One of the ways to reduce our risk is to outsource. If we do not have the requisite knowledge or available talent readily available, we can chose to outsource to organizations with this expertise or volume of talent. Outsourcing can improve our chances of success in this regard.  We also have recourse should the outsourced organization not meet the needs—we have a contract upon which we can fall back.  However, the misconception is that because we have outsourced this work package we have relieved ourselves of all of the risks associated, and that is not true.

Consider the company that outsources work because they are unable to perform the work. It really does not matter if they cannot handle the work because there is no person with the talent or the volume of people is too low to handle the workload.   They outsource to get the work accomplished. Then consider that the company performing the outsourced work does not deliver the work package as expected, with regards to either quality or timeliness.  We have outsourced the work, but we find that we are still stuck with the risks—as if we had not outsourced the work. Sure we have a contract, and likely after much wrestling and possible litigation, we are able to recover some of our investment, but the point would still be we suffered the risk.

Outsourcing is only part of the answer. If the contents of the package are part of a project the outsourcing alone does not eliminate the risks associated with it.  If we were to perform the work inhouse and fail or we outsource the work and they fail, the project has still failed.

So what is the answer? We must determine the appropriate metric to be able to predict success even (or especially) for the outsourced work packages is important.  In our outsourced package example, we would want to see a thorough work breakdown structure for the activities with estimates. We would also want to see the suppliers schedule performance index monitored periodically (weekly or monthly) so we can clearly see the progress and if the risk is indeed mitigated by the outsourcing activity.  Outsourcing is not enough, you are still required to pay attention and monitor the situation.