Punishments and rewards modify behavior in different ways. Penalties tend to stop undesired behavior, while incentives encourage and reward positive behavior. Smart executives recognize this distinction when defining objectives and performance measures for individuals. If basic expectations aren’t met, consequences are suffered. Conversely, rewards such as bonuses, stock options, and promotions motivate excellence and achievement. Similar principles apply at the organizational level when a business contracts with a service provider. Penalties for failing to meet minimum standards must be sufficiently painful and immediate to prevent complacency and sloppy work, while incentives must be attractive enough to motivate additional investments of time, money and effort.Penalties The goal of penalties in outsourcing agreements should not be to punish, to pay less for poor service, or to recover costs incurred as a result of problems. Rather, penalties should prevent problems from occurring in the first place and, failing that, should produce changes that fix the problems and increase the probability of repeatable successes in the future. Penalties must be substantial enough to exceed the administrative cost of processing them, and should increase with each repeat occurrence, up to a specified maximum. Penalties are typically capped at a percentage – as high as 15 percent – of the monthly invoice. Repeated failure to meet service targets could permit the client organization to terminate the contract for material breach. Penalties should be paid in the month after the failures occurred – and not tallied for reconciliation at year end. Otherwise the direct connection between poor performance and the penalty is lost, as is the sense of urgency to focus attention on the cause of the problem and corrective action.Penalties can be based on a variety of criteria and measures. Services are usually weighted according to their relative importance, and penalties can be calculated as a function of that weighting and the monthly service fee. In some instances, penalties may focus on trends, so that a downward trend over several months gets penalized, rather than any one particular anomaly. If staff continuity is a priority, vendor staff turnover can be used to trigger penalties, whether that turnover is caused by reassignment or by vendor staff leaving the company. Penalties can be tied to missed critical outputs that are key to business success. To effectively use penalties to motivate vendors, clients must define business priorities and focus measurable penalties only on those things that really matter. In other words, each miss in the specific critical service areas that affect business priorities should produce a deeply felt impact. Put differently, given a penalty “budget” of 15 percent of the contract price, knowing where to “invest” that 15 percent is the magic formula. If a vendor faces a 10 percent penalty for missing a key check run, for example, then considerable energy and enthusiasm will be directed to ensuring that target is never missed. Penalties tied to outages must be explicitly defined and scaled to deliver bigger hits for longer outages. For example, if acceptable outages are set at a maximum 30 minutes per month, the client must specify that the penalty for 400 minutes is greater than for 31 minutes – if not, the penalties may well be identical. The difference in impact between one 30-minute outage and 30 one-minute outages must also be considered and specified.A sliding scale of penalties can be an effective tool for managing application availability. Penalties can be tied to number of users impacted, number of sites impacted, number of applications out at one time, duration of the outage (e.g., up to 2 hours, 2 to 4 hours, more than 4 hours), first or second time this month, or this quarter, and so forth. Penalties can be based on a tally of “points” drawn from the sliding scale. For example, x points cost y dollars in month one. If the failure repeats in month two, the penalty multiplies.If the vendor tracks performance and penalties, then the client must invest time in this activity as well. Here again the key is to focus on priorities: the most important services carry the most severe penalties, and should receive the most attention. That said, not monitoring other services does not excuse the vendor from meeting targets in those areas. IncentivesIncentives can enhance motivation and accountability (and thus results), and foster healthy competition, particularly in a multi-vendor environment. Incentives should motivate positive behavior by recognizing and rewarding achievements that contribute value to the organization. The specifics of any formal incentive program should be clearly documented and communicated to all who can potentially contribute and benefit. A well-conceived incentive program is based on mutually defined goals and objectives that are established and reviewed annually, and that go beyond (though aligned with) the attainment of contracted service levels. Generally speaking, vendors should be rewarded for identifying cost saving opportunities, implementing initiatives that contribute to business success, or improving services that contribute to business success. Incentives tied only to the attainment of service levels are generally a bad idea – why should clients pay a bonus for services they’re already paying to receive? Moreover, exceeding established service level targets generally adds no value to the client. Achievement bonuses are typically one-time payments for reaching certain milestones. These may be tied to earlier-than-expected completion dates, higher-than-committed critical service levels (only if this overachievement adds additional value to the client), or better-than-expected throughput. Comparative rankings, whereby top performers receive bonus payments, can encourage continuous improvement and innovation when multiple providers for the same services are involved. Characteristic of incentive programs include:Key personnel for both the vendor and client organizations have individual incentives related directly to organizational incentives, which in turn are aligned with business goals and objectivesPayments made annually to individuals who have made a significant contribution to the outsourced account – based on nominations from peers, management from both sides, or other agreed upon criteriaPayments based on the mutual attainment of goals by vendor and client where only combined attainment results in payment to either party- thereby motivating both to work together more effectively to realize goalsGain-sharing, where the vendor receives a portion of any additional savings generated from, for example, reducing costs of raw materials, implementing new technologies, or recommending and implementing improvements in operations. Gain-sharing splits typically range from 50/50 to 75//25 in favor of the client and are generally subject to time limitsSavvy organizations recognize that penalties and incentives are powerful tools that, used wisely, can build effective, successful, and innovative outsourcing deals. For management, the key is to apply these tools in a fair and consistent manner. Unenforced penalties lose their value, erode management credibility, and can undermine the entire relationship. Similarly, incentives must be honored when the goals are achieved. Unrewarded effort is unlikely to be repeated, and unmet promises may foster resentment and a decline in future performance – which is worse than offering nothing at all. Both client and vendor should seek to marshall resources to identify and correct problems that are causing penalties. And both organizations should want their own and their partner’s team recognized and rewarded for their achievements.Dawn Willis is a Compass executive consultant based in Canada. Related content news analysis DHS unveils one common platform for reporting cyber incidents Ahead of CISA cyber incident reporting regulations, DHS issued a report on harmonizing 52 cyber incident reporting requirements, presenting a model common reporting platform that could encompass them all. By Cynthia Brumfield Sep 25, 2023 10 mins Regulation Regulation Regulation news Chinese state actors behind espionage attacks on Southeast Asian government The distinct groups of activities formed three different clusters, each attributed to a specific APT group. By Shweta Sharma Sep 25, 2023 4 mins Advanced Persistent Threats Cyberattacks feature How to pick the best endpoint detection and response solution EDR software has emerged as one of the preeminent tools in the CISO’s arsenal. Here’s what to look for and what to avoid when choosing EDR software. By Linda Rosencrance Sep 25, 2023 10 mins Intrusion Detection Software Security Monitoring Software Data and Information Security feature Top cybersecurity M&A deals for 2023 Fears of recession, rising interest rates, mass tech layoffs, and conservative spending trends are likely to make dealmakers cautious, but an ever-increasing need to defend against bigger and faster attacks will likely keep M&A activity steady in By CSO Staff Sep 22, 2023 24 mins Mergers and Acquisitions Data and Information Security IT Leadership Podcasts Videos Resources Events SUBSCRIBE TO OUR NEWSLETTER From our editors straight to your inbox Get started by entering your email address below. Please enter a valid email address Subscribe