IT service providers can reduce operational demands, bring specialized capabilities, and free internal teams to focus on business priorities. Realizing those benefits requires discipline throughout the relationship: a clear business justification, a proportionate provider assessment, defined contractual commitments, and ongoing accountability.
1. Business justification: define the need
Before approaching providers or introducing another application, platform, or security tool, establish what the organization needs to achieve.
What problem are we solving? Which functions will the service perform? Are those capabilities already available internally or through an existing provider? Would replacing or complementing them improve performance, reduce risk, or address a specific gap?
The business case should explain the expected benefits, alignment with organizational priorities, and how success will be measured. If the proposal replaces an existing service, identify the root causes of current problems. A new provider will not necessarily resolve weaknesses in internal processes or ownership.
2. Provider assessment: evaluate fit, cost, and risk
The depth of assessment should reflect the service’s criticality, data sensitivity, and operational impact. Focus on:
Functional and technical fit. Confirm that the service meets business requirements and works with the existing IT environment. Assess usability, integration, configuration, and any customization required.
Total cost and expected benefits. Include implementation, migration, training, licensing, support, and exit costs. Compare competitive proposals where feasible and consider both financial and non-financial benefits.
Security, privacy, and resilience. Assess access controls, data protection, incident response, recovery capabilities, and relevant legal or regulatory requirements. Identify where data will be stored, processed, and accessed, including through subcontractors. Review applicable assurance evidence, such as a SOC 2 Type II report, including its scope, findings, and customer responsibilities.
Provider capability and continuity. Evaluate delivery capacity, support arrangements, financial stability, and the technology’s support lifecycle. For AI-enabled services, also examine model retirement policies, migration support, and whether organizational data may be used for training.
Document material risks, required safeguards, and whether the remaining exposure is within the organization’s risk tolerance.
3. Contractual commitments: make expectations measurable
Translate the agreed requirements into a clear scope, acceptance criteria, responsibilities, and contractual commitments.
Service level agreements should specify performance targets, measurement methods, reporting, escalation procedures, and remedies. Availability commitments should clearly identify exclusions and how service credits are claimed.
For business-critical services, define recovery requirements:
Recovery Point Objective (RPO): the maximum acceptable data loss measured in time.
Recovery Time Objective (RTO): the target time for restoring service following a disruption.
Confirm that the provider’s commitments support those requirements and identify any recovery responsibilities retained internally. An uptime percentage alone does not establish restoration time or potential data loss.
Address permitted data use, incident notification, subcontractor arrangements, relevant jurisdictions, and assurance rights. For AI-enabled services, clarify rights and obligations concerning inputs, outputs, fine-tuning data, and embeddings.
Agree on exit arrangements before signing, including data export, transition assistance, access revocation, retention and deletion, and associated costs.
4. Ongoing accountability: assign ownership and verify outcomes
Name one internal owner accountable for the engagement’s business outcomes, supported by IT, security, legal, procurement, and finance.
During onboarding, verify that access, integrations, responsibilities, and support procedures are established. Throughout the relationship, review performance against agreed measures at a frequency proportionate to risk and criticality. Track incidents, costs, unresolved issues, and material changes to the service or its subcontractors.
Renewal should be an evidence-based decision: Is the service delivering the expected value? Are risks still acceptable? Does the arrangement continue to meet business needs?
Working with third parties extends the organization’s capabilities; accountability remains internal. The value of the relationship depends on how clearly the organization defines its needs, evaluates its options, establishes commitments, and follows through.
Looking to strengthen your IT governance, third-party risk management, or assurance? Let’s discuss.
