and cat­e­go­riz­ing each of the risk ele­ments present in the lit­er­a­ture reviewed.

Nev­er­the­less, this work has sev­eral lim­i­ta­tions. One can­not con­sider the cat­a­log as exhaus­tive or com­plete. Prob­a­bly, it will never be a com­plete arti­fact—it is pos­si­ble that new risks emerge, new fac­tors have to come into play, and new mit­i­ga­tion actions have to be devised. Addi­tion­ally, dif­fer­ent types of IS out­sourc­ing may have asso­ci­ated spe­cific sub­sets of risks, a sit­u­a­tion that the pre­sented cat­a­log does not address, since it treats indis­tinctly out­sourc­ing vari­etals. A third lim­i­ta­tion is the sub­jec­tive inter­pre­ta­tion under­ly­ing the con­dens­ing and cat­e­go­riza­tion of each of the risk ele­ments found on the lit­er­a­ture. Although we tried to min­i­mize this lim­i­ta­tion by split­ting the analy­sis of risk ele­ments among the authors and by allo­cat­ing blocks of risk ele­ments to more than one of the authors in order to eval­u­ate and improve the reli­a­bil­ity of the analy­sis, there may still be room for dis­cor­dant inter­pre­ta­tions.

The move towards the gen­er­a­tion of an IS out­sourc­ing the­ory admits (and requests) many future works. At the con­clu­sion of this study we advance six avenues for research. One is to com­ple­ment the part of the cat­a­log related to the provider’s view­point. In pos­ses­sion of a more rich cat­e­go­riza­tion of the IS out­sourc­ing risks from the per­spec­tive of the providers, we would be able to relate the risk per­spec­tives of the two stake­hold­ers in an IS out­sourc­ing trans­ac­tion. A sec­ond sug­ges­tion is to com­ple­ment the con­structs dan­ger and neg­a­tive out­come with a risk pro­file. Rec­og­niz­ing the oper­a­tional dif­fi­culty of adopt­ing an approach that could take into account the con­tin­gen­cies of a spe­cific cus­tomer or provider, an alter­na­tive way to assist in risk pro­fil­ing might be to assess the pos­si­bil­ity of dan­gers and neg­a­tive out­comes by index­ing it to the fac­tors. A third pro­posal for future research is to con­duct a field study in order to assess the com­pre­hen­sive­ness of the cat­a­log. This could con­sist of a ret­ro­spec­tive study of a series of IS out­sourc­ing cases in the risk sphere. The fourth propo­si­tion involves equal­iz­ing the gran­u­lar­ity o f the issues that instan­ti­ate each of the con­structs that make up the cat­a­log. An addi­tional idea for future work derives from the com­ple­men­tary view of risk as oppor­tu­nity that can pro­duce gains. Adopt­ing this view, where IS out­sourc­ing ben­e­fits are con­ceived as (even­tu­ally pos­i­tive) risks, one could extend the the­ory to encom­pass the inter­play between IS out­sourc­ing dan­gers and oppor­tu­ni­ties. The final sug­ges­tion is to pur­sue in full extent the struc­ture of the con­cep­tual frame­work. Besides pro­pos­ing the fun­da­men­tal con­structs of inter­est in the realm of IS out­sourc­ing risks, the con­cep­tual frame­work estab­lishes a rela­tion­ship between the con­structs. The test and explo­ration of the rela­tion­ships between the items com­pos­ing the cat­a­log, namely between issues per­tain­ing to the con­struct fac­tor and to the con­struct dan­ger, dan­ger and neg­a­tive out­come, mit­i­ga­tion action and neg­a­tive out­come, and neg­a­tive out­come and unde­sir­able con­se­quence, would effec­tively con­sti­tute a net­work of con­nec­tions between the items, and sub­stan­ti­ate a the­ory of IS out­sourc­ing risk.

References

• Abdul­lah, L. M. and J. M. Verner (2012). Analy­sis and appli­ca­tion of an out­sourc­ing risk frame­work. Jour­nal of Sys­tems and Soft­ware 85(8), 1930–1952.

  Ack­er­mann, T., A. Miede, P. Bux­mann and R. Stein­metz (2001). Tax­on­omy of Tech­no­log­i­cal IT Out­sourc­ing Risks: Sup­port for Risk Iden­ti­fi­ca­tion and Quan­tifi­ca­tion. Pro­ceed­ings of the Nine­teenth Euro­pean Con­fer­ence on Infor­ma­tion Sys­tems. Paper 240.

  Alexan­drova, M. (2012). IT Out­sourc­ing Risks: Empir­i­cal Evi­dence from Bul­gar­ian Ser­vice Providers. Pro­ceed­ings of the Vir­tual Inter­na­tional Con­fer­ence on Advanced Research in Sci­en­tific Fields—ARSA 2012, 29–33.

  Apte, U. M., M. G. Sobol, S. Hanaoka, T. Shi­mada, T. Saari­nen, T. Salmeal and P. J. Vep­salainen (1997). IS out­sourc­ing prac­tices in the USA, Japan and Fin­land: a com­par­a­tive study. Jour­nal of Infor­ma­tion Tech­nol­ogy 12(4), 289–304.

