Information technology sourcing is the strategic choice of how an organisation obtains, develops, operates and governs technology capabilities. The choice is not limited to “make” or “buy.” Contemporary organisations may insource, outsource, co-source, use managed services, join a shared-service arrangement, subscribe to software as a service (SaaS), or consume infrastructure and platforms through cloud computing.

Sourcing decisions affect cost, control, capability development, speed, resilience, compliance and strategic flexibility. A solution with the lowest initial price may create high switching costs, operational dependence or regulatory exposure. Conversely, an internally developed solution may provide control and differentiation but require scarce skills, capital investment and continuing management attention.

The central managerial problem is therefore not simply to minimise expenditure. It is to select a governance and delivery arrangement that provides the required business outcomes at an acceptable total economic, operational and strategic cost.

Learning Objectives

1. The Sourcing Continuum

Sourcing arrangements can be viewed as a continuum from internal ownership to external consumption. The categories overlap in practice, but each represents a distinctive allocation of responsibility.

Arrangement	Primary provider	Typical control	Typical use
Insourcing	Internal IT function	High	Differentiating or sensitive capabilities
Shared services	Internal enterprise service unit	Medium to high	Standardised services across business units
Co-sourcing	Organisation and specialist provider	Shared	Capability augmentation and joint delivery
Outsourcing	External supplier	Contractual	Non-core operations or specialist scale
Managed service	External provider manages a defined service	Contractual and service-level based	Networks, security operations, hosting and support
SaaS	Software vendor	Configuration and contract based	Standard business applications
Cloud IaaS/PaaS	Cloud provider supplies infrastructure or platform	Consumption and policy based	Elastic workloads, development and infrastructure

1.1 Insourcing

Insourcing means that the organisation owns and operates the relevant capability. It hires or develops personnel, owns processes and usually controls architecture, data and service management. Insourcing can protect intellectual property and facilitate close alignment with business users. It can also be expensive where demand is volatile or specialist skills are scarce.

Insourcing should not be confused with doing everything internally. An internal team may still use commercial software, consultants or cloud infrastructure while retaining accountability for the capability.

1.2 Outsourcing

Outsourcing transfers the performance of a defined activity to an external provider. The provider may supply people, processes, facilities and technology. Outsourcing can provide economies of scale, specialist expertise and access to mature operating processes. Its risks include loss of organisational knowledge, reduced transparency, supplier opportunism, service dependency and difficulty changing requirements.

A sound outsourcing contract specifies outcomes rather than merely headcount. It should address service levels, security, data ownership, audit rights, subcontracting, business continuity, pricing, intellectual property, exit assistance and remedies.

1.3 Co-sourcing

Co-sourcing is a collaborative arrangement in which internal and external teams jointly perform a capability. It is useful when the organisation wants specialist expertise without surrendering all knowledge and control. For example, an internal security team may retain risk ownership while a specialist provider supplies threat intelligence, monitoring and incident-response support.

Co-sourcing requires explicit responsibility allocation. Ambiguous boundaries can create gaps in accountability, duplicated effort and disputes over whether an incident or service failure belongs to the client or supplier.

1.4 Managed Services

A managed service transfers operational responsibility for a defined service to a provider under agreed service levels. Examples include managed connectivity, endpoint management, cloud operations, identity management and security operations centres.

The defining feature is not merely external ownership but continuing operational management by the supplier. The client normally retains business accountability, architecture authority and risk acceptance, even when day-to-day operation is delegated.

1.5 Shared Services

A shared-service centre provides common IT services to multiple business units within the same enterprise or group. It may operate as a cost centre, service provider or internal business unit. Shared services can reduce duplication and standardise processes, but they may become bureaucratic if they lack service-level discipline or responsiveness.

Shared services are particularly suitable for commodity activities such as payroll systems, identity administration, service desks and standard infrastructure. They are less suitable where business units require genuinely differentiated capabilities.

1.6 SaaS

Software as a service provides a complete application as a subscription or usage-based service. The vendor normally manages the application software, underlying infrastructure, upgrades and much of the operational security. The customer manages configuration, user access, data governance and business-process adoption.

SaaS reduces infrastructure ownership and can accelerate deployment. However, the customer must assess data portability, integration, availability, tenant isolation, regulatory location, vendor viability, pricing changes and the feasibility of extracting data at contract termination.

