| Offshoring
|
Outsourcing: Are you sure or offshore? Identifying legal risks in offshoring
Ken Shiu provides an insightful commentary on the benefits and risks associated with the outsourcing of business process operations and software development to lower cost countries ("offshoring") in Outsourcing: Are you sure or offshore?. Shiu outlines these benefits and risks in the context of some of the most common offshoring structures including standard third party supplier outsourcing contracts, establishing a foreign subsidiary, setting up a joint venture with an offshore service provider and BOOT arrangements. The article also deals with the main legal concerns associated with offshoring, including protection of intellectual property, the HR/industrial relations sensitivity associated with "moving jobs offshore", data protection and other industry-specific regulatory concerns. Shiu also points out that by engaging an offshore service provider, practical issues of contract enforcement and dispute resolution will take on an international flavour and must be considered by the customer in advance. Shiu concludes that despite the much-hyped cost savings that may be associated with offshoring, it is vital to give proper attention to security and compliance processes it and may even be appropriate to commence with pilot projects or projects with lower operational risk before a large-scale offshore outsourcing initiative is implemented.
Ken Shiu is a Senior Associate in the Communications Media and Technology practice of Allens Arthur Robinson in Sydney and advises on commercial technology matters in the Asia Pacific.
'Offshoring' is the recent term coined in reference to the outsourcing of software development tasks and, more lately, business process operations (BPOs), such as call centres and claims processing, to lower cost countries. The fierce political debate in the US (and to a lesser extent the UK) over the merits of offshoring have yet to reach the same intensity in Australia. According to local industry and media reports, the Australian experience with offshoring has been more reserved than the US or UK. However, the inevitable appeal of lower cost services means that more Australian organisations will be increasingly attracted to explore offshoring projects.[1]
Aside from the usual risks associated with any outsourcing of operational control, offshoring projects require consideration of additional legal risk factors which can lie hidden from the high level focus by management on the (often hyped) cost reduction business case.
Offshoring structure
Structuring the appropriate legal structure to receive offshore services has a direct bearing on the offshoring cost and risk model. Several possible options exist:
Standard third party supplier outsourcing contract
The simplest method of engagement is to adopt a pure customer-service provider relationship and contract directly with the offshore provider. A variant of this is to contract with a local multinational who subcontracts parts of the services to its lower cost offshore subsidiaries. In Australia, Telstra's outsourcing relationship with IBM typifies the latter approach. The advantage of this approach is obtaining the reduced service cost benefits and dealing with the familiarity and accountability of a local supplier. The natural disadvantage is that full offshore cost benefits may not be fully passed through to the customer and no actual knowledge of managing the overseas performed tasks is developed by the customer.
Establish a direct foreign subsidiary
This option requires significant upfront investment and resource commitment. Setting up an offshore services subsidiary requires investigation and compliance with the domestic laws of the host country (including the subtleties of offshore foreign investment, labour and tax laws). The obvious advantages of establishing an overseas subsidiary for supply of services is the ability to maintain security and keep service delivery within the customer's own corporate group. This option is able to offer a direct level of control over the provision of services and handling of proprietary assets or information, however the ongoing compliance and management costs may be high.
Joint venture with the offshore service provider
Setting up a joint venture with a service provider to provide outsourced services back to the customer is a model that potentially creates several conflicts of interest. A domestic example is the now defunct IBM GSA entity formed by joint venture between IBM Australia, Telstra and Lend Lease.
Under joint venture arrangements, appropriate contractual and governance structures need to be in place to ensure that the respective interests of each of the customer and the service provider are sufficiently protected. The usual joint venture issues of valuing contributions, shareholder exit, dispute resolution and overseeing management creates an additional overhead on top of the need for basic project management resources to monitor the provision of offshore services.
The commercial attraction of the offshore joint venture structure is often the ability for the customer to divest from its balance sheet, non-core assets (typically IT assets and personnel) and participate in the profit share upside of commercialisation of the joint venture. Companies need to consider carefully whether the underlying profit motives of any joint venture vehicle will create problems with the ultimate supply of services back to the owner-customer.
