Outsourcing governance: accountability stays in-house.

Why outsourcing arrangements go off the rails

The patterns repeat — whether a data centre, a core system or software development has been outsourced:

• Accountabilities are defined in the contract but not in daily practice: who decides when something does not fit?
• SLAs measure availability but not what matters to the business units.
• There is no escalation path that works before litigation.
• The retained organisation is too thin to challenge the provider on substance.
• The transition was planned as a project; the operation afterwards was not.

And in regulated industries there is one more thing: the supervisor holds the outsourcing company accountable — not the provider.

What I take on as interim manager for outsourcing

I lead the outsourcing relationship at management level — with a mandate towards the provider and a reporting line to the managing director:

• Build the retained organisation: the roles that must stay in-house for governance to work — service owner, architecture, contract management.
• Review contracts and SLAs: what is agreed, what is measured, what is missing — and what can be renegotiated.
• Set up governance bodies: operational meeting, tactical review, strategic steering committee — with clear decision rights.
• Define escalation: levels, deadlines, contacts on both sides, before the first incident occurs.
• Lead transitions: transition to the provider, provider switch or insourcing — with stable daily operations throughout.

Example: core-banking outsourcing with a data hub

Since 2022 I have been responsible for a strategic project at an Austrian private bank, right at the seam between bank and provider: a central data hub connecting the internal systems with the outsourced core-banking system. Real-time communication between data centres, semantic translation of data, stable daily operations during the changeover — and in parallel, preparing the hub itself so that its operation can be outsourced.

The case shows what matters: the bank keeps sovereignty over its data and processes while the provider runs the core system. You will find more depth on banking mandates on my sister brand pc-consulting.at.

Cloud, nearshoring, offshoring

As Group CTO I governed teams and providers across EMEA, APAC and the USA for eight years — with everything that entails: time zones, contract law, cultural differences in how escalation works. While rebuilding the IT of a European building-materials group, I set up cloud partnerships with Azure and Oracle and coordinated an SD-WAN with the Dutch parent company.

My experience: cloud and nearshoring lower costs only if in-house governance grows with them. Otherwise the effort merely moves from operations to coordination — and the bill stays the same. What an IT organisation looks like that leads its providers instead of chasing them is described under interim CTO / CIO.

Regulatory sensitivity

Banks, insurers and other supervised companies must govern outsourcing to clear requirements: risk assessment before signing, ongoing monitoring, exit strategy, audit rights, notification duties. With DORA, the demands on ICT providers and their governance have risen further.

I am neither a lawyer nor an auditor — but I know which evidence internal audit expects, and I build governance so that it works day to day and stands up in an audit. Data protection, the four-eyes principle and documented decisions are part of it. An overview of all my interim executive roles is under interim management.