ISO 37500:2014

ISO 37500:2014 gives generic, industry-independent guidance on outsourcing across a four-phase life cycle with governance at its centre. Clause 4 sets the contextual model, the reasons for outsourcing (cost, strategy change, capability access, risk transfer), seven key risks (no strategy, poor grasp of environment dynamics, blind cost focus, underestimated business impact, cultural incompatibility, fading process understanding, poor relationship management), the life cycle model and its main outputs, with the business case carried and re-baselined through every phase. Clause 5 sets the outsourcing governance framework: twelve principles, empowered managers, joint governance committees with charters and a relationship matrix, the client's retained organization, cultural differences, and three governance practices (joint objectives, committees, monitor-evaluate-direct) with phase-specific governance including the four exit triggers. Clauses 6 to 9 give the four phases as processes, each with purpose, activities, success factors and outputs: outsourcing strategy analysis (prerequisites, eligible services, organizational impact, strategy, initial business case, decision, project set-up); initiation and selection (service requirements, the outsourcing model and its frameworks, agreement structure, provider identification, shortlisting by RFP, outlining agreements with due diligence and exit management, negotiation and signature); transition (team, governance, refined frameworks and plan, knowledge acquisition, execution of the transfer, deployment of the quality-risk-audit-compliance, asset-knowledge and delivery frameworks, testing, pilot and formal handover with a baseline); and deliver value (service delivery, performance review, issues, changes, optional innovation and transformation, finances, relationships, the agreement, value assurance, and continuation or exit preparation). Guidance, not certifiable; the outsourcing counterpart of ISO 44001 collaborative relationships and the process reference for third-party and outsourcing controls in security, resilience and financial-services rules. It comprises 57 controls organised across 6 domains, and applies in International.