BOOT arrangement
Larger customers with more significant outsourcing requirements and commercial muscle may be able to negotiate a BOOT (build, own, operate and transfer) engagement model. This model requires the offshore service provider to setup the outsourcing infrastructure and then provide and manage the services to the customer. The customer has an option subsequently to acquire and transfer ownership back from the service provider. The BOOT model in a primitive sense is a 'try before you buy' alternative to establishing a direct foreign subsidiary.
Under a BOOT model, the customer generally has a clear incentive to ensure that establishment and infrastructure costs are borne by the offshore service provider. If the customer decides to disengage services by exiting the host country (and not exercising the buy option), the service provider assumes the commercial risk of carrying the BOOT infrastructure assets.
Naturally, due to the risk allocation, service providers will baulk at BOOT arrangements unless they are confident the service infrastructure can be subsequently used for or sold to other interested third parties. BOOT arrangements would favour generic, re-usable, business process service infrastructure such as call centres.
Geopolitical and cultural issues
Offshore outsourcing also introduces a mixture of geo-political and cultural issues that may require some lead time for the customer to adjust to before the business integration of offshore services supply arrangements are more settled. These issues include language, time zone differences, geographic distance, political risk and host country technical infrastructure. Australia's multicultural society and workforce may make these problems less significant than they are for other western countries.
Intellectual property risks
There is no substitute for sufficient due diligence on the legal framework in the offshore service provider's home jurisdiction to determine the scope and practicalities of enforcing legal rights or protecting intellectual property (IP) which may constitute a critical component of the offshoring activity.
Offshoring of software development tasks or BPO inevitably involves the use and handling of confidential information or proprietary intellectual property which the customer will be keen to protect from inadvertent use or disclosure by the offshore service provider. Although contractual remedies will often be relied on, it is worthwhile ascertaining the ability to undertake non-contractual enforcement of IP rights.
Despite most offshoring countries being signatories to various international IP harmonisation conventions including the Berne Convention and the TRIPS Agreement, [2] actual implementation and enforcement of IP rights under domestic law is heavily influenced by cultural and resource factors which are often at a level below the expectations of many Western countries. For example, although Indian law affords copyright protection and statutory breach of confidentiality for software licensors,[3] the maximum statutory penalties are generally in the order of up to 3 years imprisonment or two lakh rupees (approximately $A6,200). China, perceived by many foreign observers to be a difficult jurisdiction to protect IP, is making efforts to improve this perception although the financial sanctions in recent cases have been of similarly low impact.[4] In many countries, patentability of software is not fully recognised, which also restricts any dependence on patent infringement actions.
Recent high profile instances of source code misappropriation in US-Indian offshoring arrangements have highlighted the deficiencies in offshore IP law that may not exist (or be taken for granted) under Australian law. In August 2002, Shekhar Verma, an ex-employee of an Indian software contractor, Geometric Software Solutions Ltd was trapped by an undercover FBI agent when attempting to sell the source code for a computer-aided design software package belonging to SolidWorks, a US client of his ex-employer. Verma had been hawking the source code to several competitors of SolidWorks. [5] Indian law at the time did not recognise misappropriation of trade secrets and technically, Verma did not steal from his employer as the source code belonged to SolidWorks. Although Verma was prosecuted, prosecutors were forced to charge Verma with simple theft and the outcome of the case has yet to be settled.[6] In an Australian context, this would be reliably dealt with by an action for breach of confidence or statutory breach.[7]
Ensuring that the offshore contract at a minimum covers enforceable contractual remedies for breach of confidence is essential. The degree of critical IP involved will no doubt determine the level of comfort necessary concerning the IP protection laws in the offshoring jurisdiction. Misappropriation risks can also be mitigated by implementing physical security measures and exercising audit rights.
