Every outsourcing contract signed in the last decade contains a business continuity clause, and this week those clauses are being read properly for the first time. Business continuity for outsourced operations has moved from an annexe nobody negotiated to the most consequential page in the agreement, and the discovery most buyers are making is uncomfortable: the plan was written for a different kind of disaster. Continuity plans for delivery centres assume a local event and a functioning world around it. Typhoon, flood, fire, power failure, civil disruption. The mitigation is always the same: move the work to another site, in another city or another country, where everything is normal. With restrictions being announced daily across Manila, the Indian metros, Cairo, Colombo, eastern Europe and the Gulf simultaneously, there is no site where everything is normal.
The four assumptions that just failed
It is worth being precise about what broke, because it determines what you should ask for. Geographic diversity as the primary control. Splitting a process across two countries protects against uncorrelated risk. A pandemic is correlated by definition, and so the single most expensive resilience feature in most outsourcing arrangements is currently providing very little protection. Alternate site capacity. The recovery plan names a standby facility with seats. Those seats now cannot be filled, because occupancy density is exactly what public health measures are limiting. Capacity that exists but cannot be occupied is not capacity. Work from home as the fallback. In most agreements it is prohibited outright, and the prohibition came from the buyer. Clean floors, no personal devices, no paper, no phones, locked terminals, restricted internet, recorded calls. The security model that buyers insisted on is precisely what makes a rapid shift to home working contractually and technically difficult. People reaching the building. Delivery operations depend on shift transport, shared accommodation and public transit. When those stop, the site is available and the workforce is not.
The five questions to put to your provider this week
Ask for specifics and treat general reassurance as a negative answer. Who is doing our work right now, in what location, and at what percentage of normal headcount? A daily number, not a statement of intent. What device and network is each of those people using? Provider-issued laptop with full disk encryption over a virtual desktop is one answer. Personal machine over home broadband with a screen-sharing tool is a very different one, and both are currently in production somewhere. What access have they been given, and what has been relaxed to make it work? Multi-factor requirements, clipboard and print restrictions, download permissions, session recording, supervisor oversight. Get the list of exceptions, dated. Which of our processes are running, which are degraded, and which have stopped? Provider status reports are currently optimistic by construction. Ask for it process by process. What is the sub-contracting position? Has any work moved to a sub-contractor, a partner or another delivery location to maintain coverage? This is the question most likely to produce a surprise, and it is the one your own regulator or client will ask you.
| Request | Evidence to retain |
|---|---|
| People and location | Current team, operating place and capacity basis |
| Devices and access | Managed equipment and dated control exceptions |
| Process state | Running, degraded and stopped work |
| Subcontracting | Authorised delivery parties and data locations |
| Recovery | Named commitments and review of temporary conditions |
Qualitative summary of this article's source text, not a measured outcome or performance estimate.
Decide the control position, do not inherit it
The worst outcome available this month is that home working happens by default, without a decision, and you discover the arrangement in a quarterly review in October. If you are going to permit it, and most buyers should, permit it explicitly and in writing, with conditions: provider-managed device or thin client, no local storage, no personal email or messaging for work data, restricted access to the minimum data set required, no printing, camera and mobile phone rules for processes handling card or identity data, supervisor availability, and session logging retained. Set an end date, and agree how it will be reviewed. Then deal with the paperwork consequences properly. A change in the location of processing is a change to your data processing arrangements and frequently to your regulatory notifications. It may trigger obligations to your own customers under their contracts with you. It almost certainly affects certification scope, because a control environment audited for a delivery floor is not the control environment currently operating. And triage the process list rather than pretending everything continues. Payroll, statutory filings, cash application, supplier payments and customer-facing support in that rough order; reconciliations, reporting packs, master data maintenance and process improvement work behind them. Deciding what degrades is a management act. Letting it be decided by whichever queue collapses first is not.
Practical Guidance for Provider Resilience Review
- Get a daily operating report by process, with headcount and location. Percentage of normal capacity, what is running, what is queued, what has stopped. Written, dated, from a named person.
- Document every control relaxation as a temporary derogation with an end date. Device rules, access restrictions, supervision, recording. Your auditors will ask next year and memory will not be evidence.
- Approve home working explicitly, with conditions, rather than tolerating it. Device, network, access scope, storage, printing, phones, supervision, logging. Silence will be read as consent anyway.
- Check the sub-contracting and sub-processor position in writing. Work quietly relocated to maintain service levels is the single most common source of downstream regulatory exposure.
- Triage your processes and agree the degradation order with the provider. Name what stops. Unstated priorities become the provider's priorities.
