ASSOCIATION OF CORPORATION COUNSEL



ASSOCIATION OF CORPORATION COUNSEL

Desktop Learning Webcast Transcript

Critical Strategies for Successful Outsourcing

April 24, 2007

12:00 PM ET

Presented by Hogan & Hartson LLP

Operator: Just a reminder today’s conference is being recorded.

Female: Karen please go ahead.

Karen (Boutros): Hello I am Karen (Boutros) senior legal counsel of Websense and

former chair of the IT&E Commerce Committee. Thank you for joining us today. The IT&E Commerce Committee is proud to present this “webinar” on Critical Strategies for Successful Outsourcing. You may ask a question at any time by typing in your question in the question area in the lower left hand corner and clicking send.

Any questions we don’t get to today will be answered by the presenters by Monday and then will be attached to the archived web cast as well as the transcript, which will be in the (YAKA) virtual library. Please also fill out the web cast evaluation if you would. And that is in the links box in the left hand box of the slide.

We are lucky today to have an expert panel. They are Phil Porter who is the head of the outsourcing practice at Hogan and Hartson a law firm with over 1,000 attorneys and 23 offices in the U.S., Europe, Asia and Latin America.

We also have Robin Everett who also is a partner at Hogan and Hartson who has considerable experience in structuring, drafting and negotiating outsourcing and technology related agreements. Including IT, VPO, HR, manufacturing and telecommunications outsourcing agreements.

Finally we have Kathy Stokes, Assistant General Counsel and Assistant Corporate Secretary of the Graduate Management Admissions Counsel, which is a non-profit association of graduate business schools that owns the Graduate Management Admission test that I am sure some of us took; and related products and services. A service provider delivers the GMAT test in 93 countries worldwide. Kathy handles the contracts and outsourcing legal function as well as data security, security litigation, employment labor and other matters.

Thank you very much. I will turn this over to Phil, Robin and Kathy.

Robin Everett: That you Karen. We have divided this discussion into two parts. One is a look before you leap and then the second part deals with particular issues dealing with off shore outsourcing. And we believe that the look before you leap is important because it is real important that you be prepared before going into an outsourcing transaction. They are significant undertakings and they require substantial commitment of internal and external resources. And you do not want to learn on your own transactions so we hope you find this to be helpful.

Phil Porter: This is Phil Porter and I am going to be easy to identify because I am going to be the only male voice on the web cast. I just want to point out briefly that any presentation on outsourcing that is done in an hour is necessarily not going to be complete.

And last September Robin and I and our colleagues offered an info pack that is available through the Association of Corporate Counsel website that will take much more than an hour to read. It is approximately 110 pages long. But it will give you an opportunity to take a look at many of the outsourcing topics that we will not be able to cover today.

The first topic that we want to talk about is due diligence. And it kind fits in the look before you leap category because we are not trying to suggest that people should not leap into outsourcing. Outsourcing is a very valuable business transaction but it is not the sort of transaction that you can just say let me sign the paper and then the outsourcing service provider will solve all of my problems.

It is absolutely essential for the customer who is considering outsourcing to take a look at what their current operation is. What is going to be outsourced and be able to give the service provider or maybe several prospective service providers a good strong idea of what the transaction is?

So you start by taking a look at what services you are going to be outsourcing. And a common problem that we see among our clients is that they immediately identify the problems they are having. And they are fully prepared to tell the prospective service provider about the problems that have to be solved but they do not spend so much time at looking at the good things that they are doing and sometime give the prospective service provider an unbalanced view.

Not only are the problem areas going to be taken over but the areas that are being done well are going to be taken over. And those things all need to be focused on. It is important to look at what you are now achieving. That is very, very easy for prospective customers who are already outsourcing and are not really changing their outsourcing service provider because they already have some fairly good performance metrics.

For the first time outsourcer who is just trying to take some services that have been performing for it and give them to a service provider there is often less understanding because there has been less measurement in the past about what has been going on.

Third topic we are going to cover a little bit more in the future, identifying the outsourcing objectives. Everybody says I am going to outsource because an outsourcing service provider is going to be more efficient. This is what they specialize in and they are going to be able to do it less expensively than I can.

And what is over looked in those two goals, both of which are admirable, is the fact that when you do something more efficiently and you do it less expensively the only way you can achieve those goals is by changing it. And one of the things that are often overlooked in outsourcing service transactions is the prospect that there is going to be a change in the way the services are performed.

And that leads us to the next one about obtaining buy in from the stakeholders. These are the people on the front lines who are going to experience the change in the services. And it is not good enough to sign a contract and all of a sudden download new services on the people who are responsible for getting the operations of the company done on a day-by-day basis. It is important to prepare those people and let those people have input into what is going on.

