{'fraction_non_alphanumeric': 0.02456782764199949, 'fraction_numerical': 0.013241931363365409, 'mean_word_length': 5.340982721382289, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 3, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Exploring Practitioner Perspectives of Sourcing Risks: Towards the Development of an Integrated Risk and Control Framework

Outsourcing of information and communication technologies (ICT) and related services is an established and growing industry. Recent trends, such as the move toward multi-sourcing have increased the complexity and risk of these outsourcing arrangements. There is a critical research need to identify the risks faced by both the organisations that outsource ICT and the vendors that provide it in this changing landscape. To address growing concerns regarding the best way to deal with risk and control in this environment, our research focuses on establishing a Sourcing Risk and Control Framework to assist organisations identify these risks and develop effective mitigation strategies. In this paper we report on the first stage of our research that sought to document how sourcing risk is represented and considered in practice. To date, limited empirical research has been conducted in an Australian context. Using a series of workshops involving client and vendor representatives, we identified a broad range of risks and developed a cohesive categorisation scheme that incorporates functional and multi-stakeholder perspectives.


Introduction -The Business and Research Imperative
The management of sourcing risks, and their various guises, has been a focal area of research in the information systems (IS) field for close to two decades (eg. Earl 1996;Willcocks et al. 1999;Warkentin and Adams 2007;Herath and Kishore 2009;Yim 2014). Gonzalez et al. (2013) argue that within the outsourcing domain, risk is second only to success in terms of importance. While sourcing risk has been extensively researched, it remains a theoretical and practical challenge, especially given the variation in risks due to differences in the scope of services sourced (Jain and Thietart 2013) and the increasing challenge of integrating services across multiple service providers (Deloitte 2013a;ISACA 2014). Recent technological developments such as cloud computing, and broadband and mobile technologies have revealed a dynamic and inter-dependent nature of risks, particularly in operational security risks (Rocco Grillo cited in Protiviti 2014), that is yet to be fully understood. Bunker et al. 2015, Adelaide, South Australia Sourcing Risks Control Framework As the "scope, scale and complexity of vendor relationships and services increase," (ISACA 2014, p.9), the effective identification of sourcing risks, their management and implementation of cost effective controls is paramount to organisational productivity, performance, growth and sustainability. Yet, recent industry surveys reveal that organisations are failing to adequately address these risks and lack the necessary capabilities to manage them effectively (Protiviti 2014). In addition, as global sourcing expands, so do the types of sourcing models and standards/regulations that guide these practices (e.g. Sandeep et al. 2013). These issues focus attention on the need for developing new approaches and a comprehensive risk management strategy to effectively manage these risks at a practical (e.g. Deloitte 2013b; ISACA 2014; Protiviti 2014) and theoretical level (e.g. Lacity et al. 2010;Mathew 2011).
In response to these challenges we have developed a major research project with the aim of developing an innovative and integrated framework that can support business to effectively conduct sourcing risk assessments and implement appropriate mitigation strategies. Concurrently, the research team is also developing an ontological representation of this framework with the objective of creating an interactive website to facilitate and incorporate ongoing input to the framework on both a local and global scale.
Overall our project has three objectives: 1) understanding the implications for the design and use of such a framework in organisations; 2) making the framework part of current sourcing risk identification and management practices of an organisation; and 3) developing an understanding of sourcing risk in an Australian context. We seek to address issues such as: critical uncertainties of sourcing arrangements; the power imbalance between supplier and customer; complex compliance and standards; the nature of the supplier and customer organisation and its effect on sourcing arrangements; the nature of the sourcing transaction; and leverage and negotiation mechanisms.
There are four stages to this research program, which we outline in section two. The aim of this paper is to report on the first piece of work from Stage 1, which is designed to address the following question: "How do organisations identify and classify risks in their sourcing arrangements and collaborations?" The structure of the paper is as follows. Firstly, we provide background information about the research project. We then follow this discussion with the literature review. The third section outlines the overall project methodology and workshop format for Stage 1. This is followed by the preliminary risk classification arising from the workshops. Next the implications from the first stage of our research are discussed, followed by the conclusion and future directions for our research project.

Research Background
The overall objective of the project is to develop a new and innovative framework which can be applied by all parties to a sourcing transaction (supplier and customer) to 1) decrease the rate of failure of sourcing arrangements by ensuring that the most cost effective controls are implemented and used, and 2) decrease the transaction costs for sourcing by limiting the use of inappropriate or ineffective controls and by encouraging the selection of controls that are appropriate and effective. When established, the Sourcing Risk and Control Framework could be used for further research into novel control strategies including (but not limited to) incomplete contracts as well as strategies based on enhancing social interactions between suppliers and purchasers.

