Photo courtesy of iStockphoto, Vladimir Mucibabic


In a recent post entitled "The perils of Outsourcing Code," the point was made that, when a company outsources critical IT applications to third parties, not even the best service level agreement can protect them from the possibility of harmful code infiltrating their systems. The implication was that in-house services were somehow safer than outsourced services.

Hogwash.

Harmful code is no more likely to be inserted into a program by an outsourcing vendor than it is by a disgruntled employee - yet most IT shops have at least a few disgruntled employees. Furthermore, because of the risk allocation profiles of most outsourcing deals, the liability for harmful code intrusions often falls on the vendor (along with hefty consequential damages) through a strict liability standard.

Assuming the vendor is not judgment-proof, the vendor has substantial incentives to avoid allowing harmful code to be injected into their systems. Furthermore, a finding that a vendor slipped up will likely cause a substantial diminution of the vendor's reputation in the marketplace, a very costly error.

With proper incentive structures, I would argue that it is possible to create a situation where the supplier is less likely, not more likely, to infiltrate a system with harmful code.