The flip side of the coin for IP risk is to ensure that the ultimate deliverables from offshore are clear of any third party infringement and technically secure, including free from trojan horses and hidden back door access. [8]
Managing the troops
Due to the tide of recent media coverage, perhaps the most sensitive public relations issue for management will be the need to address the displacement of local employees. [9] The Australian political debate on the employment aspects of offshoring has yet to reach the more advanced legislative proposals in the United States such as the Defending American Jobs Act[10] and the United States Workers Protection Act.[11] These proposed bills primarily focus on preventing federal government grants subsidising any US corporations who declare increases in the numbers of their non-US workers relative to US workers or government agencies from using any offshoring in privatisation or procurement activity. Early legislation such as the Thomas-Voinovich amendments (which now limit government agencies from privatising or awarding certain new contracts to contractors performing work outside the US) were passed by US Senate and made law earlier this year.[12] Despite these US developments, companies will still need to be conscious of any union concerns and relevant local industrial relations laws with respect to redundancy and employment transfer arrangements.
Case studies have shown the benefits of management engaging in early open dialogue with affected employees. [13] In the case of large offshoring projects, co-operation of key staff will be essential to facilitate effective knowledge transfer to the staff of the external services provider.
Other human resource issues that tend to be dealt with contractually include the trans-border management of the traffic of employees between countries. Typically the initial transition period will require offshore consultants to be onsite to facilitate knowledge transfer. Similarly, Australian staff may need repeated trips offshore and access to the offshore provider's domestic resources to assist in the service integration process.
Contractual provisions may also need to mitigate any adverse operational issues which might arise if the offshore service provider itself experiences high staff attrition or turnover.
Regulatory Issues
Australian companies are not currently subject to any overarching regulatory restrictions on offshoring. Specific industry legislation, however, does require regulatory compliance. For example, in the financial services industry, APRA prudential standards on outsourcing also extend to services by offshore providers. [14] By extension, the offshore provider and the offshore contract will need to address key risk areas, particularly satisfactory business continuity plans and disaster recovery processes.[15]
Federal and state privacy laws also impose obligations on companies when dealing with personal information and the transfer of this information offshore. [16] Many favoured offshoring countries have yet to implement data privacy legislation. This may lead to the need for physical ring fencing of sensitive data and imposing adequate contractual obligations on the offshore provider regarding data handling.
Australian export control permits may in some instances be required to be obtained if any software code which is passed offshore contains strong encryption code falling within the categories defined in the Defence Strategic Goods List. [17] Any software code sent offshore should also be checked for any embedded US origin code to determine whether any re-export permits under the US Export Administration Regulations are necessary.[18]
Jurisdiction and enforcement
By engaging an offshore services provider, the practical issues of contract enforcement and dispute resolution take on an international element. The parties will need to consider private international law issues such as the selection of a governing law, the processes for dispute resolution, whether to use international arbitration and the international venue to meet for resolving contractual disputes.
The benefits of confidentiality of proceedings and the cross-border enforceability of arbitral awards provides a greater impetus for adopting arbitration as the formal dispute resolution forum in an offshoring contract. Any enforcement concerns will need to bear in mind the extent of any relevant assets in the jurisdiction and that the inclination of Australian courts to grant security of costs orders in an international arbitration proceeding is unclear. [19]
To mitigate any enforcement risks, alternative measures such as insurance, financial guarantees and performance bonds may be need to be incorporated into the offshoring contract.
Accounting and tax
Tax considerations will play a significant role in determining the most appropriate structure to adopt for an offshoring exercise. Countries such as India currently provide generous tax incentives to attract direct foreign investment in relation to establishing domestic IT businesses and locations into local software technology parks. [20]
Other finance issues relevant to international supply may also need consideration. Certain Asian countries that are promoted as destinations for offshoring activity have currency controls which may restrict some repatriation of funds overseas. These may impact on the decision to establish direct overseas service subsidiaries. Foreign exchange movements in the Australian dollar and the projections of IT salary trends (in Australia and the offshoring country) should also be factored into any perceived medium to long term cost benefits in favour of the decision to outsource offshore.
The issue of transfer pricing may also be relevant in the context of setting up any related overseas companies to provide offshoring services.