Project Background
In order to develop a Risk Management and Control Framework, a number of workshops with a crosssection of industry participants were conducted. The objectives of the workshop were to determine: • how practitioners identify and manage risk complexity through their patterns of control within their sourcing arrangements; and • the technical, social and institutional influences embedded in their risk perceptions.
Having developed the framework we would then test and continually improve it through a series of continuous case studies of organisations in different industrial settings as well as through the development of an interactive website to facilitate and incorporate ongoing input to the framework. We would do this in order to produce findings based on the identification of overall patterns or individual approaches to the topic and highlight the implications for ICT sourcing arrangements and collaborations from a risk management perspective.
• Develop meta-level learning across organisations, which has the potential to reduce the impact and cost of sourcing risks; • Encourage academic and industry information sharing about ICT sourcing risk identification, to facilitate learning; and • Develop a risk classification as a basis for the long-term development of a Sourcing Risk and Control Framework.
Upon the completion of Stage 2 of the project (as outlined above), our framework will also include the development of risk controls that should be applied to sourcing risks, the overall objectives of these controls, as well as the perceived effectiveness of such controls in different sourcing situations.

Literature Review
Failure to effectively manage issues/factors such as the identification of appropriate providers, the identification of clear outsourcing objectives understood by all stakeholders, provider attention to client problems, frequent provider/client contact, value for money arrangements, top management support, and appropriate contract structures, present risks to a sourcing arrangement (Gonzales et al. 2008, Hirschheim 2009, Goo et al. 2009, Lacity et al. 2010, Gonzalez et al 2013 Willcocks et al. (1999) and is of increasing significance given the geographical dispersion of sourcing arrangements and possible risk exposures.
The increasing inter-connected nature of sourcing risks requires an inter-disciplinary and multistakeholder view to bring together the different perceptions and approaches that can be employed in risk management. Limited attention has been directed towards exploring: the relationship of these risk factors to one another and their prioritisation (Gandhi et al 2012); the type of controls that need to be put in place to mitigate the risk to an organisation's sourcing arrangements (Wullenweber et al. 2008;Mathew 2011); or how to measure the effectiveness of these controls. In addition, there have been calls for more "holistic and rich theoretical perspectives" to be used in the sourcing domain (Fregtag et al. 2012). Theories such as transaction cost theory, agency theory and resource-based theory have been dominant in explaining sourcing motivations and risks (see Appendix A in Gonzalez 2010). Whilst useful, these theories provide limited insight into risk perceptions influenced by cultural, sociopolitical, and cognitive factors such as past experiences (see for e.g. Gorla and Lau 2010). Perceptions of risks from multiple stakeholder groups, in different industry and national contexts are critical in informing empirical research and may provide insights for practitioners to understand 'each others' perceptions of risk.

Project Methodology
The project utilizes and applies a proven methodological approach (stakeholder workshops from a Discovery perspective) to develop and implement a Sourcing Risk and Control Framework. This Bunker et al. 2015, Adelaide, South Australia Sourcing Risks Control Framework research approach is critical to the effectiveness of the data collection and analysis within this study due to the variable nature of organisational outsourcing requirements, diversity of risks associated with these requirements, the variation in control types that can be applied and the multitude of methods that can be used to assess them. That is to say, more quantitative methods of data collection (such as experiments, surveys and field studies) would not gather the most appropriate data for interpretation so to detect the subtleties and differences between organisations. The key generic components of Discovery and Action Research methodologies that are of particular relevance to the development and implementation of the Sourcing Risk and Control Framework are: Workshops -The diagnostic component, involving researchers and key industry representatives in developing a shared interpretation of the Sourcing Risk and Control Framework objectives, assumptions, information, processes and support practices; diagnosis also involves problems related to implementation of a particular framework design and achievements of the framework objectives; Workshops -The intervention component (also called therapeutic), involving the design and redesign of the Sourcing Risk and Control Framework objectives, assumptions, information, processes and support practices, based on diagnosis; and Organisational Case Studies -The learning component, involving distinct, ongoing processes of reflection on consultative practices underway and learning from observations of changes in these practices in the design of the Sourcing Risk and Control Framework. This will be undertaken in the context of the critical argument theory.
While there are several different models and forms of action research, the most appropriate for this study is the canonical form as it implies a cyclic, reflective, iterative and rigorous process (Baskerville and Wood-Harper 1998). Each cycle in this process involves phases of diagnosing, action planning, action taking, evaluating and specifying learning (Fig 1).
Data is being collected throughout the Discovery and Action Research cycles by the project team. Formal records of all the meetings with organisers and participants of consultations are being kept; the collaborative reflection and learning phases are being recorded (with the permission of participants); interviews are to be conducted with selected participants in a case consultation; and records of consultations are all being archived for subsequent analysis. This approach has been applied to other industry sectors for solution derivation and implementation as well as development of innovations (Bunker et al. 2007;Pang and Bunker 2005;Smith et al. 2010).

