What to Outsource and What to Keep: A Decision Framework

Most outsourcing decisions start with a cost figure and end with a contract. The better order is the reverse. Decide which work you will never hand over. Then decide which work a specialist does better than you do. This article gives COOs and finance directors a five-question test that sorts any operational function into move, keep or split. It also sets out what Saudi data law says you cannot delegate, whatever the contract says.

Why is 'core versus non-core' not enough?

The usual advice is short. Keep what makes you different. Hand over the rest. One common version of the test weighs two things: competitive differentiation and the availability of world-class sourcing options. That is a sound start, but it has a gap.

Some non-core work is still critical. Month-end close does not set you apart from competitors. A failed close still stops the business. Some work that looks routine also carries a legal duty that stays with you after you sign. Two boxes are not enough. You need a test that asks about accountability and control, not only strategy.

What is the five-question test?

Run each function through five questions. Answer yes or no. Do it with the function head and a finance owner in the same room.

Then apply the scoring rule below the list.

1. 1. Differentiation. If a competitor ran this function for you, would you lose an edge your customers pay for? Pricing logic, product design and key-account relationships usually answer yes.
2. 2. Accountability. If it fails, who answers to the regulator, the auditor or the board? If the answer is you, whatever the contract says, the decision and sign-off stay with you. The work itself may still move.
3. 3. Repeatability. Is the work high in volume, rule-based and countable? Counts, matching, validation and data entry are. Judgement calls are not.
4. 4. Market. Do providers exist who run this at your scale, at better quality or lower cost than your own team? If only one or two do, the saving is weaker than the pitch suggests.
5. 5. Measurability. Can you write a service level and check it without the provider's help? If you cannot count the output yourself, you cannot manage the contract.

How do you score the answers?

A yes on question 1 means keep. Stop there.

A yes on question 2 means keep the decision and the sign-off. Execution is still open for discussion.

If questions 3, 4 and 5 are all yes, the function is a move candidate. Two out of three means pilot it or split it. A no on question 5 means fix the measurement first. Come back to the outsourcing decision after that.

Do not skip question 5. Most failed arrangements fail there. Nobody can say what good looks like, so nobody can say when the provider is falling short.

What can't you hand over under Saudi data law?

Take personal data. SDAIA's guide to the PDPL describes a processor as an entity that processes personal data on behalf of a controller. It also says the controller is held ultimately accountable for the processing and has a larger set of obligations than the processor.

Article 8 of the Law is specific. The controller may only select processors that provide the necessary guarantees, must monitor their compliance, and keeps its responsibilities towards the data subject and the competent authority. Hiring a processor moves the work. It does not move the answerability.

Breach reporting works the same way. Article 24 of the Implementing Regulations says the controller must notify the competent authority within 72 hours of becoming aware of an incident that potentially causes harm. In practice, your provider's reporting time to you has to be much shorter than 72 hours. Ask your counsel how the clock runs when the provider finds the incident first, then write the answer into the contract.

Apply this to question 2. Any function that touches HR files, customer records or scanned documents scores a yes. You can still move the work. You cannot move the accountability. This article informs; it is not legal advice.

What usually moves to a managed provider?

Functions with a yes on questions 3 to 5 and a no on question 1 share a shape. They are high in volume, governed by fixed rules, and they peak at certain times of year. In our work they look like this.

1. Fixed asset counts and register reconciliation. Tagging, physical verification and matching to the ledger are countable. Finance keeps the capitalisation policy and write-off approval.
2. Inventory counts and operational support. Cycle counts and stock checks across sites produce a number you can audit. Operations keeps replenishment rules and signs off variances.
3. Document validation. Checking documents against set criteria at volume is rule-based and easy to sample. You keep the acceptance criteria and the call on exceptions.
4. Back-office BPO. Data entry, processing queues and routine reconciliations can run against a service level. You keep the process owner.
5. Specialist advice such as PDPL consultation. The need comes in bursts and the skills are scarce. You keep the controller decisions.

What should stay in-house?

Five things stay with you, even in a heavily outsourced model.

1. Strategy and pricing. These are the question 1 functions. They are why customers choose you.
2. Policy and approval authority. Who may write off an asset, release a payment or accept an exception is your decision. A provider executes the rule. It does not write it.
3. Vendor management. BCG's work on IT outsourcing names a lack of necessary capabilities in the retained organisation as a particularly critical factor. The same logic applies to operations. Someone inside must own the provider relationship and read the reports.
4. Controller decisions and regulator contact. Why personal data is processed, and how, is your call. So is the conversation with the authority.
5. Knowledge of how the work is done. If nobody inside can describe the process, you cannot audit it, replace the provider or bring it back.

When should you split a function instead?

Most functions are not all-or-nothing. Split when question 2 is yes and questions 3 to 5 are also yes. You keep the decision and the sign-off. The provider does the execution and reports against a service level.

McKinsey's work on indirect procurement shows both directions. An organisation can outsource a process for short-term benefits while it builds in-house capabilities. Organisations that already act on commercial and demand levers can handle the category internally. It also notes that some choices, such as the logistics partner, may be too critical to leave to a sourcing provider.

Treat the decision as reversible. Deloitte's 2024 survey describes a balanced approach that combines outsourcing, insourcing and captive centres for strategic flexibility. It also reports that skilled talent and agility now sit alongside cost reduction as key drivers for outsourcing. A function you score as 'move' today can score differently in two years.

How do you run the test in a week?

You do not need a consultancy project. You need a list, five questions and a decision.

• Day 1: List. One line per operational function. Add the owner, headcount, annual cost and whether personal data is involved.
• Days 2 and 3: Score. Run the five questions with the function head and a finance owner. Record the reason for each answer, not only yes or no.
• Day 4: Sort. Place each function in move, keep or split. Challenge any function where the owner wants a keep without a question 1 or question 2 reason.
• Day 5: Choose one pilot. Pick a function with clear numbers and low accountability risk. Do not start with the most painful one.
• Before signing: Write the controls. Define the service level, the reporting cadence, the audit right and the exit terms. Gartner research on IT service deals notes that buyers regularly omit detailed governance terms from outsourcing contracts, which leads to poor decisions. Review the pilot after one full cycle, such as a quarter-end.

Which mistakes show up most often?

Four mistakes repeat. Teams outsource a broken process and expect the provider to fix it. They buy on price alone and skip question 5. They move the work and the owner together, so nobody inside can challenge the provider. They sign without exit terms.

Each one is a failure of the retained organisation, not of the provider. Run the test first and name the retained owner before you name the vendor.

Frequently asked questions

Back to articles