By Stephen Baker
In 2004 GlaxoSmithKline (GSK) had been in talks with an Outsourcing company in India called GECIS, to outsource a number of Financial Services Business Processes. Outsourcing business processes is significantly different to the outsourcing of Technology. The main difference is the Outsourcer must not only perform the tasks, but they must do so in a way that replicates the culture of the organisation they are representing. After all, a customer is not interested in the fact the Company has outsourced various functions and services, as far as they are concerned they are dealing with the Company, not some Outsourcer. In my opinion, this is a significant reason for the struggles Public bodies have with Outsourcing, particularly, in the eyes of the customer. GSK already had experience of outsourcing niche elements of its business, mainly focusing on research and development etc. This particular requirement, though, was to undertake a type of outsourcing model that was, in GSK’s own definition, a ‘Pioneer’ project and, if this proved successful, would act as a model for additional projects. The functions to be outsourced were the Business Processes of 11 key financial departments, which managed payments of over £3billion annually. These were: The overall approach that had been discussed between GSK and GECIS would involve: At this time, GSK had already created a function to deliver the Programme of Projects in the form of: The Prologue
GSK had recognised that Senior Management needed a role to be performed within the Programme that would act as an ‘assurance’ that the project was delivering on key transitions as the project moved from inception to final sign-off. So, GSK went to the contract market to find someone who could: The ‘Assurance' Requirement
I had been contacted by the Contract Agency that GSK had retained and from that, I was invited to attend a meeting with GSK to discuss the role. I had been given a brief outlining the requirement for the role and was asked, based on that information, to present a description of how I might go about fulfilling that role and to highlight some key features of the proposal I was making. The presentation was limited to 10 minutes followed by 15 minutes Q&A. Attending the meeting would be the Programme Director, Head of Procurement and Head of Contracts. The main points I highlighted from my proposal were: I can only imagine that others had also been invited to a similar meeting but, whatever the selection method was, I was asked to undertake the job. My contract was for six months but this was extended by a further three months and lasted from October 2004 to June 2005. The Pitch
As any independent consultant/contractor will tell you, the client expects you to hit the decks running on the first day. Besides informing you where the toilets and canteen are, there is little time to acclimatise yourself to your new surroundings…….and in my case, not even enough time to be informed of these essential facilities. On being picked up from Reception at 9:00am on the Monday morning, I was taken to the Programme Director’s office welcomed and informed that I had one week to develop the Assurance Model, present it as a ‘Heads of Agreement’ to a number of senior GSK business managers as well as senior GECIS mangers located in Mumbai, obtain a sign-off from those parties and, working with the Heads of Procurement and Contracts, to embed it within the BPO contract with GECIS. So, with the Programme Director’s cheerful “Good luck” assisting me on my way, I found my desk sat in my chair, introduced myself to my neighbours and then closed my eyes to have a think. Getting Started
When trying to come up with solutions or processes I attempt to picture what the model might look like in my minds-eye, the ‘light-bulb’ moment, and then walk-through how it might be implemented and used and who would be involved. After about an hour and hearing a few people saying to one another “Has he gone to sleep?” I was able to outline a rough model of what the ‘Assurance Process’ would look like, how the interested parties might be informed of what they needed to work towards and the types/categories of people who would be involved. The model that I had pictured, would be based on elements of the Business Case, Contract Obligations and Working Practices. The idea was to: As part of this initial thinking, I needed to accumulate information and knowledge in order to answer these questions, as part of a Discovery process. I felt I could find the answers by looking at: In addition, I needed to identify the boundaries for the Assurance model and make it clear that I was not involved in designing or delivering the ‘Solution’ nor in the managing of the Programme. My focus was on whether the CET Board had the confidence to sign-off on the Programme, for which the Assurance Model had to be designed to do, together with supporting evidence. So, at this stage, I didn’t have to have procedures written, ‘Criteria’ identified, members of staff identified or detailed Project Plan activities. What I needed to do was: “Has he gone to sleep?” No, I'm on the road to Damascus.
