Outsourcing and Glass Houses

by David Constant

Much attention has been paid to models such as the Capability Maturity Model for Software (SW-CMM^®, or the Capability Maturity Model for Integration, CMMI^®) from the Software Engineering Institute (SEI) to manage the risks involved in outsourcing IT development or operations. The focus has been on supplier selection, contractual terms, penalties, acceptance criteria, arbitration mechanisms, and so on. The CMMI has process areas (e.g., supplier agreement management), model versions (e.g., supplier sourcing), and modules (e.g., acquisition) that provide guidance in addressing these issues. In fact, many customers won't consider using a supplier that hasn't achieved CMM Level 2 or 3. This is all well and good, and customers must indeed pay attention to managing the risks presented by potential and contracted suppliers. But what about the outsourcing risk that the customer's own organization poses?