The outsourcing life cycle under ISO 37500: governing each stage from decision to exit

What is the outsourcing life cycle?

The outsourcing life cycle is the sequence of phases an outsourcing arrangement passes through, from the first question of whether to outsource at all, through selecting a provider and moving the work, to running the service and finally renewing, re-tendering or ending it. ISO 37500:2014, the international guidance on outsourcing, is built around this idea: it covers the main phases, processes and governance aspects of outsourcing, and aims to help organisations enter into an arrangement and keep it successful throughout the contractual period.

Two points in ISO's own summary shape everything else. First, the guidance recognises that client and provider act separately in some phases and together in others, so a life cycle seen only from the client's side misses half the work. Second, it applies to any arrangement, whether an organisation is outsourcing for the first time or not, and whether it uses one provider or several. A BPO taking over customer contact, an IT provider running infrastructure and a facilities firm managing sites all follow the same arc, with different detail.

Five working stages, from decision to exit

ISO 37500 describes the life cycle in its own phases and processes, and the standard itself is the reference for its exact terms. In practice, Sterling uses five working stages to assess and organise an arrangement; this is Sterling's recommended structure for applying the guidance, not wording taken from the standard.

The stages are not a waterfall. Change requests arrive during delivery, a renewal decision sends the arrangement back to analysis, and a failed transition can force an early exit. What matters is that each stage has an owner, a decision point and a record.

Governance runs across every stage

ISO says its authors put governance at the heart of the standard because many outsourcing problems arise from missing or poor governance. Peter Bannink, project editor of ISO 37500, described it in an ISO article as being about joint decision making, joint delivery of services and joint governance. Governance is therefore not a stage of its own; it is the frame that carries the arrangement through all of them.

A workable governance model answers four questions in writing, signed by both parties:

• Who decides what. Decision rights for service changes, budget, risk acceptance and escalation, at operational, management and executive level, on both sides.
• How the parties meet. The joint bodies, how often they meet, what each receives beforehand and how decisions are recorded.
• How issues move up. An escalation route with time limits agreed in the contract, so a disagreement reaches the people who can resolve it before it becomes a dispute.
• How the model itself changes. A periodic review of whether the governance still fits the arrangement as its scope and value change.

Contract management and governance are often confused. The contract fixes obligations; governance is how the two parties run the relationship within and around them. An arrangement can be fully compliant with its contract and still failing.

Risk and flexibility at each stage

Identifying the risks involved in outsourcing is one of the themes ISO lists for the guidance, together with flexibility that accommodates changing business requirements. Both parties carry risk, and each stage brings its own:

• Analysis. Outsourcing a capability the business needs to keep, or a business case built on savings that ignore governance and transition costs.
• Initiation. Choosing on price alone, thin due diligence, or a contract that fixes today's requirements with no route to change them.
• Transition. Knowledge that leaves with people, data that does not migrate cleanly and service levels that dip while both teams learn.
• Delivery. Concentration on one provider, the provider's own subcontractors, drift in scope and quality, and changes in law or regulation.
• Renewal or exit. Dependence that makes changing provider impractical, and an exit plan written once and never updated.

Flexibility is the counterweight. A change process agreed at initiation, with clear criteria for assessing a change's risk and value, lets the arrangement follow the business rather than holding it to the requirements of the day the contract was signed.

A worked example: claims intake moved to a provider

Take an insurer in Australia that outsources first-notice claims intake to a BPO in the Philippines. In analysis, the board agrees that intake can be outsourced but claims decisions cannot, and sets the service and data protection conditions. In initiation, three providers are assessed against the same criteria and the contract includes a joint governance model with monthly service reviews and a quarterly executive review.

Transition runs in two waves, with acceptance criteria for call quality and data handling before each wave goes live. In delivery, a regulatory change in the insurer's market adds a new disclosure to every call; because the change process was agreed at initiation, it is assessed, priced and live within the governance cycle rather than argued over. Eighteen months before the contract ends, the renewal review compares performance with the original business case and refreshes the exit plan, so renewal is a choice, not a default.

The provider runs the same life cycle from its side: an account plan in analysis, a transition team in initiation and transition, and the same joint reviews in delivery. A fintech in India outsourcing software testing, or a start-up in the United States outsourcing payroll, would follow the same arc at a smaller scale.

Where outsourcing arrangements go wrong

Most failures trace back to a stage that was skipped or rushed:

• The decision to outsource is never revisited. The business case is filed after signature. Keep it as the yardstick for every renewal review.
• Transition is treated as an administrative step. Plan it as a project with its own risks, budget and acceptance criteria.
• The provider is outside the governance. Reports flow one way and problems surface late. Run joint reviews with shared data and shared actions.
• No route for change. Every change becomes a negotiation. Agree the change process before signature.
• The exit plan is a clause, not a plan. Write it during initiation and review it at least yearly.

Assessing your life cycle against ISO 37500

An assessment takes each material arrangement through the stages above and asks whether the decision, the owner and the record exist for each, and whether governance, risk and flexibility work as the guidance describes. The result is a maturity view by arrangement and by stage, and a prioritised plan that starts with the arrangements carrying the most risk or value. Because ISO 37500 is guidance, there is no certificate at the end; where your client or regulator needs certification, our guide to ISO 37500 and certifiable standards shows where the guidance supports ISO 9001, ISO/IEC 27001, ISO 22301, ISO/IEC 20000-1 and ISO 37301.

The outsourcing life cycle: questions organisations ask