Outsourcing decisions are rarely lost on price. They are lost on three clauses almost nobody negotiates properly: what is actually in scope, how performance is measured, and what happens on the day you want to leave. A provider who is cheaper per transaction but holds your payroll master data in a format only they can read is not cheaper - the cost simply moves from the invoice to the exit. This page sets out how we help organizations in Saudi Arabia decide what to outsource, evaluate outsourcing companies on evidence rather than on a pitch, and structure the scope, service levels and exit terms that keep the arrangement reversible. It is written for the operate phase - if you have not yet registered an entity or completed the registrations that follow it, the earlier steps are covered in Business setup in Saudi Arabia, and this page picks up where that one ends.
The question worth asking first is not whether to outsource but what. A useful test has three parts, and a function needs all three before it is a sound candidate: it is rule-governed rather than judgement-led, so performance can be specified in advance; it is measurable, so you will know within a month rather than a year whether it is being done properly; and it is non-differentiating, so no competitive advantage leaves the building with it. Transaction processing, payroll execution, bookkeeping to trial balance, first-line IT support and accounts payable clear that bar routinely. Regulator-facing judgement, the design of your chart of accounts, anything holding master data you have not modelled yourself, and whatever your customers actually buy you for do not.
Two distinctions are worth fixing before any conversation with a provider, because they decide which contract you are negotiating. Business process outsourcing (the BPO model, and the sense in which most Saudi buyers use "outsourcing") hands a whole process and its outcome to a provider who runs it on their own systems and staff, and is accountable for the result. Staff augmentation places people under your direction to do work you still manage and remain accountable for. They carry different risk, different cost curves and very different regulatory treatment, and a provider who is vague about which one they are selling is selling the second while pricing it like the first.
One principle governs everything below, and it is the one most often assumed away: outsourcing a process does not outsource the obligation attached to it. If a provider files your VAT return late, ZATCA assesses you. If e-invoicing is non-compliant, it is your compliance that is defective. If employee data is mishandled, you are the controller under the Personal Data Protection Law and the provider is your processor. Delegation of work is not delegation of liability anywhere in Saudi regulation, and a contract cannot make it so. What a contract can do is give you the visibility, the evidence and the remedies to manage a risk that remains yours - which is precisely what the scope, SLA and exit terms are for.
The organizations that get the most from this work usually recognise themselves in several of the following at once, not just one.
We turn down more outsourcing engagements than we take, and these are the cases where the honest answer is no.
We use the same five-stage method here as everywhere else in the practice, described in full on our how we work page. It matters more than usual on outsourcing, because the decision is being made in a market where most of the available advice is published by firms who would also like to be the provider. We do not deliver outsourced processes ourselves and we take no commission from the providers we assess, so "keep this in-house" and "your current provider is adequate, renegotiate the contract" are answers we are free to give - and give often.
We start with the process as it actually runs, not as the procedure document describes it. That means mapping the real volumes, the peaks, the handoffs and the exceptions - because exception handling is where outsourcing contracts are won and lost, and it is almost never in the baseline a provider is asked to price. We establish the true current cost, including the portion sitting in other people's job descriptions, the systems in place and what they can and cannot support, the regulatory obligations attached to the process, and the outcome you actually want. The output is a written problem definition and a candidate scope you own and can use with any adviser, including none.
Evaluation criteria are agreed and weighted before any provider is named, which is the single most effective safeguard against a comparison that quietly reverse-engineers itself around a preferred bidder. We then assess outsourcing companies against those criteria on evidence: the licences and registrations the arrangement requires them to hold, their real delivery footprint in the Kingdom as opposed to a registered address, the seniority and turnover of the team who would actually serve you, their systems and whether those can integrate with yours, their security and data-protection posture, their financial stability, and their references from clients of comparable size and sector. We also read what they propose to sign, because a provider's standard contract tells you more about how they behave under pressure than their presentation does.
You receive a written recommendation with the reasoning visible: the scored comparison, the scope boundary with the exclusions stated explicitly, a service-level framework tied to your outcomes, the full cost picture including transition and governance, the risks and how the contract addresses each, and the exit provisions. Where the recommendation is to retain the function or to stay with your incumbent on renegotiated terms, that is what the document says. We support the negotiation itself, which is usually where the value of an independent adviser is most visible - a provider negotiates these contracts weekly, and most buyers negotiate one every few years.
