Outsourcing: global control

It’s no secret that the trend of organisations moving key business processes
offshore is set to continue, with over a third of CEOs in a recent PwC survey
planning to outsource part of their business during the coming year.

This geographical shift is common across all industries, including financial
services, telecommunications, manufacturing, technology and the public sector.
It’s also on the increase in the legal services sector, with a growing number of
law firms undertaking legal process outsourcing (LPO) in emerging markets such
as India, Sri Lanka and the Philippines as they work hard to reduce the cost of
litigation and a range of other services.

But, while there is no doubt that significant efficiencies can be generated
by offshoring key processes, the offshore model brings new risks that need to be
monitored and mitigated. Our experience suggests that many businesses are
struggling to find out exactly what is happening on the ground with regards to
fraud, dishonesty, misreporting, corruption and conflicts of interest.

The risks range from well-publicised data theft through to insider criminal
threats and more subtle frauds such as suppliers overstating performance to
reach their service level agreement targets and achieve greater margins.

As with offshore operations in the financial services sector, a high profile
incident involving the compromise of sensitive customer data at an LPO provider
could be damaging for a law firm. The consequences could include regulatory and
legal censure and the erosion of customer trust and reputation.

Because of geographical distance and differences in culture and behaviours,
it is far more challenging for a company to gain any comfort or real independent
evidence of what is happening on the ground. Often, those with an oversight role
never visit the location and
rely solely on the information reported to them.

We have found that misrepresenting performance is more common than you might
expect, particularly when the levels of reward or margin are determined by
performance against pre-agreed targets. In one case, we discovered there were no
controls to prevent a supplier repeatedly selecting different samples of
performance data until they identified one which was optimal, thus achieving the
maximum payment available. This practice happened month after month, across a
range of measures such as staff attrition, customer complaints and sales
conversion ratios by contact centre staff.

Recently, PwC was asked to help a UK-based business assess the internal fraud
controls at one of its offshore centres, where they relied upon a third party
supplier to deliver a range of services. A number of internal audit reviews had
already been conducted by the client, but based their conclusions on the
information made available to them by the provider.

The client had a lingering doubt and eventually asked PwC for help and their
instincts were well founded. Our offshore integrity team adopted a different
approach and identified a range of very serious fraud control weaknesses that
had been ignored by the provider.

In this case, we found we needed to develop a range of investigative
techniques to circumvent common defensive scenarios such as highly choreographed
and escorted visits and staff being given pre-prepared answers to likely
questions. We devised a methodology to help identify any discrepancies between
what was actually happening and what was being reported.

Put simply, it transpired that their actual performance was not measured
against the effectiveness of these controls, but instead was focused only on
those areas that would impact the achievement of their targets as set out in
their contract. Our client also outsourced a significant proportion of their
accounting and finance functions offshore. If similar control weaknesses existed
in that environment it could have led to a major internal fraud. Their brand and
reputation – one of their greatest business assets – would be seriously damaged.

Getting it right, however, is not as easy as it sounds. The best way to
investigate this type of issue is to use an independent team comprised of
experienced UK-based specialists supported by local practitioners. This provides
an effective blend of seasoned investigative expertise with an understanding of
local business practices, culture and behaviours.

Local cultural awareness is an indispensable element and can often make the
difference between identifying or missing underlying issues. Additionally, in an
area that will be familiar to most firms, having local knowledge at the scoping
stage of an offshore integrity review is vital to help avoid creating a
regulatory or legal disclosure burden. If the work was scoped as an
investigation to identify who had committed a fraud then, if successful, the
investigation could generate a responsibility for the business to make a report
to the regulator or the authorities. It is therefore important to understand
exactly what the objectives of the work are and how local regulatory and legal
requirements might influence the outcome. This is an area that many businesses
do not consider.

It has often been said that you can outsource operations but you cannot
outsource risk. There is a great deal of truth in this. What we know for sure
is, you certainly cannot outsource your reputation. Many UK businesses would not
hesitate to investigate concerns or suspicions of economic crime in their UK
operations. To ignore them abroad is dangerous.

Our experience suggests that there is a corporate reluctance to explore these
issues beyond UK shores but an increasing number of companies understand that an
‘out of sight, out of mind’ mentality is one they cannot afford.

Neal Ysart is a senior manager in PwC’s forensic services practice.