The risks of outsourcing QA and how procurement can reduce them

Outsourcing testing moves work to another company. It does not move accountability. When a release fails in production, customers and regulators look at the company that shipped it, not at its testing supplier.

Two public cases show how this plays out. In its 2014 report on HealthCare.gov, the US Government Accountability Office found that the Centers for Medicare & Medicaid Services undertook development without effective planning or oversight practices and launched the site without verification that it met performance requirements. In 2022, the UK Financial Conduct Authority and Prudential Regulation Authority fined TSB for operational resilience failings in its 2018 IT migration, finding that it failed to manage the operational risks arising from its IT outsourcing arrangements. Neither case was a testing contract alone, but both show that oversight of a supplier stays with the buyer.

Below is a risk register for a QA outsourcing decision. Each risk has a control that procurement can put in place.

1. Delivery risk: the work is poor and nobody notices

Testing produces activity that looks like progress: test cases written, defects logged, hours billed. None of these shows that release risk is going down.

Control. Define service levels that measure outcomes you care about: defects found after release in areas the vendor tested, time to triage critical defects, regression run completion before a release decision. The 2023 US interagency guidance on third-party relationships warns against performance measures that encourage volume or speed without regard for accuracy. Agree a reporting cycle and a review meeting where the vendor explains the numbers.

2. People risk: the team you chose is not the team you get

Proposals present senior people. After signature, the day-to-day work can move to less experienced staff, or the lead can be reassigned.

Control. Name key personnel in the contract, with approval rights over replacements, a notice period and an overlap at the vendor's cost. Ask in the RFP for the share of each person's time committed to your account.

3. Data and confidentiality risk

Testers see unreleased features, hold credentials to build and staging systems, and often meet personal data in test environments.

Control. Signed data processing terms before work starts, a default of synthetic or masked data, named accounts with least privilege, and prompt removal of access when people leave. Require notice of security incidents within a set time.

4. Intellectual property risk

Test code, frameworks, test cases and data sets are paid for by the buyer and needed after the contract ends. Some vendor terms keep ownership with the vendor and grant a licence.

Control. An assignment of all test assets created under the contract, with test code stored in repositories and accounts you own.

5. Lock-in risk

Automation built on a vendor's own framework or platform can only be run or maintained with that vendor. Switching then means rebuilding.

Control. Require open tooling you can run yourself, or a licence that survives termination on stated terms. Score proprietary dependencies during evaluation, not after.

6. Exit risk

Many contracts describe onboarding in detail and say nothing about handing work back. The EBA outsourcing guidelines ask institutions to have documented exit plans and to be able to leave without undue disruption, and to define indicators, including unacceptable service levels, that should trigger the exit. The same logic applies to any buyer.

Control. A draft exit plan within the first months, a knowledge transfer obligation, an exit assistance period at agreed rates, and a right to terminate for convenience with a reasonable notice period.

7. Commercial risk

A low first-year rate can be followed by increases, narrow scope definitions that turn routine work into change requests, and automatic renewals.

Control. Rates fixed for an initial period, later increases linked to a named index with a cap, a change control procedure with agreed rates, and a renewal that needs your confirmation.

Keep the register alive

ISO 37500, the international guidance on outsourcing, describes outsourcing as a life cycle that runs from strategy analysis through selection and transition into delivering value, with attention to risk throughout. A risk register written at selection and never reopened does little. Review it at each quarterly business review, and update it when the vendor changes team, location or subcontractors.

What this means for your selection

Use the red flags checker to spot these risks in proposals, the contract clause builder to write the controls into your terms, and the due diligence checklist to verify what vendors claim. For the detail on each control, read test automation vendor lock-in, test automation code ownership, how QA vendors staff projects, hidden costs of outsourcing testing and exit planning.