Having experienced the ‘light-bulb’ moment of visualising the Assurance Model, I’d got my thoughts together by Tuesday afternoon so, I had a meeting with the Programme Director and gave him a quick run through. He asked if I could do the presentation at 4:00pm on the Thursday afternoon as he could definitely get the relevant people to attend. I said yes, but would that be difficult to get the people from GECIS in Mumbai to be there, as it would be about 8:30pm in Mumbai. “We haven’t signed the full contract with them, yet. They’ll be there.” He replied. I’d identified the Programme Sponsor, who was a Senior Vice President, as being key to both the success and authority of the Assurance function. The Programme Director agreed with this and arranged for me to give the SVP a heads-up briefing before the Presentation. The Programme Director also agreed that he should appoint an experienced GSK person to be involved in hands-on management of the individual Projects to ensure the Criteria was being met and the requirements of the Reviewed Meeting would be complied with. This could then lead to that person taking over my role and any other BPO Assurance roles in the future. This I did and the SVP said he would attend the meeting in the afternoon as well. So, Thursday afternoon and representatives from each of the 11 functions to be outsourced were there. Plus representatives from GSK IT, the BPO Programme, GSK Procurement, GSK Contracts, SVP and Programme management from GECIS. In addition, because this BPO was classed as a ‘Pioneer’ project there was a man and woman sitting at the back. I was informed, by a back-of-the-hand conversation, that these were from GSK Internal Audit who would, no doubt, report there impressions back to the CET board. Copies of my presentation were handed out and, at 3:55pm, SKYPE with Mumbai sprang into life. The Programme Director stood up, gave a short introduction looked at me and said “All yours.” and sat down. Making a presentation has never phased me although, I have to say, I never take them for granted. I looked round the room at about forty pairs of eyes looking at me…..I looked at the screen to Mumbai to see the faces zooming in and out and the camera sweeping around as they made adjustments. Well, this could either be an example of poor technology management or a bit of ‘8:30pm’ displeasure. So, I waited a moment for it to settle and remarked that I was sure “The transition to GECIS would be a lot smoother” The GSK contingent thought this was amusing but the faces of the GECIS representatives gave me the impression that my comment might have been lost in translation. For the next thirty minutes I went through the presentation and spent another half hour on Q&A. At the end of it I sat down and even our friends in Mumbai appeared to have relaxed. So, we all dispersed and I took on board some of the comments, to follow through. The Programme Director asked me to make any revisions to the model I thought were necessary and to meet with him in his office the next morning…..I should say that the representatives from Internal Audit had already disappeared, a trick I was to become familiar with. The following morning dawned and at 11:00am I was summoned to the Programme Director’s office. Which way would it go…..would it be “OK, what’s next?” or “Thank you for your time, but it’s not really what we are looking for.” I knocked on the door “Come in, Stephen.” Well, that was encouraging as my name hadn’t been spoken before, other than being introduced at the presentation. The SVP was there and he was pleased to say that the presentation had been both understood and well received by GSK and GECIS. He also told me that the CET Board had said that they were happy with the Assurance Model and with the confidence it would give them when being asked to sign-off…. I could almost picture Internal Audit slipping a two page report under their door, knocking on it and then disappearing down the corridor. Well, whatever their report said they did comment that they thought the Assurance model was “bringing best practice to the Company.” I went back to my desk, fairly pleased with myself, and ready to have a cup of tea and relax. No such luck! As soon as I sat down a guy from Contracts was on the phone…”Hi, Stephen. You probably gathered that we want the Assurance function included in the final version of the Contract so, we’d like to meet, tomorrow, at 8:30am to discuss how we word this into the Contract. The final version will be signed off and distributed at 5:00pm so GECIS can review it over the weekend for a formal agreement on Monday. See you tomorrow.” It was now 5:00pm on the Thursday so I had sixteen hours to make revisions from the meeting and put it in some order for tomorrow. At 9:00pm I had it finished, got a taxi and went to my hotel. The next day I had the meeting with Contracts who massaged the text into ‘Contract speak’ and inserted it into the relevant clauses. They went off to get sign-offs and it was on its electronic way to Mumbai by 3:00pm. And, we're off!