Transition is the risky part, and it is where arrangements that were sound on paper fail. We run it as a controlled handover with a parallel-run period, documented acceptance criteria, an agreed data migration with reconciliation on both sides, and a knowledge transfer that is written down rather than demonstrated once. Integration between the provider's systems and yours is designed here rather than improvised later, so that your own records remain complete and current throughout - if the only complete copy of your payroll or ledger history ends up on the provider's platform, the exit clause you negotiated in Stage 3 becomes unenforceable in practice.
Outsourcing arrangements degrade quietly. Volumes drift from the baseline, scope creeps in both directions, the provider's good team is moved to a new client, and the service-level report keeps showing green because it measures the wrong thing. We stay on as your side of the governance: reviewing performance against the outcomes rather than the dashboard, keeping the retained team capable of holding the provider to account, and flagging in good time when a renewal, a renegotiation or an exit is the right move. Retained capability is not overhead - it is the only thing that makes the exit right real.
Our engagement is the advisory layer around the decision and the contract. We do not operate the outsourced process - that is the provider's job, and keeping the two roles separate is what makes the assessment credible.
Duration is driven by how many processes are in scope, how well documented they are today, and how many providers genuinely need assessing - not by the size of your organization. Two engagements of identical headcount can differ by months on documentation quality alone.
| Stage | What drives the duration |
|---|---|
| Baseline and decision paper | Number of processes in scope, quality of existing documentation, and availability of the people who actually run the work |
| Criteria and provider assessment | Size of the credible provider set, and how long reference checks and evidence requests take to come back |
| Recommendation and negotiation | Your internal approval path, and how far the provider's standard terms sit from what the scope, SLA and exit review requires |
| Transition and parallel run | Data quality, system integration, and whether a full reporting cycle - a payroll month, a VAT period, a close - has to complete before acceptance |
| Governance | Ongoing; reviewed on an agreed cadence for as long as the arrangement runs |
One timing rule is worth stating because it is regularly broken: do not cut the parallel run to hit a go-live date. A payroll or a statutory filing that has never run correctly on the new arrangement before cut-over is a defect waiting for the worst possible month to appear in, and the parallel run is the only stage of the whole programme that reliably prevents it. We scope the specific timeline against your actual position during Stage 1 rather than quoting a standard duration here that would not hold.
Two cost questions sit inside this heading - what our advisory work costs, and what the outsourcing arrangement itself will cost you. The second is the larger number by a wide margin, and it is the one most often mis-estimated.
How we engage. Stage 1 is a scoped, fixed-fee engagement rather than a sales call, and its output - the written problem definition and candidate scope - is yours whether or not you continue with us. Stages 2 and 3 are commonly run together as a fixed-fee evaluation and recommendation. Stage 4 is scoped separately once the shape of the transition is known, because pricing it before the provider and the data position are settled would be guesswork. Stage 5 is a retained advisory arrangement on an agreed cadence. We are paid by you and only by you, which is what allows the recommendation to be genuinely neutral.
The models you will be offered. Providers price in four broad shapes, and the shape matters more than the rate:
What the arrangement really costs. The fee is one line of several. Budget also for transition and data migration; the retained team who manage the provider, which is a permanent cost and the one most consistently omitted from the business case; system integration and any licence changes; governance and reporting time; out-of-scope and change-request charges, which are where a competitive headline rate is frequently recovered; annual uplift or indexation clauses; and the exit cost - transition assistance, data extraction, parallel running with a successor, and the cost of rebuilding capability you let go. Against that sits the honest comparison: not the provider's fee against your current salary line, but the fee plus everything above against the fully loaded in-house cost including systems, management time, recruitment, cover for absence and the risk of key-person dependency. We build that comparison explicitly, because a business case that omits the retained team and the exit is not a comparison at all.
Five situations account for most of the work we take on.
Three regulatory realities shape all five, and they are worth stating plainly because they are the ones most often discovered after signature. Saudization is assessed against the entity the staff are registered under - moving roles to a provider does not, in itself, improve your position, and depending on the contracting structure it can change how headcount is counted in ways that matter. The treatment is fact-specific and the rules in this area have changed more than once, so we confirm the position for your actual structure with current MHRSD requirements rather than publishing a general rule here that would be wrong for some readers. Under the Personal Data Protection Law you remain the controller of employee and customer data your provider processes, which means controller-processor terms, defined purposes, security requirements, breach notification and a clear position on where data is hosted and whether it leaves the Kingdom. And ZATCA obligations stay with you: e-invoicing compliance, filing accuracy and record retention are assessed against the taxpayer, not the bookkeeper. Each of these belongs in the contract as a specific obligation with evidence attached, not as a general compliance warranty.