1.7 Cloud Infrastructure and Platform Services

Infrastructure as a service (IaaS) provides virtual machines, storage, networks and related resources. Platform as a service (PaaS) provides managed runtimes, databases, development platforms and other higher-level services. Cloud arrangements generally offer rapid provisioning and elasticity, but costs can become unpredictable if consumption is poorly governed.

Cloud does not eliminate responsibility. In a shared-responsibility model, the provider secures the underlying service while the customer remains responsible for matters such as identity, configuration, data classification and workload design. Exact responsibilities vary by service model and contract.

2. Theoretical Foundations for Sourcing Decisions

2.1 Transaction-Cost Economics

Transaction-cost economics asks whether an activity should be governed internally or through a market transaction. Relevant costs include searching for suppliers, negotiating contracts, monitoring performance, resolving disputes and adapting to changing conditions.

Here, C_total is the total economic cost of an arrangement; C_production is the direct cost of producing or delivering the service; C_transaction includes procurement, contracting, monitoring and coordination costs; and C_risk is the expected cost of material risks. The expression is a decision model, not an accounting identity. Its usefulness depends on consistent scope and time period.

Transaction costs tend to increase when requirements are uncertain, assets are highly specific to one relationship, transactions are frequent, or supplier performance is difficult to observe. Internal governance may then be preferable. External sourcing becomes more attractive where services are standardised, suppliers compete effectively and the provider has substantial scale economies.

2.2 Core Competence and the Resource-Based View

The resource-based view argues that sustainable advantage may arise from resources and capabilities that are valuable, rare, difficult to imitate and supported by the organisation. Activities that embody such capabilities should generally be protected from careless outsourcing.

A capability may be strategically important even if it is not visible to customers. For example, a retailer’s real-time pricing platform, a bank’s fraud-detection capability or a manufacturer’s production-planning algorithm may differentiate the business. Outsourcing its operation could be appropriate, but outsourcing architectural knowledge and decision rights may create strategic vulnerability.

Commodity services are strong candidates for standardisation, shared services or external provision. Strategic capabilities normally require retained internal ownership, even when selected components are sourced externally.

2.3 Capability and Knowledge Considerations

A sourcing decision changes the organisation’s knowledge base. If a function is outsourced completely, internal personnel may lose the ability to assess technical quality, challenge supplier assumptions or recover the service after termination. This is known as capability erosion or hollowing out.

Managers should distinguish between capacity and capability. Capacity is the amount of work that can be performed; capability includes knowledge, judgement, architecture, relationships and the ability to improve. A supplier can increase capacity rapidly, while the client may still need to retain capability in governance, design and risk management.

2.4 Risk and Agency Perspectives

Outsourcing creates a principal–agent relationship. The client (principal) delegates activity to a provider (agent), whose incentives and information may differ. Providers may optimise measurable service levels while neglecting unmeasured quality, resilience or long-term maintainability.

EAL is expected annual loss; pᵢ is the annual probability of risk event i; and Lᵢ is the monetary loss if that event occurs. Probabilities are dimensionless and losses should use the same currency and time basis. This is an expected-value approximation: it does not describe the full distribution of losses, correlations between events or extreme risks. Low-probability catastrophic events may require separate risk appetite and scenario analysis.

2.5 Flexibility and Real-Options Thinking

Sourcing decisions are often made under uncertainty about demand, technology and regulation. A flexible arrangement can have value even when its expected short-run cost is higher. Cloud elasticity, modular contracts, termination rights and portable architectures can preserve future choices.

This is analogous to a real option: the organisation pays a premium to retain the ability to expand, contract, switch or defer commitment. Flexibility has value when uncertainty is high and future decisions are difficult to reverse. It has less value when requirements are stable and switching is easy.

3. Financial Evaluation: From Price to Total Economic Cost

3.1 Total Cost of Ownership

Total cost of ownership (TCO) includes all material costs over the relevant life cycle, not only the supplier’s quoted price.

The terms represent acquisition or subscription cost, implementation and migration cost, ongoing operation, change and integration cost, expected risk cost, and eventual exit or replacement cost. The categories must be defined consistently to avoid double counting.

For cloud services, operation may be consumption-based. Relevant variables can include compute hours, storage volume, data transfer, managed-service charges, support tiers, reserved commitments and idle resources. FinOps practices connect engineering decisions with financial accountability through budgets, tagging, forecasting and unit-cost measures.