You are going to be very interested in the costs of the transaction. There is really no way to compare what the service provider is offering you unless you have figured out what your own costs are. And that can be something that is more of a challenge than you initially think about.

You need to identify any third parties who are already contributing to the services that are going to be outsourced. Robin and I worked on a transaction where the client tried vitally to identify all of the third party services that were being offered and only found out after the go light date that they had not identified all of the service providers and they found themselves paying some service providers for the same services that they were paying the outsourcing service provider to provide because they had contractual obligations so they pay both parties for the same services.

You also want to identify any assets that are being transferred. If you have an IT outsourcing transaction you may be sending computers out to the service provider. You will certainly be giving the service provider access to software. All of these assets need to be identified.

Robin Everett: Ok. Since following on this presentation. This is Robin Everett. I will be speaking the voice of the service provider and addressing their concerns and where they are coming from. Phil will be talking in the voice of the outside counsel representing the customer. And Kathy Harman-Stokes will be giving the perspective from in-house counsel of the customer. So you can understand the perspective that all parties have and then some successful ways to resolve those different issues.

So starting first then with the identification of the services (inaudible) as Phil said it sounds like that might be an easy task to undertake. But really documenting and putting down in writing what the services are can be quite challenging. And it is very important speaking from the service provider perspective that we understand what we should be pricing and what is actually included in the services.

Additional services that Phil mentioned would increase the price.

Phil Porter: Let me interrupt my colleague the attorney for the service provider to say that customers often are wooed and lulled into the situation where the service provider is prepared to provide a list of services. And they are often grateful for the service provider to do that because it saves time. But remember that the service provider is in the position of giving you its experiences based on other customers and is not necessarily familiar with the services that that particular customer needs.

If you accept the list of services from the service provider you have to recognize that you may not be getting exactly what you need and there is no substitute for looking at that critically.

Kathy Harman-Stokes: And this is Kathy Harmon-Stokes in-house counsel, Graduate Management Admission Counsel. I think this is one of the most important steps is to clearly understand your business and what your needs are in a service providers. It requires a great deal of collaboration and discussion with all of the business people internally who are going to be impacted by the retention of the new service provider. So just keep in mind a lot of collaboration it is going to take time to do it the right way. Do no make any assumptions.

Robin Everett: And often times the customers will want what is a suite clause to lump in all the services that they might not have actually specified in the details. And a couple of ways that they can do this is they will say the employees, the displaced employee services that were performed during the previous 12 months or they may have some language similar to services that are apparent in the performance of the services.

From a service providers perspective that can be quite problematic. For example, inherent in the services if you have a for example payroll outsourcing transaction and prior to the outsourcing it was handled in-house. You had the payroll administrator walk around and pass out paychecks, is that activity actually inherent. So does the service provider have to play someone on site to pass this around, probably not? But that would be a question as to whether or not that is inherent or stamping or mailing the paycheck is that really inherent in the services. So from a service provider’s perspective, it is much better to nail down just specifics.

Phil Porter: Oh tut-tut. From a customer perspective there is absolutely no way that any document can give a comprehensive description of all the services that are going to be provided. Not only do you not have the time or space to write it all down but you are not going to remember it all. And so from a customer perspective a suite clause is really essential because if the service is not described in the description of services then the service provider may be asking for an additional fee to perform services that were left out.

And you walk a tight rope here because we are not trying to take the service provider to the cleaners. We are not trying to get services that were never contemplated. On the other hand we want the operations of the customer to continue in a manner than reasonably allow the customer to do business without having to pay extra money for services that are just really part of the services that are described in the description of services.

Robin Everett: Phil I think what you are saying is very important and when we get to the governance section I think we can just highlight how important governance and communication is.

Phil Porter: And that is the point on which Robin and I both agree.

Robin Everett: Ok continuing on the identification of the services. Often times service providers will want to use the current base line at which the services were performed to measure whether a service credit would be provided, be available or if they are actually meeting their service obligations.

But when you are identifying what your service levels or service performance levels you really need to be thoughtful and diligent and identifying what it is that you should be measuring. For example you may currently be measuring if you have an outsourcing of call center and you are paying for your agent, they are your own employees. One measurement may be the number of calls; the actual numbers of calls the agents’ handle in a day and that is because you are paying per agent.

But that may not be so important if your outsourcing the call center and the pricing is based on the number of calls handled or is based on a per subscriber basis. And those instances the number of calls handled per agent and the efficiency does not matter so much but you might consider what really does matter. Maybe the call times resolution or the issue resolution time. So you need to look at what you have but also what you really want.

