Limitation of liability clauses are probably the most extensively negotiated element of risk retention by customers. To the extent that a cap on liability prevents the customer from recovering financial compensation, the customer carries the excess responsibility. The most common forms of limitation structure:

Customers negotiating a higher limit on liability and expanding the classes of uncapped liability therefore reduce the retained financial risks. In most cases, liability issues are non-structural in the sense that there is no correlation between the operational effectiveness of the outsourcing arrangements and an increased limit of liability. At any given price point a higher limit will always be better for the customer. However, a proper mitigation strategy should include a consideration of the risks of different types of potential losses and the relative positioning of the contract relative to the supplier's other arrangements. In particular:

On the same principles as above, exclusions of liability by a supplier (for example in relation to consequential loss) represent risks retained by the supplier. Again, a customer should give careful consideration to the types of risks inherent in the specifics of a project against the proposed exclusions in the contract. For example, while it is relatively common to see exclusions of liability for loss of data on many outsourcing projects, an attempt to include such a provision in a cloud data storage services contract may be met with considerably less enthusiasm. Exclusions of liability have a different effect on the retained risk profile than limits on liability in that they apply from the start of the relevant breach rather than requiring thought about the cumulative effect of breaches based on the likely frequency and distribution of different severities of incidents.

For obvious reasons suppliers are usually more flexible in relation to accepting additional categories of loss which will fall within any cap on liability than they are in accepting any additional uncapped liabilities. Customers should be wary of taking a "one size fits all" approach to exclusions as the precedent set by one project may be completely inappropriate to another set of outsourced services.

Ensuring a co-ordinated approach between the exclusions of liability and the customer's insurance cover is important. However, there is often a significant mismatch between the term of the outsourcing arrangement and the term for which insurance is readily available on fixed terms, so this should not be regarded as a complete solution.

It is also vital for a buyer of outsourcing services to understand what will and will not be recoverable as a matter of general law. Particularly common misconceptions about the extent of retained risks often arise from:

Therefore, if a customer identifies a risk that it wishes to give the supplier financial responsibility for, but which would be difficult or impossible to establish at common law (whether as a source or compensation or simply as a driver for supplier behaviour), it should consider an appropriate indemnity and the relationship of that indemnity to the limitations and exclusions of liability.

Even if the probable worst-case scenario for a failure of the outsourced services will not result in a complete failure of the customer's business, a customer will almost always potentially suffer damage to its reputation. The fact that the supplier's brand may suffer alongside the customer's may drive the supplier's behaviour to avoid failures but will do nothing to protect the value of the customer's brand in the event that something does go wrong. Given the value of reputation and brand to many business activities, it is arguably surprising that one of the most common types of loss to see excluded are those relating to loss of reputation and goodwill. The question of liability for reputational damage is likely to have an increasing profile in outsourcing negotiations following the case of GB Gas Holdings Limited v Accenture (UK) Limited [2010] EWCA Civ 912, which concerned the development of new billing systems that were intended to improve customer relations and customer service. When the systems failed the court was willing to accept that the supplier should be responsible for the ex gratia compensation paid to clients of the customer in an attempt to restore goodwill.

The impact of an outsourcing failure on a customer's brand is generally a structural issue. The more direct, extensive and externally visible the impact of an outsourcing failure on the customer's external operations, the more serious the brand damage is likely to be. Many organisations have shied away from outsourcing directly consumer-facing elements of their business in recognition of their retained risks of reputational damage. However, such a restrictive strategy also has the potential to significantly limit the potential benefits which outsourcing can bring to an organisation, particularly where there may be good commercial reasons to believe that the customer-facing functions would perform better if they were outsourced.

Whatever deal a customer can negotiate in relation to compensation provisions will always be subject to the supplier's ability to fund that compensation. Supplier solvency can have a major impact on the ability of the supplier to provide the services at all but the retained risks are worthy of consideration in their own right (see below, New risks; Supplier solvency). Indeed, from a customer perspective one of the few consolations about the traditional negotiated showdown to secure an adequate limit of liability is that it shows a level of supplier prudence about exposure and solvency across its business. A glance of the volatility of credit ratings for major suppliers will clearly demonstrate how difficult it can be to confidently predict the financial strength of any organisation over the full term of a major project.

Mitigation strategies for solvency concerns have probably been the subject of more consideration in recent times than any other topic in the field. It is beyond the scope of this article to examine all of them in detail but consideration should be given to:

Perhaps the most obvious form of retained risk arises from service descriptions which describe only the process to be followed rather than the end result to be achieved (for example, a reasonable or best endeavours obligation to seek to attain a particular goal). Such service descriptions obviously have their place and almost always represent the conscious and considered choice of the parties as to where to draw the service boundary. However, it is all too frequent to see insufficient investment being placed in the service descriptions such that items are inadvertently missed.