We are not going to put a percentage here. The saving a given organization achieves depends on its starting cost base, its volumes and how much of the work was previously invisible inside other roles, and a headline figure lifted from one engagement would tell you nothing useful about yours.
What we can describe honestly is the shape of what changes, because it is consistent. The business case stops being a comparison of a fee against a salary line and starts including the retained team, the governance and the exit - which sometimes reverses the decision, and always improves it. Scope stops being a page of aspirations and becomes two explicit lists with the boundary cases assigned, which is what removes the change-request surprises that erode the saving in year two. Service levels start measuring outcomes the business recognises rather than provider activity. And the exit provisions become real - notice periods, data returned in a usable format on a defined timetable, and a duty to cooperate with a successor - which is what preserves your negotiating position at every renewal that follows, whether or not you ever use it. Documented engagements are published individually on our success stories page as clients clear them for release.
The honest answer starts by splitting the question, because "implementation" covers two very different periods. The advisory work - baseline, evaluation, recommendation and contract - is driven by how many processes are in scope, how well documented they are and how many providers need genuine assessment. The transition that follows is driven by data quality, system integration and, decisively, by how many full reporting cycles must complete before acceptance: a payroll runs monthly, a VAT period runs quarterly, and no amount of resourcing makes a parallel run finish faster than the cycle it is testing. That last constraint is why mid-size and large organizations often converge on similar timelines - it is process count and cycle length that dominate, not headcount. The reliable way to extend a timeline is to discover during transition that the process was never documented, which is what Stage 1 exists to catch. We scope a realistic timeline against your actual position rather than quoting a standard duration that would not hold.
There is no licence price - outsourcing is a service arrangement, not a product - but the instinct behind the question is exactly right, and three years is the correct window because years two and three are where the economics actually show up. Over three years, budget for the provider fees including any annual uplift or indexation clause; transition and data migration; the retained team who govern the arrangement, which is permanent and is the single most commonly omitted line in these business cases; system integration and licence changes; out-of-scope and change-request charges, which is where a competitive headline rate is frequently recovered and which a tight scope statement controls; and the exit cost, including transition assistance, data extraction and the cost of rebuilding capability. Compare that total against the fully loaded in-house alternative - salaries, benefits, GOSI, systems, recruitment, management time, absence cover and key-person risk - rather than against the salary line alone. We build this for your actual volumes at the start of an engagement, not at the end, because it is the comparison the decision turns on.
Outsourcing is lawful; whether a particular arrangement complies is what needs establishing, and it turns on three things. First, the provider must hold the licences and registrations the arrangement actually requires - which depends on whether you are buying a managed process or the supply of labour, a distinction with real regulatory consequences that providers sometimes blur - and we verify this rather than accepting a general assurance. Second, obligations that remain yours must be discharged: ZATCA filing and e-invoicing compliance, WPS wage reporting, GOSI, and your Saudization position, which is assessed against the entity your staff are registered under and whose treatment under an outsourcing structure is fact-specific enough that we confirm it against current MHRSD requirements for your case rather than generalising. Third, data residency is a live and separate question: under the Personal Data Protection Law you remain the controller of employee and customer data your provider processes, and the law and its implementing regulations constrain where that data may be hosted and when it may be transferred outside the Kingdom - a point that becomes sharp when the provider runs a regional platform hosted elsewhere. We work through the requirements your specific activity triggers rather than leaving them to surface after the contract is signed.
All of them, and outsourcing is frequently not the recommendation. Four alternatives are assessed as a matter of course. Keep it in-house and fix the process - the right answer where the function is broken rather than under-resourced, since outsourcing confusion only relocates it. Keep it in-house and fix the systems - a great deal of what gets outsourced as a capacity problem is really a manual-process problem, and a properly configured platform can remove the volume rather than move it, which is the substance of our Accounting systems and HR & payroll systems evaluations. Renegotiate with the incumbent - where an arrangement already exists, restructuring the scope, service levels and exit terms is usually faster, cheaper and less risky than switching provider, and it is one of our most common recommendations. A hybrid - outsource the rule-governed, high-volume processing and retain the judgement, review and regulator-facing work, which is where most well-designed arrangements end up. Because we take no commission from providers and do not deliver outsourced services ourselves, each of these is an answer we are free to give.
