GB/Z 42749.6-2025Information technology - IT Enabled Services-Business Process Outsourcing (ITES-BPO) lifecycle processes - Part 6: Guidelines on risk management (English PDF)

Foreword

This document is a standard or guiding technical document.

This document complies with the provisions of GB/T 1.1-2020 "Standardization Work Guidelines Part 1: Structure and Drafting Rules of Standardization Documents".

Drafting.

This document is the lifecycle process of GB/T (Z)42749 "Information Technology IT Enabled Services Business Process Outsourcing (ITES-BPO)".

Part 6: GB/T (Z)42749 has published the following parts.

---Part 1: Process Reference Model (PRM);

---Part 2: Process Evaluation Model (PAM);

---Part 3: Measurement Framework (MF) and Organizational Maturity Model (OMM);

---Part 4: Terminology and Concepts;

---Part 5: Guidelines;

---Part 6: Risk Management Guide;

---Part 7: Maturity Assessment Examples This document is modified to adopt ISO /IEC TS30105-6:2021 "Information Technology - IT-Enabling Services - Business Process Outsourcing (ITES-BPO)".

"Life Cycle Process Part 6: Risk Management Guidelines". The document type has been changed from an ISO /IEC technical specification to a Chinese national standard.

Technical guidance documents.

This document has undergone the following structural adjustments compared to ISO /IEC TS30105-6:2021.

---Sections 6.5 and 6.6 correspond to Chapters 7 and 8 of ISO /IEC TS30105-6:2021, respectively, to clarify the risk management process and avoid...

Ambiguity;

---Chapters 5 and 6 provide an overview of the hierarchical adjustments to adapt to my country's technological conditions and increase operability.

The technical differences between this document and ISO /IEC TS30105-6:2021, and the reasons therefor, are as follows.

---The normative reference document GB/T 42749.4-2023 (see Chapter 3) has been added to adapt to my country's technical conditions and increase operability.

Actual nature;

---ISO Guide 73 (see Chapter 3) has been removed from normative references to adapt to my country's technical conditions and increase operability.

Actual nature;

---Figure 4 has been modified to better understand the risk management process and eliminate ambiguity.

This document has undergone the following editorial changes compared to ISO /IEC TS30105-6:2021.

---The headings 4.1.1 and 4.1.2 have been deleted, and their content has been integrated into 4.1. The third paragraph of 4.1.2 has been moved to 6.3.1.

---Columns have been added in sections 5.3, 5.4, and 6.2.2 to clarify the hierarchy.

Introduction

ITES-BPO services include the business process of assigning one or more IT enabling services to a service provider, which is then authorized by the service provider through a contract.

The service provider shall provide services using appropriate technologies. The service provider is responsible for managing, delivering, improving, and executing the outsourced work according to predetermined measurable performance indicators.

Processes. ITES-BPO services cover a diverse range of business processes, such as finance, people management, administration, healthcare, banking, and finance.

Services, supply chain management, hospitality and tourism, media, market research, data analytics, telecommunications, manufacturing, etc. These services will serve customers worldwide.

It provides business solutions to customers and forms an integral part of their core service delivery chain.

GB/T 42749 specifies the requirements for the lifecycle process in the ITES-BPO service industry.

---From the perspective of service providers performing ITES-BPO services for clients, this provides information applicable to all parties in the ITES-BPO service industry.

The standard applies to any service provider offering ITES-BPO services to clients across various industries under contract.

---It covers the entire lifecycle of ITES-BPO services and clarifies the process of best practices;

---Improved Standards. Service providers performing ITES-BPO services can use this document to conduct process capability gap assessments and improve;

---A universal standard applicable to all types and natures of ITES-BPO services;

---Delivers a clear return on investment for customers and service providers;

---Improve the consistency, quality, and predictability of service delivery.

Figure 1 shows the main organizations involved in ITES-BPO services and their relationships, including clients, service providers, and suppliers at various levels.

This is essentially consistent with the supply chain relationship described in section 8.3 of ISO /IEC 20000-1.2018.

Figure 1.Major ITES-BPO Organizations The relationship between the parts of GB/T 42749 is described in Figure 2.

GB/T 42749 clarifies the process requirements for service providers to implement the ITES-BPO lifecycle. It defines the planning, establishment, and implementation processes.

