SMEs should audit before outsourcing, says report

Tom Young, Computing, Monday 30 November 2009 at 17:00:00

Many SMEs are exposing themselves to unnecessary risk through lack of
in-house IT skills, says report

Small businesses are exposing themselves to unnecessary risk through a lack
of in-house skills, according to a white paper from vendor Fifosys.

"It is difficult for small companies to acquire the IT skills necessary to
support today?s complex technology requirements. These can include the
management of online order taking, continual email services, maintaining and
servicing local and wide area networks, as well as business continuity. A one or
two-person IT team simply will not be able to manage this," the report says.

As a result, many of these companies still have a "single point of failure"
? a system where operations will grind to a halt if one element of the system
crashes.

Mitesh Patel, managing director of Fifosys, said: "While businesses routinely
assess the single points of failure in core operations, from manufacturing to
distribution, they are patently failing to apply the same robust operations
practices to IT."

He explained that the problem lies with the culture of the IT department: "
Individuals within the IT team are not encouraged to look at mapping business
needs with IT risks and availability, nor do they typically have the skills to
do so."

Small companies may also find that inadequate third-party supplier contracts
fail to reflect their operational requirements. These can be expensive and risk
making small firms less agile.

The report recommends that SMEs avoid some of these problems by
commissioning an IT infrastructure audit from a professional audit firm.

"This can provide immediate insight into the single points of failure... and
will enable directors and management to determine and prioritise IT needs and
investment based on real business requirements," the report says. This might
include increasing staff training or numbers.

Only then should a small business look to purchase an IT services contract,
making sure it carefully defines the terms.

"Once [this is] in place, SMEs can look to build on this relationship to
attain quantifiable information regarding technology requirements, including
advice on strategic investment and long-term budgeting," the report adds.

Full story at http://www.computing.co.uk/computing/news/2254176/smes-shoudl-audit-before