Stage 1 Diagnostic Workshops -Risk Identification and Classification
A number of workshops were held with practitioners in the latter half of 2014 so as to develop an understanding of risks and their relationships. In order to better prepare for the workshop activities, the research team conducted an "expert walk-though" with a skilled outsourcing practitioner where a preliminary list of risks was identified. Two workshops were subsequently conducted with both practitioners and academics that had expertise in sourcing risk and control. As the opportunity to gather expert practitioners in a workshop setting was highly time-constrained it was decided to use the Quality Function Deployment (QFD) method to facilitate: 1) the development of the risk lists: and 2) their categorisation (e.g. Crow 1994, Akao 2004.
A third case-based role playing workshop was held with a few practitioners and academics to apply the risks and categories that were developed from the first two workshops and to test their rigour and relevance. Workshop participants are detailed in Table 1.

Table 1. Workshop participants
The workshops participants were drawn from a number of industries, including consulting, banking and finance, and insurance as well as professional bodies and were selected for their considerable knowledge and experience in IT outsourcing. • Case-based role playing to apply risks and categories to a specific scenario.

Table 2. Workshop activities
In Workshop 1 participants identified design elements for a Sourcing Risk and Control Framework, e.g. as QFD has a product development orientation, participants were asked about the type of risk management characteristics important in the development of the framework. Participants then classified these requirements into categories and prioritised them. These were written onto PostIt notes. One category that was identified and formed a substantial part of the workshop discussion was "Defining categories for sourcing risks." All sourcing risks identified throughout the discussion were also written onto PostIt notes (one per note).
In Workshop 2 participants identified sourcing risks (on additional PostIt notes) building on the work from the previous workshop. These risks were then categorised into 16 high-level categories (see Appendix One). Relationships were then assigned between risk categories i.e. weak to strong relationships and characterised as strategic or operational. Analysis of the PostIt notes also highlighted risks that were more relevant to outsourcing vendors, rather than client organisations.
In Workshop 3 the risk list and classification was reviewed by a small team of academics from different disciplines and practitioners through its application to a case study scenario. Workshop conversations and PostIT notes were transcribed into a spread-sheet format.

Findings, discussion and implications
The 16 categories of risks and 151 risk types (see Appendix One) identified in the workshops show that strategy related risks (91) are more prevalent than operational type risks (60). Comparison of these findings to the work of Gandhi et al (2012) and de Sá-Soares et al. (2014) are summarised in Tables 3  and 4 respectively. We compare our findings to these two studies as they provide the most recent comprehensive reviews of the literature.  Table 3. Comparison of risk categories with Gandhi et al. (2012)

-client perspective
In Table 3 we cross reference the 10 risk categories from Gandhi et al.'s (2012) study to the detailed table in Appendix One. Gandhi et al. (2012) did not survey vendor organisations, therefore, as shown in Appendix One (highlighted in bold), we did not map categories related to vendor perceptions. In addition, we shade the risk types that we could not match to Gandhi et al.'s (2012) category descriptions. Some of these unmatched areas could be explained by approaches taken to characterising the risks. For example, we have adopted the labels and classifications used by the participants in our focus group. Gandhi et al. (2012) identified the risks based on a literature review and then conducted a survey to prioritise the risks. Whilst these are important considerations, of particular interest in our findings is that the unmatched areas tend to represent governance related matters, such as accountability issues, control and assurance, strategic alignment and top management support. Further, 60% of the risks identified were characterised as strategic. This is in contrast to Gandhi et al.'s (2012), findings where more than 50% of the risk classifications were operational. These findings appear to point to Lacity et al.'s (2009, 142) 'glimpse' of the future, when they anticipated that a shift from management to leadership would be required if "governance, control, flexibility and superior business outcomes are to be the consequences" of increasing "globalizing and technologizing of the supply of business services." The governance focus is also supported in de Sá-Soares et al. (2014) study of risks of client organisations.
In addition, all but two of the risk categories (design and psychological) identified in our study could be mapped to Gandhi et al.'s (2012) categories. That is, at least one risk type within a category could be identified in Gandhi et al.'s (2012) risk category descriptions. The emotional type of risk represented in the psychological category appears to represent a common view expressed in the literature about the overwhelming number of potential sourcing risks. Lacity et al. (2009, 135) state that practitioners may find the "best way to mitigate risk is through experience." Current theory however tends to emphasise risk and its assessment via normative rules and probabilities, providing limited insight into this experiential view. Theories that represent risk as experiences and emotions (e.g. Slovic et al. 2004;Lupton 2013) as well as consider multiple institutional influences (e.g Thornton et al. 2012) may

