Certified: The ISACA CGEIT Audio Course

In this episode, we’re going to look at how organizations decide whether to build something themselves, buy it from a provider, or share responsibility through some kind of partnership, and why that choice often shapes success more than the technology itself. New learners sometimes assume sourcing is basically shopping, where the best option is the one with the best features at the best price, but sourcing decisions are really about tradeoffs that affect control, speed, cost, and resilience for years. When an organization chooses a sourcing strategy, it is choosing how much it will depend on others, how quickly it can adapt, and how predictable its risks will be under pressure. Those choices matter in governance because a sourcing contract can lock in constraints, and reversing a bad sourcing decision can be far harder than reversing a bad tool choice. The goal is to learn how to evaluate sourcing options in a way leaders understand, while staying grounded in practical realities rather than wishful assumptions about what vendors or internal teams can deliver.

Before we continue, a quick note: this audio course is a companion to our course companion books. The first book is about the exam and provides detailed information on how to pass it best. The second book is a Kindle-only eBook that contains 1,000 flashcards that can be used on your mobile device or Kindle. Check them both out at Cyber Author dot me, in the Bare Metal Study Guides Series.

A sourcing strategy is the deliberate plan for how an organization obtains and operates the capabilities it needs, rather than treating each purchase as an isolated event. This includes decisions like building in-house, purchasing packaged solutions, using managed services, or outsourcing certain functions, and it also includes how contracts and relationships are structured over time. In Governance of Enterprise IT (G E I T), sourcing is not only about cost control; it is about ensuring the organization can deliver outcomes reliably and manage risk responsibly. Control refers to how much direct authority the organization has over design, change, and operations, and speed refers to how quickly it can deliver and adjust when needs change. Cost includes not only price, but also long-term operating burden, hidden integration effort, and the cost of switching later. Resilience is the ability to keep operating and recover when disruptions occur, including outages, vendor failures, and sudden demand shifts. Beginners often treat these as separate concerns, but sourcing ties them together because each sourcing model changes the balance. A mature sourcing strategy makes those tradeoffs explicit before money is committed and expectations become fixed.

Control is often the first dimension people think about, because control feels safe, but it is also easy to misunderstand. Having control does not mean simply owning the systems, because ownership without capability can still produce fragile outcomes. Building internally can provide deep control over priorities and customization, but it also requires the organization to sustain skills, staffing, and operational discipline over time. Buying a service can reduce the burden of day-to-day management, but it can also limit how quickly the organization can demand changes or respond to unusual needs. Control also includes control of data, which matters because data is often the most valuable and most sensitive asset being processed. If a provider holds critical data and controls how it is accessed or exported, the organization may be dependent even if the service is reliable. Beginners sometimes assume that outsourcing automatically reduces responsibility, but governance requires recognizing that accountability remains with the enterprise even when work is delegated. A strong sourcing choice is one where the level of control matches the risk and the importance of the capability.

Speed is the next dimension, and it is tempting to treat speed as a simple advantage of buying rather than building. External providers often have ready-made platforms, trained staff, and repeatable processes that can reduce time to delivery, especially for common needs. The catch is that speed can be real in the beginning while slowing down later, particularly when customization, integration, or compliance requirements become complex. For example, a service might be quick to deploy, but slow to adapt when the organization needs a change that is outside standard offerings. Internal development might be slower at first, but it can be faster later if the organization develops strong reusable components and a stable delivery pipeline. Speed also has a quality dimension, because rushing into a solution can create future drag in the form of rework, brittle integrations, and unclear accountability. In governance, speed must be understood as sustainable speed, meaning the organization can continue delivering changes without accumulating chaos. A sourcing strategy that looks fast on day one but creates long-term friction is not truly fast, it is a delayed cost.

Cost is often framed as the main reason for sourcing choices, but governance needs a broader view than sticker price. The Total Cost of Ownership (T C O) includes acquisition, implementation, integration, ongoing operations, training, licensing changes, scaling costs, and eventual exit or replacement costs. Beginners often miss that a low monthly price can hide high operational costs, such as constant customization, complex support coordination, or the need to hire specialists to manage the vendor relationship. Cost also includes opportunity cost, which is what the organization gives up when it spends time and attention on one approach rather than another. If a team is building a commodity capability internally, it may be sacrificing time that could have been used to build differentiating capabilities that truly set the organization apart. On the other hand, buying a complex service can create ongoing subscription costs that grow faster than expected as usage scales. Governance helps leaders compare costs honestly by forcing the full lifecycle costs into the conversation, not just the first invoice. When cost is evaluated in context, sourcing decisions become less emotional and more defensible.