- Suspend service credit disputes and convert them into recovery commitments. Penalties extracted this quarter buy you nothing; capacity commitments and priority for your queue when staff return are worth considerably more.
- Take copies of what you would need to run the process yourself. Procedure documents, access lists, open item reports, reconciliation working papers, the queue. If the provider's situation deteriorates, this is the difference between a hard month and a lost quarter.
- Write next year's continuity requirement now, while the failure is visible. Correlated-event scenarios, tested home-working capability, defined minimum service levels, and evidence obligations rather than plan documents.
The Regional Angle
Four local factors affect Gulf organisations differently, whether they buy offshore delivery or run their own shared services here. The first is licensing. A provider operating from a free zone is licensed to conduct its activity from premises inside that zone, and the question of whether its employees may process client work from residences elsewhere is a licensing question before it is a security one. The same applies to captive shared service centres established under a specific activity and premises. Nobody wants this conversation in the middle of a crisis, but a written acknowledgement from the zone authority, or at minimum a documented internal decision recording the basis on which the change was made, is worth having on file. Concessions granted informally now will be examined formally later. The second is transport and shift logistics. In-region operations centres are staffed substantially by employees who live in company accommodation and arrive by company bus on a shift pattern. That arrangement is efficient and highly concentrated: one route suspended, one building restricted, one driver unavailable, and a shift does not start. Where movement permits are required for essential staff, they are issued to named individuals, so the permit list becomes a capacity plan. Build it deliberately, including supervisors and the people who hold the keys. The third is that a visa-bound workforce cannot be flexed the way the continuity plan imagines. You cannot hire forty temporary agents locally next week, because employment here runs through sponsorship, medicals and permits that take weeks in normal conditions and are currently slower. Surge capacity in this market is a contractual arrangement with another organisation, not a recruitment exercise, and it has to be in place before you need it. The fourth is paper, which remains embedded in regional back-office work in ways that offshore-delivery discussions ignore. Original invoices, stamped delivery notes, cheques, bank correspondence, passports and personnel files sit in an office. Mail arrives at a post office box that somebody physically collects. Customs and bank documents move by courier and must be signed for. Any process with a physical document in its path cannot go home, and the honest answer is to identify those processes now, batch them, and assign one authorised person with a permit to handle the collection run twice a week rather than pretending the workflow is digital.
The objection worth taking seriously
The strongest defence of the providers is that no reasonable continuity plan could have covered this. Resilience planning is an exercise in bounded scenarios, and the bound is set by what a buyer will pay for. Buyers have spent a decade selecting providers on price per transaction, declining to fund tested home-working capability, and insisting on physical security controls that made distributed operation impossible. Turning on those providers now, service credits in hand, is both unfair and strategically foolish: the organisations that will be served best in the coming months are the ones their providers choose to protect. The second objection runs the other way, and buyers should sit with it. The rush to permit home working is creating real exposure. Client data on unmanaged devices, screen captures on personal phones, family members within earshot of recorded calls, identity documents visible on a kitchen table. The buyer who demands continuity at any cost this month will be the same buyer whose regulator asks, next year, on what basis card data was processed from an unassessed residence. The provider will produce the email in which you insisted. The resolution is not a middle path between the two; it is documentation. Decide what you are prepared to permit, write it down with conditions and an end date, accept the degradation you are not prepared to permit, and keep the record. Both objections describe what happens when decisions are made by pressure rather than by choice, and the defence against that is a dated file rather than a firmer tone on a conference call.
Common Questions
Should we enforce service level penalties this quarter?
Generally no. Convert them into recovery commitments, priority capacity and credits against future work. Extracting penalties from a provider in distress reduces the capacity available to you.
Can we move work back in-house quickly?
Rarely at scale, and never for a process you do not have documented. What is achievable is taking back the two or three most critical processes if you hold the procedures, the access and the open items. That is the case for collecting them now.
Is home working acceptable for regulated processes?
Sometimes, with compensating controls, notification where required, and documentation. The answer depends on your sector rules and your own client contracts, not on the provider's willingness.
What should we expect over the next twelve months?
Expect distributed delivery to work better than anyone currently believes, and for that to become a permanent negotiating point about cost and location. Expect security and audit teams to spend the second half of the year reconstructing what was permitted in March. Expect the next generation of outsourcing contracts to specify tested remote capability and correlated-event scenarios rather than a plan document. And expect the providers who communicated precisely this month, with numbers rather than reassurance, to win the renewals.
Provider Resilience Review — we establish who is really doing your work, from where, under what controls, and turn this month's improvisation into a documented position you can defend next year.