Australasian Conference on Information Systems
Bunker et al.

2015, Adelaide, South Australia
Sourcing Risks Control Framework provide better insights into the dynamics of risk and control related practices within and across organisations and help fuse different approaches to manage sourcing risk more creatively. Gandhi et al. (2012, 61) found that risks were "somewhat individual" with a limited "extent of overlapping." However, Gandhi et al. (2012, 63) did acknowledge possible interrelationships. For example, financial and reputation risks were identified as having a possible effect on vendor risk. Our results (as shown in Appendix One) indicate that all strategy related risks (both client and vendor) are strongly related to Return On Investment (ROI) and reputational damage and as the levels of strategy related risks increase, the possibility of negative ROI and reputational damage increases. The second highest number of risks (27) relate to contracts. Out of these, 5 risks relate to the vendor perspective, 9 to the client, and 13 to both vendor and client perspectives. These contract related risks have weak ties to all vendor risks but are strongly related to requirements risks, suggesting that a poorly defined contract may not catastrophically affect the vendor (i.e. put them out of business). Increases in the levels of contract risks indicate a higher chance of the contract being incomplete. The results also indicate that vendor risks are strongly related to Intellectual Property (IP) risks, suggesting that the more unprofessional vendor behaviour becomes, the greater the chance the client's data is at risk. Reputational risks are strongly related to selection risks, which indicates that a poor selection of tools, techniques, processes or vendor, can increase the possibility of reputational damage. Our analysis also reveals that ROI risks are strongly related to cost, so if the level of risks related to ROI increases, it is highly likely that the level of cost related to various tasks undertaken for the ICT sourcing project will increase. Transition risks, however, do not relate to any of the 16 risk categories. SLA risks have been identified as being strongly related to requirements risks so that high levels of incompleteness or vagueness increase the likelihood of SLA related risks. Practice risks have not been identified as being related to any particular category of risks. These findings point towards the need for further work examining the inter-relationships of sourcing risks and provide useful insights for designing risk mitigation strategies. The need for an integrated theory of IT-related risk is not new to the IS field (Markus 2000). However, an integrated view of risk control, and specifically in the context of sourcing, remains problematic (Mathew 2011).
In Table 4 we cross reference nine risk categories from de Sá-Soares et al.'s(2014) study. Whilst the de Sá-Soares et al.'s (2014) study also examines risks from a client perspective, we focus here on the vendor perspective. Further, risk is conceptualised in terms of factors (sources of dangers), negative outcomes and undesirable consequences. For the purpose of this comparison we conflate the factors and danger categories together; acknowledging that this is a limitation of our study. Finally, outsourcing risks are characterised as outsourcing stages compared to the strategy/operational view adopted in Gandhi et al. (2012) and our study. Whilst a lifecycle view was not adopted in the first stage of this work, it will be considered in the next phase in developing mitigation strategies.

Conclusion and future work
In this paper we report on the first stage of our research project, designed to document how sourcing risk is represented in practice in an Australian context. Our workshop approach provided a very effective meta-learning mechanism that has forged multiple perspectives on risk into a cohesive set of relevant categories. These initial categories were found to be broadly consistent with existing classifications mainly constructed from literature reviews. Of more importance, the risk categories identified in this study also build on these existing classifications and will be used as a basis for the identification of enablers, inhibiters and mechanisms to control outsourcing risks; the next stage of this project. This research has also identified potential areas for further theoretical development in terms of: the emotional and experiential nature of sourcing risk; the need for incorporating a multistakeholder perspective; examining governance, assurance and accountability; and the interconnectedness of sourcing risk. These matters await investigation and we hope stimulate further debate.