Outsourcing can relocate key-person risk when responsibility moves to a supplier but the ability to perform critical tasks remains concentrated in one individual. The customer’s organizational chart can show a managed service while the operating dependency has merely moved across the contract boundary.
This is a conditional risk mechanism, not a claim about supplier competence or the prevalence of undocumented outsourcing. A provider can reduce concentration substantially when it establishes demonstrated coverage and a viable transfer path.
Measure tasks rather than job titles
Critical capabilities include rebuilding, diagnosing failures, correcting data, recovering service, and interpreting business exceptions. Language knowledge helps with some of these tasks without automatically supplying the rest.
GAO’s IT workforce guidance compares competency and staffing needs with available skills. Applied here, that suggests recording who can perform each required task, under what access conditions, and with what evidence.
A named backup person is weaker evidence than a successful exercise. Availability also matters: a second competent person who cannot access the environment during the required window may not provide effective operational coverage.
The transfer can hide the same concentration
Take a constructed engagement in which a supplier’s senior specialist learns the application from a departing employee. Incidents are then resolved through that specialist, while other provider staff route tickets and communicate status.
The service can perform well during ordinary operation. Yet the specialist’s absence could expose the same missing knowledge that motivated the outsourcing decision. A larger provider headcount does not by itself establish broader capability for this particular application.
The relevant comparison is task coverage before and after transfer. Contract ownership and demonstrated operating capability are separate observations.
Documentation needs a receiving user
Build instructions, decisions, diagnostic history, access procedures, and business-rule explanations are useful transfer artifacts. Their adequacy becomes visible when another operator attempts the required work without relying on unrecorded intervention.
The UK DDaT Playbook calls for current supplier documentation and planned knowledge transfer. The Sourcing Playbook connects outgoing transition with incoming mobilisation and dependency planning. These are scoped public-sector guidance examples, not proof that a particular provider has completed transfer.
An exercise can reveal missing permissions as well as missing knowledge. A technically complete runbook remains insufficient if the receiving organization lacks the rights or credentials needed to execute it.
Receiving-team operation tests the boundary
A representative release and recovery exercise can be led by the intended receiving team while the specialist observes and records gaps. The objective is usable capability, not simply attendance at training.
Dynamics 365 handover guidance includes support training in rollback, failover, and backup/restore. The broader exercise should be tailored to the actual contracted application and its failure modes.
Exceptional data corrections and infrequent business cycles deserve inclusion where consequential. Routine ticket handling can leave those concentrated skills untested for a long period.
Look for evidence that concentration declined
The hypothesis weakens when several available operators independently demonstrate critical tasks, transferred artifacts remain current, and a replacement provider or internal team can use them. It strengthens when successful work repeatedly depends on undocumented intervention by the same person.
Retained customer knowledge matters too. The customer needs enough understanding to accept results and make business decisions that the supplier has not been authorized to determine.
Outsourcing should therefore be evaluated for the specific concentration it removes, retains, or introduces. The service boundary can change while key-person exposure remains; demonstrated task coverage is the evidence that distinguishes relocation from resolution.