This article was updated on June 15, 2018.
Compliance seems to get more complicated every year, especially with the various updates and changes to tax laws and employment laws that organizations must contend with. As a result, there's a growing trend of organizations outsourcing some of their compliance needs. If you're considering outsourcing for your organization, you need to understand the differences between in-house vs. outsourcing compliance, so you can find an appropriate balance between the two.
Compliance Outsourcing Trends
The majority of businesses outsource at least some part of their compliance work. According to Deloitte, 24 percent of the surveyed compliance executives say they "do not outsource any part of the compliance program" and completely manage everything in-house. Compliance outsourcing firms are becoming more sophisticated and offering more services so it's likely this trend will continue. So much so that the SEC has warned certain businesses in the financial industry to ensure they have adequate internal controls to monitor the effectiveness of their compliance outsourcing providers.
Benefits of Outsourcing
Outsourcing compliance work can save money and time. The outsourcing firms can often handle parts of your compliance at a lower cost than if you ran everything yourself. They benefit from economies of scale due to specializing in one or two services. At the same time, you don't have to worry about turnover hurting compliance because the work is being done by a fully staffed organization rather than just one or two trained in-house employees who could suddenly leave. Finally, the outsourcing firm will stay on top of changing regulations so you don't have to constantly do research yourself. Remember — if you outsource compliance it's easy to get the impression the risk has been passed off to the other organization. However, your business is still liable for compliance issues, even if they come from a mistake made by the outsourcing organization.
When to Outsource
Compliance tasks that do not require a unique understanding of your business are good choices for outsourcing. For example, compliance training seminars and candidate sanction screening. Outsourcing also works well when you need a system online 24/7. That's why a whistle-blower hot line was the most commonly outsourced compliance element, according to Deloitte.
Outsourcing can help prevent compliance issues for tasks spread over different departments. For example, payroll is often divided between HR and the finance department, which can make overseeing the entire process difficult. By outsourcing this work, the other business is in charge of compliance for both finance and HR functions.
Outsourcing can be useful when you need specialized knowledge right away and don't have time to train your staff, like if you need to adapt immediately to new regulations or have an emergency and need someone to fill in for a few months. Outsourcing would work until you can catch up in-house.
When to Handle In-House
Any compliance element that requires an understanding of your unique business process may be better handled in-house. For example, you should design your own controls because an outsourcing firm might not understand the nuances of your business well enough to develop effective controls. If a control element depends on knowing confidential information from your organization, think twice about outsourcing. At the very least, you should see what kind of security measures the organization has in place to protect your information and how they would compensate you for a breach. Finally, if your business is struggling with a compliance element, don't count on outsourcing to automatically solve the problem. Your own system must be working properly before you can think of outsourcing.
In the end, there's no "one-size-fits-all" combination of in-house vs. outsourcing compliance that every firm should adopt. However, by carefully considering the pros and cons, you should be able to find a balance that is right for your business.
SIGN UP FOR THE SPARK NEWSLETTER