At the time I lived in Somerset and, as all of my work was not in that county, I tended to live away from home during the week. My normal routine was to leave home on a Sunday lunchtime and travel by train to where I was working. Accommodation was often a budget hotel or, indeed, a room in a private house, no client-funded Management Consultancy luxury for me, as I paid for it out of the fee I received. I would then put in the hours during the week to enable me to leave around mid afternoon on a Friday to go home. For this assignment it was around fours hours door to door; but, if I missed a train connection, that could extend to five hours (on one contract I had to catch three trains and it took eight hours. Also, there were some assignments I took abroad. So, instead of coming home at the weekends I would stay and quite often my wife would join me for the weekend and take in a few extra days sightseeing). It's not all Champagne and caviar, you know!
So, the word came down that the BPO Outsourcing contract had been signed by both parties and the Programme was officially underway. My plan, now, was to: The way the Assurance Model had been designed was from the CET Boards perspective. What I mean by that is, the CET Board would not be asking GECIS or, for that matter, the future GEK function if ‘they were assured that the transition had been successful.’ No, it would be the CET Board who would say, can we assure ourselves that the transition has been successful and that decision would be based upon ‘the Programme meeting the Board’s criteria for success and these are the tests, measurements and evidence you will provide for us to make that decision.’ In other words…customer led and judged. They needed to be Assured, by the SVP, that if they were to sign-off the Programme they could do so in the knowledge the transition had been successfully completed in accordance with the Business Case and the provisions within the Contract. In turn, the SVP needed a similar Assurance that the Programme was progressing to the Programme Plan, Transition Testing, Business Case and Contract provisions. This would be undertaken during the Assurance Review, which were aligned to specific Milestones in the Programme Project Plan and were identified at Tollgates. In total there were four Tollgates in the Programme plus the process to transition to a Pilot and a further transition into the Operational State. Some Tollgates (Tollgate 3, Pilot and Operational State) would trigger Contract Payments, if successfully completed. The process of Assurance would be applied from Tollgate 3 onwards, as the first two Tollgates were about Design and Discovery between GSK and GECIS. The Assurance Model is shown as Appendix A at the end of the document and was applied to each of the 11 finance functions being outsourced (In the Model you will see a box called ‘HR.’ HR was a key contributor and sign-off that any TUPE requirements, staff consultations, redundancies or redeployment had been properly and successfully undertaken). OK, back to it.
As already indicated, there were 11 business process functions to be outsourced and 4 Assurance Reviews would be undertaken for each business function (Tollgates 3 & 4 plus transition to a Pilot plus transition to Operational State). That meant there would be 44 interactions/cycles of the Assurance process. However, during my initial discovery work it was agreed, with the Senior Vice President, that a final Assurance Review would be undertaken prior to his meeting with the CET Board, who would then use this review as evidence for the CET Board sign-off. As he remarked, ‘The Board don’t rubber stamp sign-offs. They will have read my report and will have searching questions, that he really would have to have answers for.’ I also found that some of the business functions would be undertaken in phases and the Programme Director requested that these phases should also go through the Review process. There were 10 of these. So, in total there would be 55 interactions of the Assurance Model. This was a large amount of work so, the question was ‘Is the design of the model robust, repeatable and have minimal impact on the workload of the Programme?’ The first of the business processes to be transitioned was Travel and Expenses and this would be used to test the efficiency and robustness of both the Project Design and the Assurance Model. The essence of the Assurance Model is the premise that ‘Someone will deliver something that needs to be accepted by someone else.’ This is a classic process in any business but, in this case, it will be formally managed and reviewed. The method for doing this would be on the basis of: The biggest piece of work was the creation of the Acceptance Criteria. The Criteria had three elements to it: In the case of the first two requirements, I went through the Business Case and the Contract to identify what had to be delivered by the Outsourcer and GSK. This was then translated into a number of individual Criteria as well as an Impact Statement should the individual Criteria not be delivered or only partially delivered etc. At the time of the Review. In the case of the Products, these deliverables had been identified as part of the Design phase for each of the Business Processes being outsourced. My task was to identify those deliverables and to have agreed, between