How to choose an outsourcing provider: due diligence, SLA and exit plan in 10 steps

Choosing an outsourcing provider should not resemble buying the cheapest line item in a spreadsheet. A partner handling correspondence, documents or another operational process gains access to information, deadlines and activities that support everyday business. A sound decision therefore combines price with quality, security, continuity and the ability to recover the process.

The following ten steps create a measurable way to compare offers. They apply to business correspondence outsourcing and provide wider context for other outsourced processes. This does not mean that BackOffice Outsourcing offers every service mentioned as an example.

1. Define the process before requesting quotations

Set the start and end points, volumes, seasonality, document categories, exceptions and the outcome the business needs. “Mail handling” may mean dispatch only or a complete cycle of collection, registration, scanning, routing, printing, inserting, postage, returns and reporting. Without a shared scope, two apparently similar prices may describe entirely different services.

2. Compare the full cost model, not one rate

Include implementation, standard and additional operations, materials, transport, storage, reports, exception handling and minimum volumes. For the internal option, add employee time, cover, equipment, space and error costs. The outsourcing calculator is a useful starting point.

3. Verify competence, capacity and the real operating model

References matter, but they do not replace an operational discussion. Ask who owns the process, how cover is organised, how quality is checked, what volumes the provider actually handles and what happens when demand rises suddenly. A good answer describes roles, tools and procedures rather than simply promising “flexibility”.

4. Establish the parties’ personal-data roles

When an external company processes personal data on a client’s behalf, the roles must be classified correctly. GDPR Article 28 requires controllers to use only processors providing sufficient guarantees and to govern processing with a binding contract. EDPB guidance stresses that the agreement should not merely repeat the GDPR; it should give concrete information on how obligations will be met and which security level is required. See also our guide to business mail scanning and GDPR.

5. Turn expectations into measurable SLAs

The SLA must reflect the real risk of the process. Replace “quickly” with defined measures such as:

• time from collection to registration and notification,
• cut-off time for outgoing jobs,
• turnaround for scans or batches prepared for dispatch,
• acceptable error level and rework rules,
• incident response time and escalation route,
• reporting frequency, content and format.

Every metric needs a data source, owner and agreed calculation method. Otherwise both parties may calculate the same KPI correctly but reach different results.

6. Assess technical and organisational security

Review access control, separation of privileges, activity logs, retention and deletion, encryption, staff training and incident management. NIS2 includes supply-chain security among the risk-management measures for entities within its scope. Even where a business is not directly covered by NIS2, the principle is useful: process security also depends on suppliers and subcontractors.

7. Identify subcontractors and delivery locations

Determine which activities the provider performs directly and which are passed on. Ask where data is processed, how further providers are approved and checked, and who is accountable for errors. The client should know who can access documents and where each stage takes place.

8. Test business continuity and failure scenarios

A continuity plan must say more than “we have backups”. Discuss system outage, site unavailability, staff shortage, transport delay, power loss and a sudden volume spike. The provider should identify priorities, communication channels, decision-makers and the maximum recovery time for critical activities.

9. Design reporting, audit and change management

Reporting should support decisions, not just say that work was completed. Agree volumes, turnaround, errors, returns, exceptions and open actions. The contract should also cover review rights, controlled changes and regular operational meetings. Stability in outsourcing does not mean no change; it means managed change.

10. Start with a pilot and prepare the exit plan

A limited pilot reveals data quality, exception volumes and real workload before the entire process moves. At the same time, define termination arrangements: return or deletion of data, handover of registers and instructions, transition support and export formats. An exit plan is not a sign of mistrust. It is mature risk management.

A short provider scorecard

Score each category from 0 to 3: scope fit, total cost, competence, SLA, security, subcontractors, continuity, reporting, pilot and exit plan. The cheapest offer with zero points for security or continuity is not the cheapest option; it is an option with deferred risk cost.

When assessing a correspondence provider, request a process description, sample report and measurable scope. Contact BackOffice Outsourcing to discuss your current model, a controlled pilot and a quotation without assuming everything must move on day one.

Sources

• Regulation (EU) 2016/679 — in particular Article 28
• EDPB, Guidelines 07/2020 on the concepts of controller and processor, version 2.1
• Directive (EU) 2022/2555 (NIS2) — in particular Article 21

Frequently asked questions

Should the lowest price decide the provider?

No. Compare price with scope, SLA, additional-operation charges, security, continuity and the potential cost of errors.

What belongs in an SLA?

Measurable turnaround, quality levels, data sources, reporting, incident response, escalation and accountability for corrective action.

Is a pilot worth running?

Yes. A limited pilot exposes exceptions, data quality and the real workload before the full process is transferred.

Why define an exit plan at the beginning?

To secure data return or deletion, access to registers, knowledge transfer and continuity when the agreement ends.

← Back to all articles