3 Third question: the implementation by the outsourcing organisation

The outsourcing rules are essentially a standard of due care. They requirean approach proportional to the risks associated with outsourcing. It istherefore not possible to indicate what concrete measures an outsourcershould take. Sometimes, sectoral regulations include concrete, precise rules.It is not sufficient, however, for an outsourcing company to tick off suchdetailed sectoral regulations. There is no sectoral regulation that containsprecise rules on every aspect of any outsourcing. In the end, what countsis that risks are identified and adequately addressed. This may take morefar-reaching measures than have been detailed in a specific (or even other)sectoral regulation.

In this study, numerous measures that a company can take tomanagethe risks associated with outsourcing are systematically brought to light.Those suggestions should (certainly) not always be followed. The measurestaken must be proportionate to the risks. The matter always comes down tothe question whether the set of taken measures is sufficient to adequatelycontrol the risks associated with the outsourcing at hand. Thus, a limitedpower to issue instructions may be quite acceptable when a terminationarrangement is included in the agreement that allows the outsourcer toterminate anytime without costs. (Of course, this would require that theactivities can actually be handed over to a successive service provider withina short time). Also, a limitation of liability in favour of the service providermay be fair, provided that sufficient incentive remains for the serviceprovider perform to the best of its abilities.