Principles and Practices for Orchestrating Digital Value Chains

In the first part of this post I stated that the continuous drive to reduce IT cost by standardization will come to a point where the reduced IT cost are outstripped by the ‘damage’ it causes to the business. The drive for standardisation is further increased by the commonly used method to scope outsourcing contracts. In this post I provide an scoping approach which I believe will gain substantially in the coming years: selective sourcing contracts with a scope derived from differentiated business demands. The importance of accountability towards the Business regarding the quantitative and qualitative added value of IT will only increase more and more. The Business demands to know how IT supports the opportunities and risks the Business faces due to increasing complexity, competition, globalization and other trends. It is up to the Business to provide insight in the opportunities and risks it faces, while the IT organization is responsible to translate them into IT value and ris...

This post is a follow up on this post in which I describe the rough outlines of an approach to reduce the expenses one has to include in the business case related to ensuring regulatory compliance. This post is not meant for the average company which has to worry about SOX and standard privacy laws. This post is based on my experiences of working for a large international bank which did a lot of outsourcing, but did not know well how to translate the large amount of national and international laws and regulations into a manageable and cost effective control and monitor framework. What does regulatory compliance cost? A study of the Work Bank in 2005 shows that in the Netherlands, the United Kingdom, Belgium, Sweden and Norway on average 8 to 11% van the total expenditures by the government goes towards regulation of the business. Figures from the United States over 2004 indicate that there a total of 14.9% of the Gross National Income is spent on laws and regulation (11.2% on national...

Not all risks related to outsourcing can be mitigated in the same manner. Some risks and its mitigation are fully retained within the client company while others can only be mitigated with the cooperation of the external vendor. SAS70 , due diligence and audit rights are the most commonly used assurance mechanisms, but are: limited in their use (e.g. SAS70 focuses on controls for IT systems which function can have a material effect on financial statements and is thus of limited use to mitigate other types of risks). expensive (e.g. both auditing by the companies own auditors or SAS70 statements requires the vendor (and third party auditor) to invest a lot of hours in collecting and presenting evidence. The bill for an SAS70 type II can easily end up in the area of $100-200k. showing a snapshot of the situation (e.g. due diligence is typically a one-off exercise which is performed typically as part of the selection or contracting phase, same applies for a SAS70 type I report). In order ...