3.2 Present Value and Discounting

When costs occur at different times, they should not be compared by simply adding nominal amounts. The present value of a future cash flow is:

C_t is the cash flow in period t, r is the discount rate per period, and PV_t is its present value. The rate and period must match: an annual rate should be used with annual periods unless appropriately converted. The formula assumes a conventional deterministic cash flow and does not by itself adjust for inflation or risk; those issues must be treated consistently in the cash-flow model.

B_t represents benefits in period t. A sourcing alternative is financially attractive relative to another when its comparable NPC is lower, or when its NPV is higher under the same assumptions. Financial comparison must be supplemented by strategic, risk and capability analysis.

3.3 Worked Example: Insourcing versus Managed Service

An organisation is comparing a five-year internal operation with a managed service. All figures are in thousands of currency units. The discount rate is 8% per year. Assume costs occur at the end of each year, except the initial implementation cost at time zero.

Cost item	Insourcing	Managed service
Initial transition	180	120
Year 1	520	430
Year 2	530	440
Year 3	540	450
Year 4	550	460
Year 5	560	470
Exit cost at Year 5	80	140

The nominal totals are 2,960 for insourcing and 2,510 for the managed service. However, discounting is required. Using PV_t = C_t ÷ (1.08)^t, the approximate present costs are:

The managed service has an estimated present-cost advantage of approximately 296.5 thousand. Nevertheless, this conclusion depends on service quality, transition risk, exit feasibility, data protection and the probability of future price increases. A lower NPC is not sufficient if the managed service cannot meet regulatory or resilience requirements.

4. A Structured Sourcing Decision Framework

Stage 1: Define the Service and Business Outcome

Specify what is being sourced, who consumes it, required service hours, performance outcomes, compliance obligations, interfaces and demand variability. Vague scope produces incomparable bids and weak accountability.

Stage 2: Classify Strategic Importance

Assess whether the capability is commodity, critical or strategic. Consider competitive differentiation, intellectual property, customer experience, regulatory significance and the consequences of failure.

Stage 3: Assess Internal Capability

Evaluate skills, capacity, architecture knowledge, process maturity, tooling, leadership and improvement capability. A low current cost may conceal underinvestment in resilience or technical debt.

Stage 4: Analyse the External Market

Examine supplier maturity, competition, concentration, reference customers, financial stability, portability, geographic coverage and relevant certifications. A theoretically attractive sourcing model may be impractical where only one provider can deliver it.

Stage 5: Estimate Total Economic Cost

Include life-cycle costs, transaction costs, risk exposure, integration, governance, transition, exit and likely demand changes. Use sensitivity analysis rather than a single forecast.

Stage 6: Evaluate Risk and Control Requirements

Determine which risks can be transferred, reduced, shared or accepted. Legal transfer of responsibility does not eliminate business accountability. Critical services require tested continuity arrangements and meaningful audit rights.

Stage 7: Select the Operating and Contractual Model

Possible models include fixed price, time and materials, consumption-based pricing, outcome-based services, gain-sharing and hybrid contracts. The model should reflect measurability and uncertainty. Fixed price is unsuitable when requirements are highly uncertain unless change mechanisms are strong.

Stage 8: Design Governance and Exit

Define decision rights, escalation, performance review, architecture authority, data access, audit, innovation, dispute management and termination assistance before contract signature. Exit planning is a design requirement, not an emergency activity.

5. Comparing the Main Alternatives

Insourcing versus Outsourcing

Insourcing offers control, knowledge retention and closer cultural alignment. It may be inefficient for standardised activities and can expose the organisation to recruitment difficulty and unused capacity. Outsourcing offers scale and specialist expertise, but creates dependency and requires active supplier management.

Co-sourcing versus Full Outsourcing

Co-sourcing is often superior where the organisation needs specialist skills but must retain institutional knowledge and risk ownership. Full outsourcing may be more efficient for mature, repeatable services. The choice depends on whether the client can define outcomes, monitor quality and maintain sufficient retained expertise.

Shared Services versus External Providers

Shared services can consolidate demand without exposing data and processes to an external party. They also permit enterprise-wide standardisation. External providers may offer stronger scale economies, broader benchmarks and faster access to innovation. Internal shared services can fail when business units are captive customers with little influence over service quality.