  Aron, R., E. K. Clemons and S. Reddi (2005). Just Right Out­sourc­ing: Under­stand­ing and Man­ag­ing Risk. Jour­nal of Man­age­ment Infor­ma­tion Sys­tems 22(2), 37–55.

  Aubert, B. A., M. Patry and S. Rivard (1998). Assess­ing the risk of IT out­sourc­ing. CIRANO—Cen­tre interuni­ver­si­taire de recher­ché en analyse des organ­i­sa­tions. Avail­able: ttps://depot.eru­dit.org/bit­stream/000399dd/1/98s-16.pdf

  Aun­dhe, M. D. and S. K. Mathew (2009). Risks in off­shore IT out­sourc­ing: A ser­vice provider per­spec­tive. Euro­pean Man­age­ment Jour­nal 27(6), 418–428.

  Bahli, B. and S. Rivard (2003). The infor­ma­tion tech­nol­ogy out­sourc­ing risk: a trans­ac­tion cost and agency the­ory-based per­spec­tive. Jour­nal of Infor­ma­tion Tech­nol­ogy 18(3), 211–221.

  Bahli, B. and S. Rivard (2005). Val­i­dat­ing mea­sures of infor­ma­tion tech­nol­ogy out­sourc­ing risk fac­tors. Omega 33(2), 175–187.

  Beulen, E., P. van Fen­ema and W. Cur­rie (2005). From Appli­ca­tion Out­sourc­ing to Infra­struc­ture Man­age­ment: Extend­ing the Off­shore Out­sourc­ing Ser­vice Port­fo­lio. Euro­pean Man­age­ment Jour­nal 23(2), 133–144.

  Chou, D. C. and A. Y. Chou (2009). Infor­ma­tion sys­tems out­sourc­ing life cycle and risks analy­sis. Com­puter Stan­dards & Inter­faces 31(5), 1036–1043.

  Cullen, S., P. B. Sed­don and L. P. Will­cocks (2005). IT out­sourc­ing con­fig­u­ra­tion: Research into defin­ing and design­ing out­sourc­ing arrange­ments. Jour­nal of Strate­gic Infor­ma­tion Sys­tems 14(4), 357–387.

  Cur­rie, W. L. (1998). Using mul­ti­ple sup­pli­ers to mit­i­gate the risk of IT out­sourc­ing at ICI and Wes­sex Water. Jour­nal of Infor­ma­tion Tech­nol­ogy 13(3), 169–180.

  Dhar, S. and B. Bal­akr­ish­nan (2006). Risks, Ben­e­fits, and Chal­lenges in Global IT Out­sourc­ing: Per­pec­tives and Prac­tices. Jour­nal of Global Infor­ma­tion Man­age­ment 14(3), 39–69.

  Dib­bern, J., T. Goles, R. Hirschheim and B. Jay­ati­laka (2004). Infor­ma­tion Sys­tems Out­sourc­ing: A Sur­vey and Analy­sis of the Lit­er­a­ture. The DATA BASE for Advances in Infor­ma­tion Sys­tems 35(4), 6–102.

  Doty, D. H. and W. H. Glick (1994). Typolo­gies as a Unique Form of The­ory Build­ing: Towards Improved Under­stand­ing and Mod­el­ing. Acad­emy of Man­age­ment Review 19(2), 230–251.

  Earl, M. J. (1996). The Risks of Out­sourc­ing IT. Sloan Man­age­ment Review 37(3), 26–32.

  Fan, Z. P., W. L. Suo and B. Feng (2012). Iden­ti­fy­ing risk fac­tors of IT out­sourc­ing using inter­de­pen­dent infor­ma­tion: An extended DEMA­TEL method. Expert Sys­tems with Appli­ca­tions 39(3), 3832–3840.

  Gandhi, S. J., A. Gorod and B. Sauser (2012). Pri­or­i­ti­za­tion of out­sourc­ing risks from a sys­temic per­spec­tive. Strate­gic Out­sourc­ing: An Inter­na­tional Jour­nal 5(1), 39–71.

  Gart­ner (2013). Press Release—Gart­ner Says World­wide IT Out­sourc­ing Mar­ket to Reach $288 Bil­lion in 2013. Gart­ner, Inc. July 17.

  Gart­ner (2014). Fore­cast Analy­sis: IT Out­sourc­ing, World­wide, 1Q14 Update. Gart­ner, Inc. April 14.

  Gon­za­lez, R., J. Gasco and J. Llopis (2005). Infor­ma­tion sys­tems out­sourc­ing risks: a study of large firms. Indus­trial Man­age­ment & Data Sys­tems 105(1), 45–62.

  Gon­za­lez, R., J. Gasco and J. Llopis (2009). Infor­ma­tion sys­tems out­sourc­ing rea­sons and risks: an empir­i­cal study. Inter­na­tional Jour­nal of Human and Social Sci­ences 4(3), 181–192.

  Gre­gor, S. (2006). The Nature of The­ory in Infor­ma­tion Sys­tems. MIS Quar­terly 30(3), 611–642.