both parties, what the Criteria is for the successful acceptance that the Criteria had to meet ( ie had the Criteria been met in its entirety, partially met but sufficient for the Programme to continue under caution or, the Criteria has not been met and the Programme is halted until it is). This document was to be produced well in advance so that both parties could see what they would be judged against at the Review Meeting. It should be noted that the Criteria and its successful delivery was not just confined to the Outsourcer delivering to GSK. In quite a few cases, GSK was delivering products to the Outsourcer; for example, connectivity to GSK servers and this needed to be assured. This document was signed off by both GSK and GECIS line management and used in the Review Meeting. The next piece of work was to identify named individuals within GSK and GECIS that were involved in the Acceptance Process and those who would attend the Acceptance Review Meeting and what their role, responsibility and accountability would be. In the case of the Acceptance Process, this was at Project and Line Manager level, basically, those working to achieve and accept the deliverable. In the case of the Acceptance Review Meeting, this identified the Chair of the meeting, Senior GSK and GECIS managers, those who would support those senior managers and personnel who would attend as Observers. To do this I created a RACI Matrix: The Matrix also included a description of their role, how they were expected to collaborate and how they were expected to conduct themselves at the Acceptance Review Meeting (for instance; do not come to the meeting and argue about the state of a Criterion. If you disagree then both sides should say that and present how the issue will be resolved, by whom and by when). The final piece of work was to develop the ‘boiler plate’ tasks that made up the Acceptance activity within the Programme Plan as well as individual Project Plans. There were about six tasks that had to be undertaken that formed the Acceptance activity. They included: Each task included both man-effort and elapsed time estimates. These tasks had been created as a set of repeatable Microsoft Project ‘boiler plate ‘ actions that the Programme Planners could embed into Project Plans, using the fixed Tollgate date as the given. With all these things set up, Criteria documents having been agreed and distributed, the Programme got underway and we waited for the first Assurance Review Meeting. As already stated, the date of the Tollgate was fixed and the Assurance Review Meeting would happen three days before that fixed date. Because these dates were fixed, Projects did not have the luxury of moving those dates, so, their progress and the quality of that progress would be judged on that day, regardless. The first Acceptance Review Meeting took place and, of course, some leeway had to be given as participants got familiar with the challenges posed by the Assurance Review. Unfortunately, some of the participants, from both GSK and GECIS, hadn’t taken the process or their responsibilities as seriously as they should have done. All the participants had been informed, both in documentation and a workshop, of how they should conduct themselves in the meeting, the maximum time the meeting would run for and the agreed outcomes. The main issues that started coming out at the meeting were that some of the Criteria had not been worked to or, had been ‘modified’ to suit what the Project wanted to deliver. With some Criteria, the two parties couldn’t agree whether it had been met, or not, but had not come up with a plan on how they would mitigate the issues raised and argued about at the meeting. The Senior Vice President had told me before the meeting that he was going to come down hard on any nonsense or substandard professionalism or quality. Also, as this was the first Assurance Review there were a number of Observers from Procurement, Contracts and Internal Audit as well as some senior managers from GSK Infrastructure and a couple of the GSK divisions that were being outsourced. It has to be said that this first meeting was a shambles as far as the Project was concerned and the SVP didn’t hold back in his summary of events. As the Secretary to the meeting, I was glad I was making an audio recording of the meeting, as well as taking notes, as the SVP gave his summing up. In front of everybody he stated that: ‘The collaboration between GSK and GECIS Project staff was not of an appropriate level of professionalism, management or focus for a Programme of this importance to GSK and this Assurance Review Meeting had shown that to be the case. The Programme Director had three days to convince the SVP this would be resolved. Those who were reporting to the Assurance Review Meeting did not give the confidence to him that they understood whether progress was being made or they fully understood what they were reporting. In particular, GSK staff providing information and data to GECIS in a timely and complete manner and GECIS staff not honestly reporting risks, issues and progress and sharing with GSK in a professional manner, rather than what they think GSK should be told. The Project has one hour in which to identify how issues allocated Amber and or Red status will be addressed, resolved and by whom and be given to the Review Secretary.’ During this Assurance Review Meeting a RAG status had been applied to each of the Criteria. Some were Green, the majority were Amber with a few Reds. The overall assessment, based on these RAG status and on the way the participants had contributed to the Assurance Review Meeting, the SVP’s overall assessment is that the Project is rated as RED. This means that the Project is stopped until Amber and Red status are resolved. The consequence of this is that by stopping further work, there would be less elapsed time to meet the next fixed Tollgate date. It was then that the Programme Director and GECIS senior staff realised the ‘power’ of the Assurance Model and its implications, as this really was the way higher management would exercise its influence. Although, I had spoken to the SVO on a number of occasions and discussed the effect the Assurance Review could have on the Programme, I was pleasantly surprised the way he discharged his duty as Chairperson of the Assurance Review Meeting and his professionalism in calling the shots…..I did learn, later, that the SVO was very well respected by those further down the ladder and if he made a proclamation it was taken seriously. As the Programme progressed more Assurance Reviews were held with mixed results. During the time I was involved a few reviews did go through with a Green RAG status but, it has to be said, they were fairly straightforward. The majority were deemed to be Amber RAG status which meant that the Project Stream could continue but under the condition that those Criteria highlighted as not meeting the requirement of that Criterion were resolved in the agreed timescale. I think four Project Streams were halted due to a Red RAG status, which meant that the spotlight was definitely on that stream, with the Programme Director being informed. By now, GECIS and GSK were collaborating really well, having been roundly rebuked by the SVO for not doing so, and appreciating that as they were in this together they might as well work together to get through the Programme. How the Assurance Model worked in practice.
So, with the Programme underway, the Assurance Model being taken seriously and both GSK and GECIS line management appreciating that the SVO and the CET Board were not a rubber stamping exercise, how did things progress? Well, to be honest, I don’t know! It is often the lot of an independent contractor/consultant that you don’t often see an assignment through from beginning to end. Basically, you are employed for as long as the client feels your contribution fits with their requirements and the budget holds out. In my case, it was stated as part of my contract that they wanted me to design a solution, make sure it worked and was robust and train and handover to a permanent GSK employee, so, I knew I wouldn’t be there at the end. I was able to agree with the Programme Director that after 10 cycles of the Assurance Model I would then engage with my replacement with the plan to fully Handover and depart by the 30th cycle, which included both Tollgate 3 and some Tollgate 4 Reviews. This would enable the new person to undertake a further 24 cycles before the Programme was due to end. When I left, after 30 cycles, the Assurance Model was embedded into the working practices of the Programme and both GSK and GECIS line management were using the Model to focus their work, be more collaborative and be more proactive in Assurance Review Meetings. It was also interesting to see how new contributors were brought into the Assurance ethos and were both helped and instructed in what was expected of them within the working practices of the Model. In fact, it was pleasing to see that additional Assurance benefits were being realised as the Programme moved forward, over and above those I had identified. The last action that took place, before I left, was a review of the Assurance Model and its practical value to the Programme by GSK Internal Audit, which was prepared for the CET Board. I wasn’t able to see that report but it was the practice of the Agency I had gone through to get feedback on performance etc. Besides the usual platitudes of ‘team member…diligent…worked more hours than contracted for…smartly dressed and professional etc etc’ GSK did say that a summary item of my contribution was ‘The Independent Contractor bought best practice to the company.’ For me just that comment meant a lot and was a testament to the contribution I hoped I was able to make. Knowing the abilities and professionalism of the people I worked with and the pressure they were under, as they transitioned their jobs to an Outsourcer, I was actually humbled by the comment. Was the Assurance Model taken forward to other BPO contracts? Again, I don’t know as I moved to new pastures and it was always a policy of mine not to keep in direct contact with past colleagues. However, I hope the principles of the Model were, indeed, embedded into the GSK-way of Outsourcing Business Processes, lthough, I would expect changes to be made to the detail of the working practices etc. It was interesting that my next four contracts were with three public sector organisations which involved Outsource companies and it was fascinating to observe the relationship between public organisations and their Outsource supplier and the GSK private sector relationship. It's time to Exit.
