The Danger of Internal Outsourcing: When Everyone Owns the Process and Nobody Owns the Result

"The Danger of Internal Outsourcing: When Everyone Owns the Process and Nobody Owns the Result"

What’s Happening

Boards are increasingly alert to external outsourcing risk, especially where suppliers, technology partners and third-party platforms sit close to critical operations. The less visible risk is happening internally. Organisations are moving judgement, ownership and consequence into specialist functions, committees, frameworks and reporting systems.

That movement often looks like progress. The UK Corporate Governance Code places clear responsibility on boards to monitor risk management and internal control frameworks, and the FRC’s guidance connects those frameworks directly to culture, behaviour and the individuals operating them. The point is subtle but important: a control system only works if ownership still exists beneath the structure. (FRC (Financial Reporting Council))

What’s Being Said

Most board conversations are still framed around assurance. Are the right committees in place? Has the risk been logged? Has HR advised? Has compliance reviewed? Has the PMO tracked delivery? Has internal audit reported? Has the matter been escalated?

Those questions are necessary. They are not sufficient.

The Post Office Horizon scandal showed what can happen when institutional confidence attaches itself to a system while human evidence is discounted. The Criminal Cases Review Commission describes Horizon as the most widespread miscarriage of justice it had ever seen and the biggest single series of wrongful convictions in UK legal history. (Criminal Cases Review Commission)

The TSB IT migration failure showed the same ownership problem in a different form. The FCA and PRA fined TSB £48.65 million for operational resilience failings, including weaknesses in planning, governance, risk management and control over a critical technology migration. (FCA)

Carillion remains the external outsourcing warning, but the lesson travels inward. Parliament found that the government’s outsourcing approach had pushed unacceptable levels of financial risk onto contractors while relying on incomplete or incorrect information. (UK Parliament Committees)

What I’ve Noticed

The risk hiding under boards’ noses is not only outsourced work. It is outsourced judgement.

Culture goes to HR. Risk goes to risk. Conduct goes to compliance. Transformation goes to the PMO. Cyber goes to IT. Customer pain goes to operations. Data goes to analytics. Reputation goes to communications. Strategy goes to the strategy team.

Each move is rational. Together, they can create a structure where accountability remains at the top while proximity, judgement and ownership migrate somewhere else.

That is when the system begins to take precedence over results.

What This Means

The chain of causality is usually quiet.

The organisation grows more complex. Leaders create specialist functions to manage the load. Those functions introduce frameworks, policies, committees and dashboards. The board receives more structured information. Management receives cleaner escalation routes. Everyone feels more controlled.

Then judgement starts to move.

Managers wait for HR before addressing behaviour. Executives wait for risk to define appetite. Sponsors wait for the PMO to tell them whether delivery is on track. Business units wait for transformation teams to make change happen. Compliance becomes the place conduct goes to be interpreted, rather than the place it is supported.

The system becomes fluent. The result becomes harder to see.

Over time, culture reinforces the pattern. People learn that safety lies in correct process rather than clear ownership. They become skilled at escalation, documentation and functional handoff. They can explain their role. They can evidence their actions. They can show that the issue had an owner.

And still, the outcome deteriorates.

"Internal outsourcing happens when judgement migrates into functions, committees and frameworks while accountability remains with leaders. The result is a system that can prove activity without proving ownership."

Pressure Test:

If the board removed every dashboard, committee label and functional owner from the discussion, could it still name the person accountable for the result and the evidence that the result is improving?

If not, the organisation may not have a governance gap.

It may have outsourced ownership to itself.