All for One and One for All

Like any outsourcing model, co-sourcing will work only if the client and vendor both get something out of the relationship, says CISR's Ross. The vendor gets the benefit of developing industry- and application-specific skills by working on the client's project, while the client reaps the vendor's technology expertise at low costs. But a real co-sourcing alliance goes a step further, sharing project risk as well.

Guy de Poerck, CIO of the International Finance Corp. (IFC), an arm of the World Bank that promotes private-sector investment, views that concept of shared risk as critical to the application development and maintenance work it sends to its partners in India. IFC has been using Satyam Computer Systems for application development work for just 18 months, but it has quickly moved from paying for the work on a cost-and-materials basis to a fixed-cost model. Client and vendor decide ahead of time how much money will be spent on all application-related work.

To do so, de Poerck must be completely open with Satyam. He shares IFC's IT and business plans so that the outsourcer can determine what resources will be required to support IFC's ongoing projects. And Satyam must stick to the initial budget (unless the scope of a project changes) if it wants to profit from the relationship. "It's a true sharing of risk," says de Poerck. "You can't approach this like you're buying a commodity and saying: 'Here are my operations - do a survey and make me a deal.' With co-sourcing you have to engage with each other at a really detailed level."

But it wasn't easy for IFC to get to that point. De Poerck began working with Satyam in early 2004 on a pilot project, paying for time and materials. But to truly share risk and management, de Poerck realized that his department would have to gain a better understanding of its processes than it had at the outset. "You need to know exactly what all your processes are and what your service levels are and have that documentation ready," says de Poerck. "Very often you will find that you don't. But co-sourcing is a fantastic way to force yourself to do that and raise the [service] level of your own IT department."

Another important ingredient in the co-sourcing equation is the level of trust and openness required. IFC insists on having "100 percent visibility" into who Satyam puts on its projects, says IFC's information officer and offshore manager, Zafar Azhar, who reports to de Poerck. One reason is that IFC has opened its network to Satyam. "We treat the development centre at Satyam in Chennai the same way that we treat all of IFC's other 105 country offices around the world," says Azhar. "We do the same checks on [the employees] and ask for their passports, which starts a process to do background checks."

A major risk with co-sourcing alliances, according to Ross, is an imbalance of inputs between client and vendor. If a CIO relies too much on the outsourcer's technical prowess, his staff may lack the knowledge to use the applications effectively. Conversely, if a vendor spends too much effort imparting its software development or project knowledge to the client, it could, in essence, share itself right out of a contract.

That Side's Yours and This Side's Mine

The mechanism for co-sourcing success - a true sense of partnership - can also be its downfall. Boundaries between the two sides can become blurred. It's often difficult to tell exactly what the client is contributing and what the vendor is providing, says Ross, and that can lead to problems. CIOs who succeed at these relationships seek to define the separate contributions of client and vendor - even down to individual responsibilities - without detracting from the collaborative nature of co-sourcing.

Omgeo, a software provider for the securities trading industry, began co-sourcing with Indian company Patni last year. The arrangement has worked so well that Omgeo MD Michael Agnew refers to Patni as "the development, QA and testing unit" of Omgeo. Yet he has been careful to specify who does what. "It's part of our project charter process to set and write up all roles and responsibilities up front," says Agnew. "We understand what all the accountabilities are by function, by project and by individual." But simply saying who's responsible for what isn't enough. "The lesson I've learned with any partner is that being very formal in the communication process and setting expectations clearly up front is paramount to success," says Agnew. "All throughout the project life cycle, it should be clear who's handling what."

At the highest level, there's an Omgeo global sourcing director who oversees all outsourcing and monitors all metrics from cost to performance to headcount. There are also Omgeo project managers who direct development teams and work with the vendor's project manager. Three Omgeo managers are responsible for working with Patni's quality assurance team in Mumbai. And most importantly, there's the Omgeo program manager for Patni who deals directly with Patni's equally important relationship manager for Omgeo.

Mary Lacity, professor of information systems at the University of Missouri, says having the right people in the relationship management roles is a make-or-break proposition for a co-sourcing alliance. "If you get the two primary point people right - the alliance managers for customer and supplier - you'll be fine," she says. "It's hard to find the right people. But if those two people can be completely frank, be completely honest about the people in their own organization rather than necessarily protect them, and even share financial information - 'This is what my margins are, and this is what I can do' - then it works."