  ISO (2009). ISO 31000—Risk man­age­ment—Prin­ci­ples and guide­lines. Inter­na­tional Orga­ni­za­tion for Stan­dard­iza­tion.

  Iacovou, C. L. and R. Nakatsu (2008). A Risk Pro­file of Off­shore-Out­sourced Devel­op­ment Pro­jects. Com­mu­ni­ca­tions of the ACM 51(6), 89–94.

  Juri­son, J. (1995). The role of risk and return in infor­ma­tion tech­nol­ogy out­sourc­ing deci­sions. Jour­nal of Infor­ma­tion Tech­nol­ogy 10(4), 239–247.

  Ker­linger, F. R. (1986). Foun­da­tions of Behav­ioral Research, third edi­tion. Orlando, USA: Har­court Brace Jovanovich Col­lege Pub­lish­ers.

  Kern, T. and L. P. Will­cocks (2001). The Rela­tion­ship Advan­tage: Infor­ma­tion Tech­nolo­gies, Sourc­ing, and Man­age­ment. Oxford, UK: Oxford Uni­ver­sity Press.

  Kern, T., L. P. Will­cocks and M. C. Lac­ity (2002). Appli­ca­tion Ser­vice Pro­vi­sion: Risk Assess­ment and Mit­i­ga­tion. MIS Quar­terly Exec­u­tive 1(2), 113–126.

  Khidzir, N. Z., A. Mohamed and N. H. Arshad (2013). ICT Out­sourc­ing Infor­ma­tion Secu­rity Risk Fac­tors: An Exploratory Analy­sis of Threat Risks Fac­tor for Crit­i­cal Pro­ject Char­ac­ter­is­tics. Jour­nal of Indus­trial and Intel­li­gent Infor­ma­tion 1(4), 218–222.

  Knight, F. H. (1921). Risk, Uncer­tainty, and Profit. Boston, USA: Houghton Mif­flin Com­pany.

  Lac­ity, M. C. and R. Hirschheim (1993). The Infor­ma­tion Sys­tems Out­sourc­ing Band­wagon. Sloan Man­age­ment Review 35(1), 73–86.

  Lac­ity, M. C., S. A. Khan and L. P. Will­cocks (2009). A review of the IT out­sourc­ing lit­er­a­ture: Insights for prac­tice. Jour­nal of Strate­gic Infor­ma­tion Sys­tems 18(3), 130–146.

  McIvor, R. (2008). What is the right out­sourc­ing strat­egy for your process? Euro­pean Man­age­ment Jour­nal 26(1), 24–34.

  Renn, O. (1992). Con­cepts of Risk: A Clas­si­fi­ca­tion, In Krim­sky, S. and S. Gold­ing (Eds), Social The­o­ries of Risk. West­port, USA: Praeger, 53–79.

  Sab­her­wal, R. (1999). The role of trust in out­sourced IS devel­op­ment projects. Com­mu­ni­ca­tions of the ACM 42(2), 80–86.

  Sak­thivel, S. (2007). Man­ag­ing Risk in Off­shore Sys­tems Devel­op­ment. Com­mu­ni­ca­tions of the ACM 50(4), 69–75.

  Slovic, P. (1999). Com­ment: Are triv­ial risks the great­est risks of all? Jour­nal of Risk Research 2(4), 281–288.

  Tafti, M. H. A. (2005). Risks fac­tors asso­ci­ated with off­shore IT out­sourc­ing. Indus­trial Man­age­ment & Data Sys­tems 105(5), 549–560.

  Vara­jão, J., C. Pereira, L. Ama­ral and S. Cas­tro (2011). Out­sourc­ing de serviços de sis­temas de infor­mação na banca em Por­tu­gal. Com­put­er­world.

  Vara­jão, J., R. Gonçalves, L. Bar­roso and L. Ama­ral (2006). Out­sourc­ing de serviços de sis­temas de infor­mação. Revista Diri­gir—Sep­a­rata, 93.

  Vas­sil­iadis, B., A. Ste­fani, J. Tsak­nakis and A. Tsaka­lidis (2006). From appli­ca­tion ser­vice pro­vi­sion to ser­vice-ori­ented com­put­ing: a study of the IT out­sourc­ing evo­lu­tion. Telem­at­ics and Infor­mat­ics 23(4), 271–293.

  Whit­ten, D. and R. L. Wake­field (2006). Mea­sur­ing Switch­ing Costs in IT Out­sourc­ing Ser­vices. Jour­nal of Strate­gic Infor­ma­tion Sys­tems 15(3), 219–248.

  Will­cocks, L. P. and M. C. Lac­ity (1999). IT out­sourc­ing in insur­ance ser­vices: risk, cre­ative con­tract­ing and busi­ness advan­tage. Infor­ma­tion Sys­tems Jour­nal 9(3), 163–180.

  Will­cocks, L. P., M. C. Lac­ity and T. Kern (1999). Risk mit­i­ga­tion in IT out­sourc­ing strat­egy revis­ited: lon­gi­tu­di­nal case research at LISA. Jour­nal of Strate­gic Infor­ma­tion Sys­tems 8(3), 285–314.