Independent Contractors will often admit to doing more for the client than what they were originally asked to do. During my conversations with the SVO and the Programme Director the issue of Benefits Realisation was touched upon. So, they asked if I could put together a paper on how it might be undertaken. This I did but I also knew where this was leading. Sure enough I was then asked if I could put together a high level model from which they could consider what they should do. I did this (yes, sitting at desk….eyes closed) and left it with them. About three months later the Contracts Agency phoned me to see if I would be interested in doing a Benefits Realisation contract for a well known Big Pharma. I was now working on a new contract so I had to turn it down. An additional contribution
Well, if I had been nominated the invitation must have got lost in the post. As is the life of any Independent Contractor, people would have been saying, probably about a week after I’d left…..”Has anybody seen that Assurance bloke recently. You know, the one we thought had dropped off to sleep. Is he still with us?” Was I nominated for a Nobel Assurance Prize?
Having worked for quite a few companies, there’s always some little quirk or idiosyncrasy that stays in your mind. In the case of GSK it was to be found in their restaurant. When you’d selected your food you then proceeded through to the seating area of the restaurant. On entering, your eyes were drawn to quite a number of banners that were hanging from the high ceiling. These were representations of the various products the company sold and the banners used images from advertising campaigns. I found a seat that was a bit on it’s own and, as I sat down, I noticed a few heads had turned and a glimmer of smiles greeted me. I gave a smile in recognition, friendly people I thought, until I looked closer at the banner that was almost above me. There was a photo printed on the banner of Sir Stirling Moss, the racing car driver, looking down at me and asking “Do you have problems with Erectile Dysfunction? If so, Levitra might be the answer.” Levitra, it turns out, was GSK’s version of Viagra. It should be noted that Sir Stirling also appeared in an advert for Viagra as well as for Levitra. Anyway, I finished my lunch of sausage, egg and chips and when I got back to my desk, I was asked if I’d had a good meal to which I replied that I had. “And, where did you sit in the restaurant?“ ? An amusing time in the restaurant
Appendix A – Review Points of Significance
I found this report in the Daily Telegraph on 13th April 2023, which helps to ‘illustrate’ the consequences of not seeking ‘Assurance’……. “TSB Bank’s former chief information officer fined over botched IT upgrade The Prudential Regulation Authority (PRA) has fined TSB Bank’s former chief information officer for mishandling an IT upgrade that temporarily wiped out its banking services. The regulator has fined Carlos Abarca nearly £82,000 for not properly overseeing the transfer of corporate and consumer services data on to a new IT platform in 2018. Despite receiving the transferred data, the new platform immediately experienced technical failures which significantly disrupted TSB’s services, including branch, telephone, online and mobile banking. Many of TSB’s 5.2m customers were impacted by the issues. The PRA found that Mr Abarca failed to gain sufficient assurances from the third-party IT supplier that it was prepared for the upgrade. It comes after the PRA and Financial Conduct Authority fined TSB £48.7m in December. This penalty was in addition to the £32.7m in compensation TSB paid to the customers who suffered losses.” Copyright Daily Telegraph. And finally......
