Management of Contracted Services

Management of Contracted Services (CGEIT - IT Resources): A Complete Guide with Exam Tips

Introduction
Management of Contracted Services is a key topic in the IT Resources domain of the ISACA CGEIT (Certified in the Governance of Enterprise IT) certification. Modern enterprises rarely deliver all IT capabilities in-house. They rely on outsourcers, cloud providers, managed service providers, consultants and offshore partners. Governing these relationships so they deliver value, manage risk and support enterprise objectives is a core responsibility of IT governance. This guide explains what contracted services management is, why it matters, how it works in practice, and how to approach CGEIT exam questions on the subject.

Why Management of Contracted Services Is Important
1. Accountability cannot be outsourced: An enterprise can delegate the execution of a service, but the board and executive management remain accountable for outcomes, risk, compliance and data protection. This is one of the most heavily tested ideas in CGEIT.
2. Significant spend and value at stake: Contracted services often make up a large share of the IT budget. Poorly governed contracts erode value through hidden costs, scope creep and underperformance.
3. Risk exposure: Third parties bring operational, security, privacy, regulatory, financial, concentration and reputational risks. A supplier failure can become an enterprise failure.
4. Strategic alignment: Sourcing decisions must support business strategy, not just reduce costs. Misaligned contracts can lock the enterprise into inflexible arrangements.
5. Regulatory and compliance requirements: Many regulators, such as those in financial services and healthcare, require formal oversight of third-party providers. Examples include data residency rules, audit rights and exit plans.
6. Resource optimization: CGEIT's IT Resources domain is about making sure the enterprise has the right capabilities (people, information, infrastructure, applications and external services) to meet its needs. Contracted services are a major lever for this.

What Management of Contracted Services Is
It is the set of governance and management practices used to plan, select, contract, monitor, evaluate and exit relationships with external service providers. The goal is to make sure these relationships deliver the expected value at acceptable risk and cost, in line with enterprise objectives.

Key concepts include:
- Sourcing strategy: A deliberate, enterprise-level decision on what to keep in-house, what to outsource, and which delivery model to use. Options include insourcing, outsourcing, cosourcing, multisourcing, cloud (IaaS/PaaS/SaaS), offshore or nearshore, and shared services.
- Contract: The legally binding agreement that defines scope, pricing, terms, liabilities, intellectual property, confidentiality, audit rights, termination and exit provisions.
- Service Level Agreement (SLA): Measurable performance commitments, such as availability, response and resolution times, and quality metrics, along with remedies like service credits.
- Operational Level Agreement (OLA) and underpinning contracts: Internal and sub-supplier agreements that support the SLA.
- Vendor and supplier management: The ongoing processes for managing the relationship, performance, risk and contract.
- Right to audit: A contractual clause that lets the enterprise, or its auditors, assess the provider's controls. Independent assurance reports such as SOC 1 or SOC 2 (SSAE 18 / ISAE 3402) may supplement it.
- Exit strategy and transition plan: Pre-agreed arrangements for terminating or transferring the service, including data return, knowledge transfer and continuity.

In COBIT 2019, this area maps mainly to APO10 Managed Vendors. It is supported by APO09 Managed Service Agreements, APO12 Managed Risk, BAI02 Managed Requirements Definition and MEA01/MEA03 for performance and compliance monitoring. At the governance level, EDM04 Ensured Resource Optimization and EDM03 Ensured Risk Optimization set direction.

How It Works: The Contracted Services Life Cycle

1. Strategy and Planning
- Define a sourcing strategy aligned with business strategy and approved at the appropriate governance level, such as the board, an IT strategy committee or the executive.
- Do a business case covering total cost of ownership (TCO), benefits, risks and alternatives.
- Identify core competencies that should stay in-house. Strategic, differentiating or highly sensitive capabilities are usually retained.
- Set risk appetite for third-party dependencies.

2. Requirements Definition
- Document business and technical requirements, service levels, security and compliance needs.
- Involve business stakeholders, legal, procurement, security, risk and IT.

3. Vendor Selection and Due Diligence
- Use a formal process such as an RFI or RFP, evaluation criteria and weighted scoring.
- Perform due diligence on financial stability, reputation, references, security posture, certifications (e.g., ISO 27001), business continuity capabilities, subcontractors and geographic or legal risks.
- Assess cultural fit and strategic alignment, not just price.

4. Contract Negotiation and Establishment
Essential contract elements include:
- Clear scope and deliverables
- SLAs with measurable KPIs, reporting obligations and penalties or incentives
- Pricing model and change mechanisms
- Security, privacy and confidentiality requirements
- Data ownership, location and return
- Intellectual property rights
- Right to audit and assurance reporting
- Business continuity and disaster recovery obligations
- Subcontracting restrictions and flow-down clauses
- Liability, indemnity and insurance
- Dispute resolution and escalation
- Termination clauses (for cause and for convenience) and exit or transition assistance
- Regulatory compliance obligations
- Legal review is mandatory before signing.

5. Transition and Onboarding
- Plan the transfer of services, people (where relevant), assets and knowledge.
- Establish governance structures such as relationship managers, steering committees and reporting cadence.