And it is also important that you define and measure your service levels in the same way. One project that I worked on had a, it was for a call center, it had a first call resolution metrics. And the customer defined the metrics at they met it at 100 percent and they defined resolved including escalations to Tier 2 support. So when the service provider came in they said there was no way that they could reach 100 percent because they also provided Tier 2 support and anything that would be escalated would not be considered a first caller resolution in their view.

So you really need to nail down the definition and the measuring tools and methodology going forward with the service provider.

Phil Porter: From a customer perspective I think it is important to step back for a moment and say what are service levels all about and how is the best way to structure them. Service levels when used properly are not a way to penalize the service provider and I can see Robin nodding her head as I say this. But really a way to create an incentive for the service providers to get the things done that a customer desperately needs done.

So you identify service levels and then the other shoe that drops is that you attach what are typically called service credits to the service level so if a service provider fails to meet a particular service level then there is some reduction of the amount that is paid the service provider for a particular month.

And the reduction that is paid is often referred to as the amount at risk. And what we are talking about is the service provider expects to receive $100 a month for the services or $100,000 a month for the services. The service provider is only willing to put a percentage of that amount at risk. They are willing to perhaps not make a profit in the months where their performance may not be up to snuff but they are not prepared to lose money.

And it is not in the customers; it is not an advantage to the customer to put the service provider in a position to where the service provider is losing money. That would force the service provider to cut corners and perhaps result in services that are even less effective.

So the one thing that I would really like every participant to take away from this is that it is important to sit back and say ok what do I want to create incentives for and what kind of incentives do I want to create. And a basic rule for customers is not to have too many service levels. The amount at risk is finite. If you have a large number of service levels if all of them are missed, each service credit will be very small.

On the other hand if you have a relatively small number of service levels it allows the service provider to focus the service providers performance. Make sure that those particular performance standards are met and if one or more of those performance standards is not met the service credit will be more dramatic and more likely to create an incentive for the service provider not to do that again.

Kathy Harman-Stokes: This is Kathy Harmon-Stokes. I want to reiterate what Phil just said concerning the number of service credits that you have and how much money is at risk. I think if that is critical you focus on the handful of pain point you really have and you do not want to have too many of them because as Phil just said having too many service levels really dilutes the significance and impact of each individual service level. Just focus on the key pain points.

I want to go back just a second to something that Robin said a minute ago. Where you are outsourcing for the first time or using a new service provider. It really presents a good opportunity to understand your business and to make some critical decisions. And critically analyze what has been done in the past and how you want things to be handled going forward.

One example that we faced was that with a previous service provider the full report included social security numbers. And they had always done that and when we were looking at a new service provider we asked the critical question about whether we need those social security numbers on core reports and given current legal issues we decided that we do not need them. And so switching service providers gave us a really good opportunity to look at the data we needed and to redesign the core report and eliminate the data we did not need.

Robin Everett: Ok another do diligence activity is identifying the job transfer. When services are outsourced typically jobs are eliminated. And in addition to dealing with some of the communication issues that you may have with customers there actually are legal regulations that apply. And two in particular that we are going to touch on is the Warren Act and that is a U.S. regulation. And the second is the Acquired Rights Directive in Europe.

The Warren Act which is the Worker Adjustment and Retraining Notification Act requires that you give 60 days notice to employees who will be terminated as part of a facility closing or if there is a termination of the sort of employees at that site if it is over 50 employees. And this implies to employers with over 100 employees.

And 60 days notice can really cut into the cost savings that you are expecting. So you need to work closely with the service provider to make sure either the terminations are staggered or that your cost analysis takes that additional cost into account.

The European Union, the do not recognize employment at will and this Acquired Rights Directive is very complex and particularly for Americans who are not use to this type of regulation it can be very expensive and very time consuming to undertake.

So for example you cannot actually terminate employees in an outsourcing transaction. They are very few narrow exceptions and when you are transferring the employees to the new service provider which you are required to do in most cases you may have to meet with the work counsel and consult with them and it is not just a shuffling of papers. They actually require you to meet with them, talk with them, and take into account their recommendations. They are kind of like little mini unions and that can be very expensive, very time consuming.

The employees that are transferred have to be transferred with the exact same employment terms. So for example someone has five weeks of vacation now with you but you transfer them to the service provider and the service provider only gives X-years of service four weeks of vacation. You cannot simply give them a payment for vacation; they have to have five weeks of vacation with the new service provider. So it is very tricky.