Resilience is the dimension that is easiest to overlook during procurement, because resilience matters most during rare, stressful events. A sourcing strategy affects resilience by changing dependency patterns, failure modes, and recovery options. If a critical service is outsourced to a single provider, the enterprise may inherit that provider’s outages, business stability risks, and supply chain exposures. If a capability is built internally, resilience depends on internal staffing depth, documentation quality, and the ability to operate during absences and turnover. Resilience also includes geographical and operational redundancy, meaning the organization can continue operating when a region, network path, or vendor component fails. Beginners sometimes assume a large vendor is automatically resilient, but even large providers can have outages that affect many customers at once, and shared failures can be more damaging than isolated ones. Governance should ask what happens when things go wrong, not only how things work when everything is normal. A sourcing strategy that includes clear recovery expectations and tested continuity plans supports resilience far more than one that relies on optimism.

To balance these dimensions, it helps to understand the main sourcing models as patterns rather than as brands. In-house sourcing means the organization builds and operates the capability with its own staff and infrastructure, which can maximize control but also demands strong operational maturity. Outsourcing often means transferring responsibility for a function to an external party, which can increase speed and reduce internal burden, but it can also reduce visibility and create dependency. Managed services are a common hybrid, where a provider operates a service but the enterprise still sets goals, owns outcomes, and often shares responsibilities for configuration or governance. Cloud-based services can also be seen as sourcing, because they shift parts of infrastructure responsibility to a provider while keeping application and governance responsibilities internal. Beginners sometimes think the choice is binary, build or buy, but most real-world strategies blend models across different layers. Governance needs to evaluate the entire ecosystem, because mixing models without a plan can create gaps where nobody is clearly responsible. A sourcing strategy is strongest when responsibilities are explicit and aligned to the enterprise’s risk tolerance.

A key beginner misunderstanding is assuming that contracts can replace governance, as if writing requirements is enough to guarantee outcomes. Contracts matter, but they are not a substitute for oversight, measurement, and relationship management. A Service Level Agreement (S L A) can define availability targets, response times, and support expectations, but it cannot automatically ensure the provider’s internal practices match the enterprise’s risk needs. Even a well-written contract cannot eliminate the need to monitor performance, validate controls, and coordinate changes, especially when business needs evolve. Governance should treat contracts as tools that support accountability, not as shields that remove accountability. This also means understanding that compliance obligations and data protection responsibilities do not disappear when work is outsourced. If a provider mishandles data, the enterprise still faces consequences, including reputational damage and regulatory action. A mature sourcing approach plans for ongoing verification and clear escalation paths, rather than relying on legal language alone. When learners grasp this, sourcing becomes a governance discipline rather than a procurement event.

In practice, choosing a sourcing strategy begins with understanding the capability being sourced and how critical it is to enterprise outcomes. Some capabilities are differentiators, meaning they directly support what makes the organization unique, and those often justify more internal control or deeper partnership. Other capabilities are commodities, meaning many providers can deliver them reliably, and those often make sense to source externally to gain speed and predictable cost. Criticality also includes how sensitive the data is, how severe the impact of failure would be, and how hard it would be to switch providers. Switching difficulty is often underestimated, because integrations, data migrations, and operational retraining can create lock-in even when a contract allows termination. Governance helps by asking structured questions, such as whether the capability is core to strategy, whether internal skills exist, and what dependencies will be created. This approach also reduces emotional debates, because it frames the decision around enterprise needs rather than around preferences for building or buying. When the capability is understood, the sourcing choice becomes a targeted tradeoff rather than a guess.

Another essential part of balancing control and speed is deciding where standardization is beneficial and where flexibility is necessary. Standardization can reduce complexity and improve security by limiting variation, especially for common capabilities like identity, logging, or data handling. External sourcing can support standardization when the organization chooses a small set of approved providers and patterns, rather than allowing each team to procure independently. At the same time, innovation can require flexibility, such as the ability to experiment with new services or new delivery models without long procurement cycles. Governance can support this by defining guardrails for experimentation, such as limiting scope, requiring clear data handling rules, and setting review points before scaling. A sourcing strategy that supports innovation is not the one that allows uncontrolled purchasing; it is the one that provides a safe, fast path for controlled trials. Beginners sometimes equate governance with slowness, but well-designed sourcing governance can increase speed by reducing uncertainty and creating clear pathways. When teams know what is allowed and how to proceed, they spend less time negotiating and more time delivering.