6. Ongoing Monitoring and Performance Management
- Track SLA performance against agreed metrics through regular reports and reviews.
- Conduct periodic risk assessments and review assurance reports.
- Hold regular relationship and governance meetings at operational, tactical and strategic levels.
- Monitor compliance with contract terms, security requirements and regulations.
- Manage changes, issues and disputes through defined processes.
- Measure the value actually delivered against the business case.

7. Relationship Management
- Treat strategic suppliers as partners and encourage collaboration and innovation.
- Segment vendors by criticality and spend, for example strategic, tactical, operational and commodity, so oversight effort is applied in proportion to importance.

8. Renewal, Renegotiation or Exit
- Evaluate performance and ongoing alignment before renewal.
- Carry out exit plans that keep services running, return or securely destroy data, and transfer knowledge.
- Avoid vendor lock-in through standards, portability and documented processes.

Roles and Responsibilities
- Board / Governance bodies: Approve the sourcing strategy and risk appetite. Ensure oversight mechanisms exist.
- Executive management / CIO: Accountable for implementing sourcing decisions and making sure they deliver value.
- Vendor management office / procurement: Run selection, contracting and administration.
- Service owners / relationship managers: Monitor day-to-day performance.
- Legal, risk, security and compliance: Provide specialist review and assurance.
- Internal audit: Provides independent assurance over the vendor management process.

Common Risks in Contracted Services
- Loss of control and in-house knowledge
- Vendor lock-in and dependency
- Hidden costs and scope creep
- Poorly defined SLAs that cannot be measured or enforced
- Security breaches and data privacy violations at the provider
- Regulatory non-compliance, such as cross-border data transfers
- Supplier financial failure or business discontinuity
- Concentration risk, where too many services sit with one provider
- Fourth-party risk from subcontractors
- Misalignment between the provider's and the enterprise's objectives

Exam Tips: Answering Questions on Management of Contracted Services

1. Remember that accountability stays with the enterprise. If an answer suggests the provider becomes accountable for compliance, data protection or business outcomes, it is almost certainly wrong. The enterprise remains accountable and the provider is responsible for delivery.

2. Think like a governance professional, not a technician. CGEIT favors answers about strategy, alignment, value, risk and oversight. When choosing between operational fixes and governance-level actions, the governance-oriented answer is usually best. Examples include aligning with business objectives, establishing a framework and defining accountability.

3. Business alignment comes first. The FIRST or MOST important consideration in a sourcing decision is usually that it aligns with enterprise strategy and business objectives. Cost savings alone is rarely the best answer.

4. Look for the root-cause, preventive answer. If a vendor underperforms, ask whether the contract or SLA defined measurable requirements. Questions often test whether you see that weak contracts or unclear requirements are the root problem.

5. Know the key contract protections. Expect questions on the right to audit, SLAs with measurable metrics, exit or termination clauses, data ownership, confidentiality and continuity provisions. The right to audit and exit strategy are frequent correct answers when questions focus on oversight or risk.

6. Due diligence happens before signing. If a question asks what to do BEFORE entering a contract, think risk assessment, due diligence, requirements definition and business case.

7. Monitoring is continuous. After the contract is signed, the best answers involve ongoing performance monitoring, periodic reviews, independent assurance reports and risk reassessment. Signing a good contract is not enough.

8. Watch for keywords such as FIRST, BEST, MOST and PRIMARY.
- FIRST often points to strategy, requirements or risk assessment.
- BEST often points to the most comprehensive governance-level control.
- PRIMARY often refers to business value or alignment.

9. Prefer measurable and enforceable answers. Choose answers that create objective, measurable criteria, such as KPIs in SLAs, over vague ones like a good relationship or vendor promises.

10. Recognize independent assurance. When an enterprise cannot audit a provider directly, as with large cloud providers, independent third-party assurance reports (SOC 2, ISO 27001 certification) are the appropriate answer.

11. Balance value, risk and resources. CGEIT governance objectives are benefits realization, risk optimization and resource optimization. The best answer often balances all three rather than maximizing one.

12. Do not overlook exit planning. Questions on vendor lock-in, provider failure or contract termination often have exit strategy or transition planning as the correct answer.

13. Subcontractor (fourth-party) risk. If a provider uses subcontractors, the best answer usually requires that contract obligations, such as security and audit rights, flow down to them and that subcontracting needs approval.

Sample Question Walkthrough
Question: An enterprise has outsourced its data center operations. Recently the provider has repeatedly missed availability targets, but the enterprise has little recourse. Which of the following would have BEST prevented this situation?
A. Selecting a lower-cost provider
B. Including measurable SLAs with defined penalties in the contract
C. Increasing the number of status meetings
D. Moving operations back in-house

Answer: B. The root cause is the lack of enforceable, measurable performance terms. Meetings (C) do not create enforceability. Moving in-house (D) is reactive and may not align with strategy. Cost (A) is irrelevant to the problem.

Key Takeaways
- Sourcing must be strategy-driven and approved at the governance level.
- Accountability always stays with the enterprise.
- Strong contracts include measurable SLAs, audit rights, security and privacy terms, continuity provisions and exit clauses.
- Due diligence comes before contracting. Continuous monitoring comes after.
- Use COBIT APO10 (Managed Vendors) and APO09 (Managed Service Agreements) as reference points.
- In the exam, choose answers that are governance-oriented, preventive, measurable and aligned with business objectives.