And also what makes it complex is the requirements vary between the member countries. And also the remedies vary between the various countries. In France for example failure to comply with this can result in criminal action. In Germany the employee can object to being transferred to the new owner and can remain with the former employer. So that may also throw a wrench into the economics of the deal. So it is very important that you start working early on if you are contemplating transferring any employees or doing any outsourcing with your European entities.

Phil Porter: Just kind of a tight rope issue for customers because one of the first thing a customer is concerned with is the prospect that if its employees get wind of the fact that there is an outsourcing transaction coming they will have a natural tendency to look for employment elsewhere.

And they may find the employment elsewhere before we are ready to start the outsourcing transaction and that leaves the customer in a very difficult position because it no longer has the staff to manage its infrastructure between the time the employees flee and the time that the outsourcing service provider is ready to assume responsibility for the services.

There is a natural tendency there for to try to keep outsourcing transactions as quiet as possible for as long as possible and that natural tendency is totally inconsistent with the legislation that is out there. And unless there is a human resources person available and involved who is familiar with this legislation the natural tendency may win out and if the natural tendency wins out then the employees will have legal claims against the customer.

So it is extraordinarily important to plan the whole strategy of communications with employees and the context of this legislation so that you do whatever is necessary to retain the employees as long as you need those employees to perform services, comply with all the legislation, and maintain the operation of the customers business.

Quite often that involves a fair amount of public relations work and as a practical matter often involves retention bonuses so that employees have an incentive to stay until they are no longer needed. There is a real balancing act that takes place there but it is extraordinarily important.

Another issue that I just want to touch on in connection with employees is that when employees are transferred there is a fairly immediate and instant recognition that employees may have claims against the former employer that arise before the date of transfer of services to the outsourcing service provider. And they may have claims against the outsourcing service provider that accrued after that date of transfer.

However the employees may not be quite so conscientious about bringing their claims in the time frame that I just described and so whenever there is a transfer of employees, there is generally a very intense discussion between the customer and the service provider about indemnifying each other for claims that really relate to the person who is doing the indemnify.

So that if a claim actually accrued before services are transferred to the service provider and the employee waits until after that transfer of services and then conveniently sues his or her new employer the service provider wants that said claim covered by the customer because the claim actually accrued when the employee worked for the customer.

Robin Everett: Next we are going to talk about governance and as Phil and I discussed earlier governance is really important in these projects. Not only in defining or finalizing what the scope of work is but an outsourcing agreement is one where it is really a relationship agreement. It is not like you are buying so many (widgets) and they are delivered and find that then there may be some warranty issues.

You really are working side by side even though one is in the role of customer the other is in the role of service provider. So it is critical that you have proper communication management, performance management, change management and transition management for the future.

Phil Porter: A little bit ago on one of the earlier slides I mentioned the fact that one, the primary goals that everybody sites for an outsourcing transaction are improving the efficiency with which the outsource services are provided. And decreasing the cost with which the outsource services are provided. And we kind of blew by a slide that had something about transition versus transformation on it that I want to mention on it now because that issue is very, very closely intertwined with the governance issues.

Transition is generally considered to be a situation where the service provider takes over the outsource services and tries to provide them in a manner that is very, very similar to a way they were being performed before the transition date.

Many service providers refer to this as lift and move or drag and drop. But the idea is that after the transition date the services are going to look and feel very similar to the way they were provided before hand. Transformation on the other hand is where you really get the increases in efficiency and you really get the decreases in cost. Because transformation is a situation where the service provider comes in and says I can do this better, let me show you how and all of a sudden there are a lot of changes.

Whether you have transition with minor changes or transformation with major changes you have a situation where the customer and its employees have a different experience than they had before the date when the service provider takes over.

And as much as we all may want to say that we are cutting edge people and we are early adopters and all those other things that make us sound young and vibrant. None of us really likes change. Change requires us to you know readjust our lives and because of that outsourcing service transactions by their nature have tension involved.

I attended and spoke at a conference not too long ago where the statistic was commonly said that 80 percent of outsourcing service transactions is unsatisfactory. That is a fairly dramatic statement and one that is probably more daunting that it needs to be because no body really defined what unsatisfactory was and it probably includes a lot of minor dissatisfaction that everybody would have experienced had they not outsourced.

But the point that I want to focus on is that there are changes and the topic that we are now about to talk about governance is the way that you take that tension and try to solve any problems that arise because of it before they become so serious that they are no longer solvable.