SaaS versus Custom Development

SaaS is attractive when business processes are common and the organisation is willing to adopt vendor-standard workflows. Custom development is justified when requirements are differentiating, unavailable in the market or constrained by unique regulation. Excessive customisation of SaaS can remove its economic advantages and increase upgrade risk.

Cloud versus Traditional Infrastructure

Cloud is valuable where demand is variable, deployment speed matters, or managed platform services reduce operational burden. Traditional infrastructure may remain appropriate for predictable high utilisation, specialised latency requirements, data sovereignty constraints or workloads with substantial migration costs. The relevant comparison is not “cloud is cheaper” but whether the selected operating model delivers better total value and risk control.

6. Contracting, Governance and Performance Management

A sourcing strategy is implemented through governance as much as through procurement. Essential contractual provisions include:

Performance indicators should combine cost, service, risk and improvement. Examples include cost per transaction, incident recurrence, mean time to restore, change success rate, security-control compliance, customer satisfaction and forecast accuracy. A metric is useful only when its definition, data source, target and management consequence are clear.

7. Applied Case: Northstar Health Network

Background

Northstar Health Network operates hospitals and outpatient clinics. Its identity, collaboration and endpoint-management services are provided separately by each hospital. Costs are rising, security practices differ, and clinicians experience inconsistent access to applications.

Problem

The executive committee proposes full outsourcing to a global managed-service provider. Hospital leaders are concerned about patient-data governance, loss of local responsiveness and dependence on a single supplier. The security team also reports that internal expertise is uneven but essential for incident response and regulatory interpretation.

Analysis

The identity service is critical and security-sensitive, but it is not a competitive differentiator. Standardisation could improve control and reduce duplication. Local clinical workflow knowledge, however, is strategically important. The external market contains mature identity and endpoint providers, but the proposed supplier uses subcontractors in several jurisdictions.

Northstar estimates that full internal operation would cost 9.2 million per year, while the proposed managed service would cost 7.4 million. Transition would cost 1.8 million, and expected annual risk cost is estimated at 0.9 million internally and 1.2 million under the proposed contract. The risk estimate is uncertain because a breach could produce highly skewed losses.

Approach and Solution

A transition board includes clinical, security, procurement, legal, finance and supplier representatives. The service is introduced in controlled waves, beginning with low-risk administrative users.

Outcome

After implementation, Northstar achieves greater standardisation and improves access reliability. The internal team retains sufficient knowledge to challenge supplier decisions and manage incidents. The arrangement costs more than the supplier’s original headline quotation because governance, resilience and exit provisions are funded explicitly, but the board considers the additional expenditure justified.

Learning Points

The case demonstrates that the best answer is often neither complete internal operation nor complete outsourcing. Strategic retention of architecture, privacy and risk capability can coexist with external delivery of standardised technology. It also shows why risk, exit and governance costs must be included in the business case.

8. Contemporary Developments and Ethical Issues

Multi-Cloud and Portability

Organisations increasingly use several cloud providers to obtain specialised services or reduce concentration risk. Multi-cloud can improve bargaining power but may increase integration complexity, skills requirements, data-transfer costs and operational inconsistency. It should be adopted for a clear risk or capability reason, not merely as a slogan.

Artificial Intelligence in Sourcing

AI can support demand forecasting, contract analysis, supplier-risk monitoring and cloud-cost optimisation. It can identify anomalous consumption or compare contract clauses, but outputs require human validation. Training-data provenance, confidentiality, explainability, bias and accountability must be addressed before AI is used in procurement or supplier evaluation.

Sustainability

Cloud and outsourced services shift energy and hardware decisions but do not remove environmental responsibility. Procurement should consider energy efficiency, renewable-energy claims, hardware life cycles, electronic waste, data-centre water use and transparent emissions reporting. Sustainability criteria should be measurable and contractually reviewable.

Regulatory and Ethical Governance

Outsourcing does not transfer an organisation’s legal or ethical duties to vulnerable customers, employees or citizens. Due diligence should cover forced labour and human-rights risks in technology supply chains, fair treatment of outsourced workers, accessibility, privacy, algorithmic discrimination and responsible use of customer data. Critical suppliers may require regulatory notification, operational-resilience testing and documented concentration-risk controls.

