Operational risks should be identified, categorized and quantified using a best practices model.  One area that is easy to overlook in creating a baseline for sourcing evaluation purposes is the ever changing landscape of regulatory requirements.  Depending on your business model and strategy, there may be regulatory challenges that will be pertinent in the near future but may not be pertinent today. 

One example of this is a company that currently uses merchant processors for retail outlets and does not perform its own credit card processing.  For example, company "X" has announced its intention to evaluate alternatives for the sourcing of it's IT function.  Currently, company "X" does not store and manage customer credit cards and is therefore not subject to the controls and processes required by the Payment Card Industry (PCI).  If this was not addressed and managed as part of the "Baseline" requirements, there would be financial ramifications for both parties when that requirement became a business requirement.

This is a very simple scenario that would probably identified be during a comprehensive due diligence process, however, if there is a weak system of process and controls for a company, there will more than likely be other changes that arise due to business or regulatory change.  The ControlOrigins model is driven by a comprehensive mapping of risks, controls and procedures that are then referenced to best practice frameworks as well as regulatory requirements.   The potential risk of missing a key future requirment of need for future process improvement is minimized with our model.