I had a situation within the last six months where a client that I assisted with an outsourcing transaction about two years ago called me and said, “Phil the outsourcing transaction is not working and we need to terminate it.” And so obviously my first question having done the outsourcing transaction and wanting it to succeed as I want all the transactions I work on to succeed was, “well what is wrong?”

And I got the kind of flustered response from the caller, “well it is just not working. It is terrible, we hate it.”

And so then I tried to sooth things down and said, “well we really need to look at what the service provider is doing wrong.” And I was able to calm down the caller and we found out what the service provider was doing wrong and the transaction was two years ago and I did not have an immediate recollection but I had this vague pain in my stomach that the service provider was not doing anything different than what the description of the services said.

So I asked the caller to be a little bit patient. I wanted to go back and review the agreement and the caller agreed to let me do that. I went back to review the agreement and in fact the service provider was doing exactly what was in the description of services.

And so there was one of two problems in this transaction. One of the possibilities was that the customer with my help did not adequately describe the services at the time the transaction was done. Or second maybe we described the services as adequately at the time the transaction was done but the customers needs changed and unfortunately the services did not.

What we are going to talk about now is the concept of communication between customer and service provider so that we never get to the point that somebody is calling a lawyer and saying this transaction is not working and we have to put a stop to it before both parties have been able to address whatever problem is arising to see if they can not work it out before marching into court.

Kathy Harman-Stokes: One point that I want to make as in-house counsel person is that it is really critical to include in your contract provision to really sort of encourage if not force the business people in your organization to work very closely and regularly with the business people in the other organization.

We have service providers where our business people are talking to the service provider business people every week. Where my legal department is talking to the service providers legal department at least once a month and where the CEO’s are talking quarterly.

When you really have critical functions that have been outsourced open lines of communication avoid disputes and they really allow the customer and the service provider to work as a team and ensure that all difficulties are resolved and a collegial and effective manner. Which also increases efficiencies for the entire transaction.

Phil Porter: I need to add another war story here. One of the first things I discussed with a customer when I represent a customer in an outsourcing transaction is how we are going to handle governance. And I want to recount to you the immediate response that I got from the last two clients that I worked with on outsourcing transactions and I immediately add that Kathy was not one of the last two clients that I worked with.

The first of the two I said ok we want to establish the kind of communications that Kathy just mentioned and one of the ways to do that is to put a provision into the contract and we will talk about this on a later slide that requires periodic meetings.

And then the next thing we have to do is decide who is going to staff those meetings and the immediate response I got was well it is not going to be me. I was in a room with the clients decision makers. They were the people who were going to take responsibility for the outsourcing transaction. They were the people who were the champions of the outsourcing transaction yet none of them wanted to sit on a committee where they were going to be communicating with the service provider on a regular basis.

I did a fair amount of fast-talking during that meeting. By the time that I finished that meeting I had persuaded them that if in fact this was going to be a successful outsourcing transaction it needed their hands on approach. But it was something that was not easy to sell.

The second client that I am going to recount, which happens to be the most recent one, I had the very same decision with and I was taken aside by the person who brought me into that meeting. He immediately kind of suspended the meeting, took me out in the hall and said, “I do not want this topic discussed with the other people at the table. This is something that is between you and me.”

And I obviously honored that wish, but then I took him aside privately afterwards and said this is not the way to have a successful outsourcing transaction. What we need is broad based communication as possible because if we limit communication what we are going to have is pockets and areas of dissatisfaction that are not being communicated. And to the extent that they are not being communicated they are going to get more serious in the little closet where they are being held. And again I sold the point of view but it was not an easy sell.

Robin Everett: And that takes us to performance management, which is also as Phil and Kathy both mentioned, really a part of communication management too. Performance management is a joint responsibility. If you are transferring an outsourcing function and it does not mean you have transferred your business. You still have responsibility for your business. And even if you have the very best owners terms on a service provider that is not sufficient in all cases or probably in any case in getting a really good service provided to you. Which is what you really care about.

And just one more story that I have is I represented a service provider who was helping a client recover from a failed outsourcing. And although the client and their previous service provider entered into an agreement that was very favorable to the client and had all these governance provisions in it they did not actually act on those and take advantage of those and the customer I think really fell behind on his duty to supervise the work.

And so what happened at the end of the day is services were not properly performed. It was a publicly traded company and there was a lot of press, negative press about that transaction. And it was just not a good situation. And what you cannot do in a contract is really protect against your reputational arm.

Kathy Harman-Stokes: I want to make the point that from our perspective owning the GMAT exam our brand is everything. And that is what we are the most protective about. So we have ensured in our contract provisions that we have a communication and we are living by that everyday in our communications with our service provider.