9. Challenges and Limitations

No sourcing framework produces certainty. Cost estimates may omit informal coordination, future integration and technical debt. Risk probabilities may be subjective, while catastrophic events cannot be represented adequately by expected value alone. Supplier markets change, and a provider that is competitive at contract award may later become dominant or financially unstable.

Scoring models can create false precision. A weighted score is useful for disciplined discussion, but the weights reflect managerial judgement. Sensitivity analysis should test whether the recommendation changes when cost, risk or strategic assumptions vary.

Finally, sourcing is not a one-time procurement event. It is an operating relationship that requires continuous measurement, renegotiation, capability development and eventual renewal or exit.

Best-Practice Checklist

Before approving a major sourcing decision, management should be able to answer yes to the following questions:

Chapter Summary

Sourcing strategy determines how an organisation obtains and governs IT capability. The principal alternatives—insourcing, shared services, co-sourcing, outsourcing, managed services, SaaS and cloud—differ in control, flexibility, capability requirements, risk allocation and cost structure.

Transaction-cost economics explains why market provision is not automatically cheaper: search, contracting, monitoring and adaptation costs may be substantial. Core-competency and resource-based perspectives emphasise retention of capabilities that are valuable, rare or strategically differentiating. Risk and agency perspectives highlight information asymmetry, supplier incentives, concentration, security and accountability. Real-options thinking recognises that flexibility and reversibility have economic value under uncertainty.

A rigorous decision compares total economic cost rather than headline price. It includes acquisition, implementation, operation, change, risk, governance and exit. Present-value analysis improves comparisons across time, while sensitivity and scenario analysis address uncertainty. The best solution is frequently hybrid: externalise standardised activities while retaining internal architecture, governance, risk and business knowledge.

Effective sourcing finally depends on contract design and active governance. Service levels, data rights, security, continuity, subcontracting controls, pricing transparency and exit assistance must be designed before commitment. Sourcing is therefore a strategic capability, not merely a purchasing technique.

Key Terms

Transaction-cost economics: Analysis of the costs of using markets compared with internal governance.

Core competence: An organisational capability that contributes significantly to distinctive performance or competitive advantage.

Insourcing: Delivery of a capability primarily through internal organisational resources.

Outsourcing: Contracting an external provider to perform a defined activity or service.

Managed service: An externally operated service delivered under defined performance and governance terms.

Shared service: A common internal service provided to multiple organisational units.

SaaS: Software delivered and operated by a vendor for customer use through a subscription or usage arrangement.

IaaS: Cloud provision of infrastructure resources such as computing, storage and networking.

Total cost of ownership: Life-cycle cost of acquiring, operating, changing, governing and retiring an asset or service.

Total economic cost: Cost including direct expenditure, transaction costs and expected risk consequences.

Expected annual loss: Probability-weighted estimate of loss from specified risk events over a year.

Vendor lock-in: Difficulty or cost of changing suppliers, technologies or service arrangements.

Retained capability: Internal knowledge and authority deliberately kept to govern or perform critical activities.

Service-level agreement: Contractual statement of measurable service performance obligations.

Exit strategy: Planned method for transferring, replacing or terminating a sourced service.

Real option: Value arising from preserving the ability to make a future choice under uncertainty.

FinOps: Financial management practice linking cloud consumption, engineering and business accountability.

Concentration risk: Exposure created by excessive dependence on one provider, platform or geographic location.

Review Questions

Short Answer Questions

Long Answer Questions

Analytical / Application Questions

Multiple Choice Questions with Answers

Question 1

Which arrangement involves joint delivery by internal staff and an external specialist?

Question 2

Which perspective focuses most directly on search, negotiation, monitoring and adaptation costs?

Question 3

In the simplified total economic cost model, which item represents procurement, contracting and monitoring effort?

Question 4

If a risk has probability 0.04 and estimated loss of 500,000 currency units, its expected loss is:

Question 5

Correct Answer: C. A unique fraud-detection algorithm supporting competitive advantage

Question 6

Correct Answer: B. The provider operates a defined service against agreed performance terms

Question 7

Using an 8% discount rate, the present value of 108 currency units received one year from now is approximately:

Question 8

Question 9

Correct Answer: B. It combines external scale with retained internal knowledge and control

Chapter 8 Sourcing Strategy and Make–Buy–Cloud Decisions

Sourcing Strategy and Make–Buy–Cloud Decisions

Introduction and Context