Cost control also improves when sourcing is treated as an ongoing portfolio decision rather than as a one-time purchase. Over time, organizations often accumulate overlapping services, redundant contracts, and underused licenses, which creates waste and increases complexity. A capability-based sourcing approach can prevent this by asking whether each sourced service strengthens a capability measurably and whether that capability is already supported elsewhere. Governance can encourage consolidation where it reduces risk and improves efficiency, while still allowing diversity where it genuinely supports resilience. It can also require cost transparency, meaning leaders understand what costs are fixed, what costs scale with usage, and what costs may appear later due to add-ons or integration needs. Beginners often focus on the direct invoice, but the most significant costs often show up in operations, such as support coordination and the effort to manage changes across many providers. When sourcing is governed as a portfolio, the organization can reduce vendor sprawl and negotiate from a position of clarity. That clarity supports better decisions and often improves resilience as well.

Resilience deserves special focus in sourcing because external dependency can be both a strength and a risk. A strong provider may offer sophisticated redundancy and 24-hour operations that an internal team cannot match, which can improve resilience if the relationship is designed well. At the same time, concentration risk can increase if too much depends on one provider or one region, because a single failure can have wide impact. Governance should encourage thinking in failure scenarios, such as what happens if the provider has an outage, what happens if the provider’s supply chain is compromised, and what happens if the provider changes terms or direction. Another resilience concern is the ability to operate during disputes, such as billing disagreements or contract transitions, because operational continuity should not be fragile to commercial conflict. This is where exit planning becomes part of resilience, because an organization that cannot move away from a provider has limited leverage and limited recovery options. Beginners sometimes assume an exit plan is pessimistic, but in governance it is a practical requirement that strengthens resilience and bargaining power. When resilience is designed into sourcing, the organization becomes more stable under stress.

A related factor that affects control and resilience is visibility, meaning the enterprise can understand what is happening inside the sourced service well enough to manage risk. Visibility includes performance metrics, incident notification practices, audit evidence, and clarity about who is responsible for which tasks. Without visibility, an enterprise may discover problems late, respond slowly, or make incorrect assumptions during incidents. Governance should require enough reporting and evidence to make risk manageable, while avoiding unrealistic demands that providers cannot meet. For beginners, it helps to see that visibility is part of control, because you cannot control what you cannot observe. Visibility also supports analytics and operational learning, because it enables trend analysis and root cause understanding over time. A sourcing strategy that values visibility will often include regular reviews, defined escalation paths, and shared incident communication expectations. This reduces confusion during crises, which is when sourcing weaknesses become most costly. When visibility is strong, external sourcing can still feel governable rather than opaque.

Finally, making sourcing decisions leaders understand requires translating technical implications into value, risk, and constraints in plain language. Leaders may not care about architectural details, but they do care about whether the enterprise can deliver faster, avoid downtime, control costs, and protect sensitive information. A good sourcing decision narrative explains what the organization gains, what risks are introduced or reduced, what constraints exist, and how accountability will be maintained. It also clarifies what will be measured, such as reliability, response time, cost predictability, and security posture, because measurement turns sourcing from a promise into a managed relationship. Beginners should understand that sourcing is not merely choosing a vendor; it is choosing a relationship model that shapes how work gets done. When governance frames sourcing in outcome terms and plans for ongoing oversight, sourcing supports strategy instead of creating hidden dependency. That is the balance: enough control to manage risk, enough speed to deliver value, enough cost clarity to avoid surprises, and enough resilience to withstand disruptions without panic.

As we close, choosing sourcing strategies that balance control, speed, cost, and resilience is one of the most practical governance skills because it determines how the enterprise builds and operates its capabilities over time. Control must be matched to criticality and data sensitivity, speed must be understood as sustainable delivery rather than short-term acceleration, cost must be evaluated as T C O rather than as a price tag, and resilience must be designed into dependency patterns and exit options. Sourcing works best when responsibilities are explicit, visibility is strong, and contracts support accountability rather than pretending to replace it. For brand-new learners, the most important takeaway is that sourcing is a long-term tradeoff decision that shapes risk and performance long after the excitement of acquisition fades. When G E I T treats sourcing as a disciplined strategy, the enterprise can move faster with fewer surprises, protect what matters, and remain adaptable even when providers change or disruptions occur. That is how sourcing becomes a strength rather than a hidden fragility in the organization’s technology ecosystem.