And one thing to keep in mind is that the company that owns the brand is on the hook in the media and you do not want that negative press and you have a responsibility to protect the brand and also legally to oversee what your service provider is doing. You are going to get audit provisions in your contract and you need to make sure that those are operationalized and make sure you are following through. And you have the oversight you need in addition to the regular communication so that you can flag problems ahead of time.

The phrase we like to use internally is trust and verify and it is really important in protecting your brand to make sure the service providers are regularly doing what they are suppose to do. Complying with laws they need to, et cetera.

Phil Porter: My favorite quote on the slides that we have up now is the monthly performance report. I have dealt with a number of service providers who may not be as reasonable as I am sure Robin always is. Who are reluctant to provide monthly reports of their performance?

This gets back a little bit to the service levels that we were talking about earlier and there is a tendency on the part of some service providers to want to handle service levels quarterly. And the incentive for that is not hard to discover if a service level is missed in one month but you are only reporting quarterly it is possible that you can exceed the requirement in one or two of the other months and end up with a quarter where you have not failed to meet the service level.

That is from a customers perspective, not a good thing because it creates a climate on the service provider that oh well if we have a bad month we can fix it in a different month. But the customer has to operate its business day in and day out, month in, month out and can not afford to have a bad month.

So I think that first of all it is essential to get monthly reports on the service providers’ performance. And on one of the outsourcing transactions that I am working on right now, I am working with a consultant, he is very good and he has suggested and it is a suggestion that I like so much that I am going to do in all the future outsourcing transactions I do or I will suggest it any way.

He has suggested that on a quarterly basis a person from the service provider needs to come in person to the customer’s facility and go over the performance reports for the preceding quarter. And it is kind of like a status report or a state of the union message or calls it what you will and if everything is going well this person is going to be able to have very good things to say.

But if there are some service level failures the service provider is right in front of the customer and can listen to the customer’s response to that and has a greater opportunity to feel the customers pain. And from my perspective I think that is a very good thing.

And the reason that I think it is good is I am not a status who is trying to make the service provider miserable or make Robins life miserable. But I am trying to get these problems bubbled up into communication with both parties before they reach the point the customer is calling me and saying this is just not working I want to terminate the agreement.

Robin Everett: Next we will be talking about key off shoring issues. And these issues also come up in domestic outsourcing but they are particular concern in offshore issues.

The first issue is data and privacy and data security. Which is a really hot topic and a lot of service providers and customers as they should be are very concerned about this and allocating risk in this area. There are over 33 state laws that require notification of security breaches and that is in addition to some federal laws that apply to particular industries such as Grimley, Slylie and Tippa and also the U.S. Federal Trade Commission that requires reasonable data security measures.

Phil Porter: I have a comment that I have to make. I know that Kathy is going to say a whole lot about her experiences with privacy and data security. The one comment that I need to make is that a customer cannot outsource compliance with laws.

At the end of the day if laws are not being complied with the enforcers of those laws are going to look at the customer and say you did not comply. And the customer can raise its hand and say oh it is not my fault, my service provider did not comply. But the enforcers of those laws do not care.

It is the customers’ responsibility to comply with laws. In the data security area I have had a number of clients come to me and say well we have not yet completed our data security compliance policies. We want the service provider to help us with that.

Service providers are not data security lawyers. They do not dictate or help a customer determine what compliance is required. They are in a position of saying tell me what you need to comply with laws and I will do it. But a customer who says please tell me how to comply with laws is using its resources improperly.

Kathy Harman-Stokes: I want to add one bit of caveat to that. The owner of the data, the customer is certainly the most responsible entity, but for example if you are here in the U.S. and your service provider is collecting and processing data overseas your service provider may be just as liable under those authoritative laws as you are as a data owner. So you seem to think about those issues and make sure that you are in compliance with U.S. law but also other countries where you operating and the service provider also does need to agree to comply with law.

I will say just as broadly looking at the bullet points on the slide you are going to have restrictions on exporting personal identifiable data from Europe into the U.S. and you are also going to have laws to comply with in countries wherever you are collecting data in country around notifying appropriate government authorities or a filing application to even process and collect data.

So some companies think well I am compliant with Safe Harbor. My service provider is compliant with Safe Harbor. Well that is not going to help you in terms of notifications and applications where you are collecting data to actually be able to collect that data.

Some of the notifications are relatively simple as in the U.K. but some of the applications to process data for example that required in Greece are extensive and depending on the data you are collecting you may have to have your counsel and your representatives meet with the Hellenic Data Reception Authorities and it may be a timely, time consuming process. So keep in mind those obligations that you will have.