The process of implementing, operating, monitoring, reviewing, maintaining, and improving its services is proposed to consist of nine parts.

---Part 1: Process Reference Model (PRM). The purpose is to provide a process reference model that defines the ITES-BPO lifecycle.

The process, its objectives, and its outcomes. The process objectives detail the results of successful process implementation and provide insights for stakeholders.

It delivers a return on investment. Process outcomes are observable implementation results that align with the business benefits gained by clients and service providers.

---Part 2: Process Evaluation Model (PAM). The purpose is to provide an example model for performing process evaluation, which uses...

It is based on and directly compatible with the process reference model in GB/T 42749.1-2023.

The 2023 External Process Reference Model provides process dimensions. The capability model in GB/T 42749.2-2023 is based on GB/T The process capability measurement framework defined in 42749.3-2023.This involves adopting comprehensive indicators of process performance and process capability.

This collection expands upon the ITES-BPO process reference model and process capability measurement framework.

---Part 3: Measurement Framework (MF) and Organizational Maturity Model (OMM). The aim is to define a process capability measurement framework and group...

The organizational maturity model clarifies the assessment methodology for evaluating process capability levels and organizational maturity levels, helping organizations to use the model effectively.

Conduct process capability level and organizational maturity level assessments.

---Part 4: Terms and Concepts. The purpose is to define the terms and concepts in GB/T 42749 and to describe the terms and concepts in GB/T 42749, Section 1.

The relationship between Part 1 and Part 5 is shown in Figure 2, which provides guidance for process tailoring and application, helping users understand and apply it.

GB/T 42749.

---Part 5: Guidance. The purpose is to provide guidance for the use of GB/T 42749, and also to provide guidance for process capability gap assessment.

Guidance helps organizations assess process capability gaps and improve processes.

---Part 6: Risk Management Guidelines. The purpose is to provide a risk management practice guide for service provider outsourcing processes, offering guidance for service providers.

Provide guidance to service providers on planning, establishing, implementing, operating, monitoring, reviewing, maintaining, and improving their risk management framework.

---Part 7: Maturity Assessment Examples. The purpose is to provide maturity assessment examples for using GB/T 42749, clarifying through these examples...

Clearly demonstrate the assessment methods and requirements defined in Parts 1 to 3 of GB/T 42749, and in accordance with Part 1 of GB/T 42749.

Parts 5 and 6 are used in conjunction with each other to assist assessors in collecting objective evidence and determining process capability levels and organizational maturity levels.

---Part 8: ITES-BPO Continuous Performance Improvement. The purpose is to describe the continuous performance improvement assessment method and its elements, and is a...

The extension of the continuous improvement processes defined in GB/T 42749.1-2023 contributes to the performance of ITES-BPO service providers.

improve.

---Part 9: Extended Guidelines for Capability Assessment of Digital Transformation Processes. The aim is to provide guidelines for ITES-BPO service providers in implementing...

This document outlines the fundamental requirements for digital transformation that need to be considered during the process, clarifies the key drivers for improving an organization's digital transformation capabilities, and provides guidance for...

ITES-BPO organizations provide guidance on process capability assessment for digital transformation.

1 Scope

This document provides a risk management practice guide for ITES-BPO service providers in the outsourcing process, guiding ITES-BPO services.

The provider plans, establishes, implements, operates, monitors, reviews, maintains, and improves its risk management framework. The guidance in this document conforms to...

GB/T 24353-2022, from the perspective of ITES-BPO service providers, elaborates on risk management principles, risk management frameworks, and risk management...

Process.

This document applies to ITES-BPO service providers managing all processes throughout their lifecycle.

2 Normative references

The contents of the following documents, through normative references within the text, constitute essential provisions of this document. Dated citations are not included.

For references to documents, only the version corresponding to that date applies to this document; for undated references, the latest version (including all amendments) applies.

This document.

GB/T 24353-2022 Guidelines for Risk Management (ISO 31000:2018, IDT)

GB/T 42749.4-2023 Information Technology (IT) Enabled Services Business Process Outsourcing (ITES-BPO) Life Cycle Process, Part 4 Part. Terminology and Concepts (ISO /IEC 30105-4:2022, MOD)

3 Terms and Definitions

The terms and definitions defined in GB/T 24353-2022 and GB/T 42749.4-2023 apply to this document.

4 Risk Management Principles