It can be tempting for customers to avoid omissions by using "sweepers" of part of the statements of work, for example requiring that the supplier undertake:

Such constructs can have their place in an arrangement to ensure that a full service is provided but in practice this can come at a high price of creating uncertainty, perpetuating redundant business process steps and stifling innovation. A proper investment in the statement of work is always preferable, despite the fact that this can sometimes be a time consuming and tedious task. If the timescales and resources of the project really do not allow this then in some cases it may be possible to include a process for the ancillary activities to be documented and reviewed after the contract award with appropriate revisions to the resourcing and payment models.

Generally, obligations to comply with regulations cannot be outsourced but the activities which underlie them can be. For example, in relation to the financial services sector, the FSA requires regulated firms to notify it before entering into material outsourcing arrangements (FSA Handbook, Supervisory Provision 15.3.8g(1)(e)) and stresses that firms cannot contract out of their regulatory obligations (FSA Handbook, Senior Management Arrangements, Systems and Controls (SYSC) 3.2.4G(1)).

Since the customer necessarily retains certain regulatory compliance risks, mitigation strategies must focus on structuring any outsourcing in a way that provides the customer with maximum assurance that any relevant regulations will be complied with by the supplier. In particular this may involve:

If the customer insists on controlling the way in which services are delivered as well as the ends which they are to be attained, the supplier is unlikely to be able to deliver much in the way of enhanced value (whether that is measured in price, better delivery capability, improved output service capability or quality, or otherwise). However there are two distinct strands of risk which may follow from a transfer of control:

The transfer of control to a supplier should not be treated as an all or nothing proposition. An appropriate mix of freedoms and safeguards can be designed for each project based on the stability of the operations which are outsourced and the need and likelihood for major change. A detailed discussion of those checks and balances is beyond the scope of this article but may include:

In entering into an outsourcing arrangement the customer will transfer or otherwise lose its in-house capabilities. A customer must consider whether this exposes it to the risk of being unable to re-acquire that capability within a required timescale. In particular:

There is no substitute for a well-designed exit plan that takes account of the specific characteristics and circumstances of the services and the means by which the supplier will deliver them. The operational detail of the plan is highly likely to evolve gradually alongside the services but the broad assumptions underlying the design of the exit plan (for example whether the services may be provided using shared facilities) must themselves be protected from unilateral change by the supplier. Arrangements where the workload can be rapidly switched between completely independent suppliers (as might be the case for a retailer's payment card acquisition function for example) provide excellent protection but often the nature of the outsourced services means that a parallel supply arrangement is not viable or cost effective.

In addition to the impact of supplier solvency on the customer's retention of risk (see above, Retained risks; Supplier solvency) solvency concerns represent an additional risk as an insolvent supplier is unlikely to be able to provide the service. The administrator of an insolvent company also has the power to escape from onerous contractual commitments. However, an administrator will usually try to sell an outsourcing business as a going concern and so such powers would not be used against a customer lightly. Nonetheless, customers should consider where they would stand if the administrator exercised its power to disclaim responsibilities in relation to the exit provisions of a contract.

The additional delivery risks which would arise from a supplier insolvency are substantially the same as those discussed above, that is, providing assurance of continuity of supply and due performance (for example a parent company guarantee) and ensuring that the services can readily be moved elsewhere. Where possible within the context of an exit strategy, customers should consider where exposure to contract disclaimer by an administrator can be reduced. For example, there is all the difference in the world between a contract which:

Outsourcing a function can be extremely useful to bring a customer up to the then applicable market standard in a shorter time than they would have been able to manage themselves. However, it is also likely to sacrifice any element of market leadership in relation to that function. Clearly the risk is most acute where the supplier will provide the outsourced services on a leveraged basis since, by definition, the same solution will be made available to others to the same quality and, often, for the same price. Where the solution is not provided on a leveraged basis, there is nonetheless a risk that any competitive advantages which the customer enjoys on day one will be:

The best protection against loss of competitive advantage in this way is to outsource only "commodity" functions rather than those which are of strategic importance to the customer or those which (while not necessarily central) provide a competitive advantage. However, failing this, customers may consider including provisions in the outsourcing arrangement, such as:

By entering into an outsourcing arrangement the customer may expose itself to a new set of potential contractual and legal liabilities. In particular:

Apart from those arising in relation to intellectual property, the customer's liabilities to the supplier and third parties tend to be ones created by the contract and therefore can be mitigated by appropriate negotiation and risk management.