Robin Everett: And as a service provider one of the important things that I would advise a service provider client is if you do not need the data do not get the data. So if your client, if you are doing an IT outsourcing project and maybe doing some application bill you will need some data to test the applications. But it can be mock data, not the actual data.

In one case that I worked on the customer said well we always use our live data. We do not want to go through the expense of developing mock data that you just have to be compliant with our security regulations. And the service provider said do not give it to me I do not want it. We have to work out how you can get us mock data. So the best way to prevent disclosures and breaches is to not provide the protected data to the service provider if at all possible.

Kathy Harman-Stokes: We have one service provider for example who is providing some test development services for us and in initial discussions we thought oh well, sure that makes sense for that service provider to receive the personal identifiable data; to receive the actual names of the test takers. And once we started thinking about it critically they did not even need the persons name at all. So the data was anonymized after that service provider which means that we stripped out the person identifiable portion of it and assigned randomly selected number instead so the data could be matched up.

Phil Porter: One of the biggest sensitivities I see on the data security issue is companies who do not realize that they have a security issue. We are now in a global economy and many, many small companies are very active and very successful participants in the global economy. And they have got to be active in such a successful participants in the global economy by establishing outposts in other countries in the world.

And without intending to violate any laws they sort of have been blissfully unaware of them. And so what happens is that we have a company with subsidiaries or divisions in a variety of different countries and they process their entire payroll. They process all their data from their United States data center, which is at their flagship operation.

They do not recognize that there are data security requirements that they should be complying with that they are not. And some times the outsourcing transaction is the event that brings all of this to life. And at that point it is extremely important to say yes I have a goal of completing the outsourcing transaction but also recognizing that there is a legal compliance issue that needs to be addressed, separate and apart from the outsourcing transaction.

Kathy Harman-Stokes: One other quick note around some of the European union requirements. There are several countries in Europe that have specific security laws in place. Like Spain, Italy and Romania for example. I believe one of those countries actually has the number of characters that you must have in your pass code around the data that is sitting on servers. So there are some very specific security requirements from some of those countries.

Robin Everett: Intellectual property ownership and protection. Different countries have different laws and different levels of enforcement. You may have heard, be familiar that China has had some IP enforcement issues in the past. They are working on that and they are actually getting better. But they still have a ways to go and there are several other countries that have different laws and different enforcement reliability issues.

There also may be restrictions on your ability to use third party assets if you are off shoring. So maybe it is part of your asset allocation in this deal you are suppose to be providing application to the service provider in India but your license grant from a third party licenser may only be for use in the U.S.

So you need to do diligence to make sure the rights you are giving and the geographic areas you are giving those rights are fully covered and compliant.

Phil Porter: People mess us intellectual property rights in the United States without even going off shore. There is just kind of a intuitive thought that if a customer is paying money for the development of intellectual property the customer is going to own the intellectual property. And while that is a very charming and cozy intuitive thought it is not right under the law.

And under the laws of the United States if I engage an outsourcing service provider to develop intellectual property for me and just assume that I am going to own it I am going to be wrong. The only way that I own it if it is developed in the United States is for the developer to assign it to me.

That works for application development in the software arena. That works for inventions in clinical trials, medical research outsourcing. It works for any aspect of intellectual property. So if people can mess up intellectual property on such a systematic and regular basis in the United States just imagine what happens when things go offshore; because the rules when you go offshore are different.

They are not necessarily more intuitive and some places they are even less intuitive. For all the people who have finally learned the lesson that the service provider must outsource new, must assign new intellectual property to the customer in the United States someone who is outsourcing to Germany and tries to include a similar clause will be very frustrated because certain types of intellectual property are not even assignable by the developer in Germany.

So there is no substitute if your off shoring to take a look at what the intellectual property laws are in the country to which your outsourcing and making sure that first of all you can achieve the goal that you have. And second if you can achieve them that you have done the proper thing in the contract to make sure you do achieve them.

Robin Everett: Some other off shoring issues are COLA, foreign exchange, changes in law, Sarbanes-Oxley and language and cultural differences. I would like to talk about COLA again from the service providers’ perspective. COLA stands for cost of living adjustment. But what service providers are really concerned about is not so much the cost of living in the countries in which they are performing a service but the cost to employ the people to perform the services.

So a standard index that is used to determine COLA is often a consumer price index, the CPI. Service providers would prefer to use an index called the ECI or the employment cost index because that really does reflect what their true cost is. And what would be the cost to the customer if they had not outsourced the services.

