An internal auditor performed a review of IT outsourcing and found that the service provider was failing to meet the terms of the service level agreement. Which of the following approaches is most appropriate to address this concern?

When a service provider fails to meet the terms of a Service Level Agreement (SLA), the most appropriate and immediate response is to actively manage and enforce the existing contract. This involves a structured process of monitoring performance against agreed-upon metrics, formally escalating the identified failures to the provider's management for resolution, and, if necessary, invoking contractual remedies such as penalty clauses. This approach directly addresses the breach of contract, seeks timely remediation, and protects the organization's interests as defined in the outsourcing agreement. It is a fundamental practice in effective vendor and contract management.

A. This addresses a potential root cause (lack of skills) but is a secondary diagnostic step; the primary action is to enforce the existing agreement.
C. This describes a broader governance framework for all outsourced services, not the specific, immediate action required to address a current performance failure.
D. Reviewing the agreement is premature when the immediate issue is non-performance; the first step is to enforce the current terms, not renegotiate them.

1. The Institute of Internal Auditors (IIA)

Global Technology Audit Guide (GTAG) 7: Information Technology Outsourcing

2nd Edition.

Page 16

"Monitoring the Outsourcing Arrangement": This section emphasizes that "Monitoring activities should be performed to ensure that the service provider is meeting its contractual obligations

including service-level agreements (SLAs)." It further states that the organization should "review performance reports and other documentation... and escalate issues as appropriate." This directly supports the monitoring and escalation components of the correct answer.

Page 17

"Contract Management": This section lists key contract provisions

including "penalties for nonperformance

" which aligns with the use of penalty clauses mentioned in the correct answer.

2. ISACA

COBIT 2019 Framework: Governance and Management Objectives.

APO10 Managed Vendors

Practice APO10.04 "Monitor vendor performance and compliance": This practice states that the enterprise should "Periodically review vendor performance against targets... and address identified deviations." and "Review vendor compliance with contractual requirements." This supports the proactive monitoring and addressing of concerns as the primary approach.

3. Goo

J.

Huang

C. D.

& Hart

P. (2008). An exploration of the role of service level agreements in reducing outsourcing risks. Decision Sciences

39(3)

499-531.

Page 503

Section 3.1 "SLAs as a Control Mechanism": The article explains that SLAs serve as a formal control mechanism that specifies performance metrics and "remedies for non-performance (e.g.

penalties)." This academic source confirms that monitoring performance and applying penalties are core functions of an SLA to manage vendor relationships and address failures. (https://doi.org/10.1111/j.1540-5915.2008.00201.x)