CRISC · Question #166
An organization has asked an IT risk practitioner to conduct an operational risk assessment on an initiative to outsource the organization's customer service operations overseas. Which of the…
The correct answer is C. Cross-border information transfer restrictions in the outsourcing country. Cross-border information transfer restrictions in the outsourcing country would most significantly impact management's decision because they could legally prohibit or severely limit the ability to process or store customer data as required. This legal constraint directly…
Question
An organization has asked an IT risk practitioner to conduct an operational risk assessment on an initiative to outsource the organization's customer service operations overseas. Which of the following would MOST significantly impact management's decision?
Options
- ATime zone difference of the outsourcing location
- BOngoing financial viability of the outsourcing company
- CCross-border information transfer restrictions in the outsourcing country
- DHistorical network latency between the organization and outsourcing location
How the community answered
(63 responses)- A19% (12)
- B5% (3)
- C65% (41)
- D11% (7)
Why each option
Cross-border information transfer restrictions in the outsourcing country would most significantly impact management's decision because they could legally prohibit or severely limit the ability to process or store customer data as required. This legal constraint directly jeopardizes the core purpose of outsourcing customer service operations, which often involves handling sensitive customer information.
Time zone differences impact operational efficiency and scheduling but are generally manageable through workforce planning and do not present a fundamental barrier to the outsourcing initiative itself.
The ongoing financial viability of the outsourcing company is a significant business risk, but typically manageable through due diligence, contractual agreements, and monitoring, whereas legal restrictions can be an insurmountable barrier.
Cross-border information transfer restrictions (e.g., data residency laws, GDPR-like regulations in other countries) can legally prohibit or severely complicate the outsourcing of customer service operations that handle sensitive customer data. This legal and compliance risk can make the entire outsourcing initiative unfeasible or expose the organization to significant penalties, thus most significantly impacting management's decision.
Historical network latency affects service quality and response times but can often be mitigated through technical solutions or optimized processes; it doesn't pose a fundamental legal or operational blocker like data transfer restrictions.
Concept tested: Legal and regulatory risk in outsourcing
Source: https://learn.microsoft.com/en-us/compliance/regulatory/gdpr
Topics
Community Discussion
No community discussion yet for this question.