In the U.S. the difference can be significant. For example, in a deal that had a $10 million annual fee over seven years, over the last seven years, the entire increase if you use the ECI instead of the CPI would be an additional $3 million. And that is comparing the CPI standard with ECI white collar. So for consumer they may see using ECI as an additional cost but to the service provider they are seeing that as true indicator of what the cost of providing services is.

And that, the $3 million as I mentioned is just the difference from CPI and ECI in the United States. When you start looking at the cost of employment in the developing countries where services are now being performed that can be even more significant.

So the actual COLA index or inflation index should not be just glozed over just because CPI is thrown around out there. That is not necessarily the right index. So it is just important to determine the appropriate index.

Also not all of the services, I am kind of arguing for the customer here.

Phil Porter: Thank you Robin.

Robin Everett: Are subject to this cost of living or cost of employment index. So if you have part of the cost, infrastructure, if you are providing a lot of servers or equipment or facilities, those may not necessarily be subject to the cost of living. And so maybe 40 percent, 30 percent, 70 percent of the services will be subject to the index is typically the way that is handled.

And then you may have some services performed in the United States so you may only want to use the U.S. index for that portion or for offshore services use apply the offshore index for those services. It can get very complex but it also can be simplified. It is really just a matter of sharing the risk and who is in a better position to absorb that risk. And there are several different creative ways to do that. Get similar issues on the foreign exchange rate, fluctuation.

Phil Porter: We are getting very close to the end of our hour so I want to focus lastly on the Sarbanes-Oxley Act that SEC bought. Thanks to Sarbanes and Oxley a couple of years ago they have single-handedly added some 10 to 20 hours to every outsourcing negotiation. And the reason for that is that every customer who is a public company must comply with Sarbanes-Oxley and maintain internal controls.

The customary way of doing that is by obtaining a fast 70 report an audit report from the service provider, which basically reviews any computer systems that the service provider uses, that have an affect on the financial activities of the customer. That by itself result in a large negotiation in terms of how often these reports will be provided. When they will be provided. Who can see them? What happens if there is a problem in one of the reports? And all of these areas are things that need to be covered very carefully in an outsourcing negotiation.

I think that brings us to questions.

Karen (Boutros): Yes, hi this is Karen again. We had one question. What is dynamic bidding and what do you all think about that?

Phil Porter: Well I will start with that one because I have some very strong thoughts about it. Dynamic bidding is a situation where in an outsourcing transaction we create almost an auction situation where we have a plurium of, a number of outsourcing service providers responding to the customers needs. And bidding on the fly so those individual services providers can respond to another service providers bid and seek to improve it.

Customers often although now I am going to reciprocate Robins arguing on my behalf a while ago. Customers often find dynamic bidding to be a very attractive option because it as any auction it creates the best possible price. All of the service providers who are participating in this activity have a strong incentive of being the single successful service provider and so they have an incentive to bring their bid down. And every time their bid comes down the customer gets a bigger smile on his face.

The problem I see with dynamic bidding is that if I am a customer I want a carefully thought out and carefully structured bid that the service provider that ends up with a bid that the service provider can actually perform. I also want the service provider to be able to perform all of its obligations without losing money. Because if the service provider starts losing money on the services it is providing to me it is going to have an incentive to cut corners and if it is losing enough money it may have an incentive to fail. And as a customer I do not want either of those incentives.

In a dynamic bidding process there is a service provider bidder who is in the drivers seat for making those bids. But unlike a standard transaction the service provider bidder does not have the same opportunity to go back to the service providers’ own infrastructure and say ok how do we respond to this. Can we lower the bid and still provide the same quality of services. Will we need to say we can lower the bid but we would have to change the services in the following manner?

All of those opportunities are short-circuited and what we have is total focus on price without focus on the quality of the services that are being provided and the ability to meet the service provider’s needs. So when I have customers who approach me with the dynamic bidding process the first thing I point out is that it is the customers decision and I can support that process if that is what the customer decides. But I have serious questions about whether it is in the customer’s best interest.

Karen (Boutros): Phil thank you very much. And to thank Phil, Robin and Kathy for a very informative presentation. And of course, thanks to Hogan and Hartson for sponsoring the presentation.

We have some questions we were not able to get to. And as I said before those will be posted on a link with the archived web cast by Monday and they will also be in the transcript in (YAKA) virtual library.

Thank you all for joining us today and we hope to have you join some of our IT&E Commerce calls which we have on the first Thursday of every month. And also we hope that you will join us at the (YAKA) annual meeting in Chicago from October 29th to 31st. Thank you again and have a nice day.

END

................
................

In order to avoid copyright disputes, this page is only a partial summary.

Google Online Preview   Download