Conclusion
Offshoring should not be regarded as a quick-fix cost-cutting initiative nor a one-size-fits-all solution. Many of the issues raised in this article result in extended lead time for integration of the offshore provider into the business process and significantly longer time to attain consistent and satisfactory outsourced service levels. The more critical the business process or data sensitive the activity being outsourced, and the more inexperienced the customer, the greater the need (and cost) of implementing security and compliance processes. These costs may materialise as hidden or contingent costs which impact the offshoring business case.
A more measured and conservative approach to offshoring is to commence with smaller pilot projects or projects with lower operational or intellectual property risk, before engaging in any large scale offshore outsourcing initiative. Commencing with offshoring of small pilot projects allows time to assess deficiencies in internal process controls, acclimatise to any cultural management issues, establish the necessary processes and deploy adequate resources required for accurately monitoring contractor performance.
* This paper is an expanded version of an article titled "Catching the Offshoring Wave: How to avoid getting beached" recently published in Allens Arthur Robinson's Focus On Technology, April 2004 and in LexisNexis, Contract Management in Practice Newsletter, May 2004.
Footnotes
* The author wishes to thank Michael Pattison, Partner, Allens Arthur Robinson for his input and assistance in the preparation of this article.
1 Gartner Group estimates that 2.7% of Australian application development and system integration spending in 2002 was offshored to India. See "Changing Places", Sydney Morning Herald, 9 March 2004. The Australian Information Industry Association (AIIA) recent offshoring poll of 100 Australian companies revealed that one in local organisations had considered or are considering an offshoring project. See AIIA Media Release, 4 May 2004
2 WTO Agreement on Trade-Related Aspects of Intellectual Property Rights
3 Copyright Act 1957 and The Information Technology Act 2000 respectively
4 Lim, M and Herrold, B "Internet company's ex-employee is guilty of IP theft", World eBusiness Law Report, 10 December 2003
5 Fitzgerald, M "Big Savings, Big Risk", CSO Magazine, November 2003, available at http://www.csoonline.com/read/110103/outsourcing.htm
6 Chesto, J "Offshoring of jobs reveals new risks to tech industries", Boston Herald, 24 May 2004, available at http://business.bostonherald.com/technologyNews/view.bg?articleid=29101
7 For example, section 183 of the Corporations Act 2001
8 Willoughby, M "Hidden malware in offshore products raises concern", ComputerWorld, 15 September 2003, available at http://www.computerworld.com/securitytopics/security/story/0,10801,84723,00.htm?from=story_picks
9 "Offshoring Threatens Telstra Sale", The Australian IT, 16 January 2004
10 Zielenziger, D "US House members to offer anti-offfshore jobs bill", Forbes.com, 2 March 2004 available at http://www.forbes.com/home_asia/newswire/2004/03/02/rtr1283147.htm
11 Sharma, D "Federal Bill targets offshore labor", CNET News.com, 20 February 2004 available at http://news.com.com/Federal+bill+targets+offshore+labor/2100-1022_3-5162467.htm
12 See Global Sourcing Information, National Foundation for American Policy at http://www.nfap.net/researchactivities/globalsourcing/appendix.aspx
13 Overby, S "The Hidden Costs of Offshore Outsourcing", CIO Magazine, 1 September 2003
14 APRA Prudential Standard APS 231
15 Paragraph 20, APRA Guidance Note AGN 231.1
16 See Section 6B and Schedule 3, National Privacy Principle 9, Privacy Act 1988 (Cth) and corresponding provisions in state privacy legislation
17 Regulation 13E of the Customs (Prohibited Exports) Regulations 1958 and Chapter 2, Part 5 of the Defence Strategic Goods List
18 Parts 730-774 of the Export Administration Regulations
19 Shipway, L. "Orders for Security Costs in International Arbitration", International Law Office Newsletter, 20 May 2004
20 See Department of Information Technology http://itfriend.mit.gov.in/ipcell3.asp and Industry and Ministry of Finance http://finmin.nic.in/foreign_investment/intfinance_issues/index.htm
June 2004 contents
|