Usually yes, and this question deserves more weight than it normally gets, because the integration design is what determines whether your exit rights are real. Three requirements matter. Your systems must remain the system of record for your own data, with the provider working in them or synchronising into them - if the only complete payroll or ledger history ends up on the provider's platform, you have created a dependency no contract clause can undo. Data must flow both ways on a defined cadence, in a documented and non-proprietary format, so your records are complete and current at any moment rather than at the end of a notice period. And your reporting must run off your own data rather than arriving as the provider's PDF, or you cannot verify the service levels you are paying for. Most established accounting and HR platforms support this natively, so it is typically configuration and interface work rather than replacement. Replacement genuinely enters the conversation in two cases: your current platform cannot support multi-party access or export at all, or your data is not in a system in the first place. Working out which applies is part of Stage 1, and it is sequenced deliberately - a systems problem solved after the outsourcing contract is signed is solved on the provider's terms.
A heading that promises numbers and then supplies a percentage nobody can check is worse than one that says nothing, so we will be direct: we do not publish an aggregate saving figure, a client count or a satisfaction score for this practice. Those numbers are unverifiable by a reader, they are the easiest thing in the world to construct, and a finance director evaluating advisers should discount them wherever they appear - including here. The record that can be checked is the set of documented engagements on our success stories page, published individually with their context as clients clear them for release. If a number matters to your decision, ask for it during the initial evaluation and we will give you the real one for a comparable engagement, with the caveats attached.
The organizations that bring us this work share a situation rather than a sector: a back office that has fallen behind the business, or an outsourcing arrangement already in place that nobody can confidently say is working. In practice that means newly established entities building a finance and HR function from nothing, subsidiaries of foreign groups reconciling local statutory obligations with group reporting, fast-growing companies whose transaction volumes have outrun their processes, and established organizations approaching a contract renewal with no real exit position. Rather than listing names here ahead of their own confirmation to be featured, we keep the current, permissioned list on our customers page and update it as new relationships are cleared for publication.
Individual engagements - the process baselines, the provider evaluations, the contracts restructured rather than replaced, the transitions run in parallel before cut-over - are documented case by case rather than summarized here, because each turns on its own starting position and because publishing project detail requires the client's clearance first. Outsourcing work is also commercially sensitive in a specific way: a provider evaluation names providers, records what the assessment found, and often sits alongside a live contract negotiation. Our projects page carries the engagements cleared for public reference, including finance and HR operations work as it becomes available to share.
We do not publish a client quote until the client has reviewed and approved the exact wording attributed to them, so this section will carry real, attributed testimonials from outsourcing and back-office clients as those approvals come in, rather than a composite or paraphrased quote standing in for one now. If a specific reference matters to your own decision, raise it during the initial evaluation and we will connect you with a comparable past client where confidentiality allows - which on outsourcing engagements is genuinely more useful than a published quote, because the question you want answered is usually about the transition rather than the adviser.
This is the section where an outsourcing adviser's incentives are most worth examining, so here are ours. We do not deliver outsourced processes, we hold no reseller or referral agreement with the providers we assess, and we take no commission on any arrangement we recommend - which is what makes "stay in-house" and "renegotiate with your incumbent" available as conclusions. The relationships we do maintain are with the technology vendors and professional firms whose products and specialisms a client's solution sometimes requires, and where any of those is relevant to a specific evaluation we disclose it in the Stage 2 write-up rather than leaving it to be inferred. Our accreditations and technology partner network are listed on our partners page.
This page covers the decision and the contract. The steps before it are covered elsewhere in this cluster, and they run in sequence: if you are still deciding whether and how to enter the Saudi market, start with market entry advisory; if the decision is made but the entity does not exist yet, company formation in Saudi Arabia covers the entity, licence and commercial registration; and the registrations between a licence and a working operation - GOSI, the corporate bank account, premises, first hires and Saudization - are in Business setup in Saudi Arabia. If the underlying problem turns out to be a systems problem rather than a capacity one, which it often does, our Accounting systems and HR & payroll systems evaluations are the place to start instead. And the five-stage method behind all of it, including how we keep the evaluation vendor-neutral, is set out on how we work.
Here is a test you can run before speaking to anyone, and it takes about twenty minutes. Take your existing or proposed outsourcing arrangement and answer three questions in writing. What is explicitly out of scope - and can you name who handles exceptions, corrections, year-end and regulator correspondence? What does the service level actually measure - your outcome, or the provider's activity? And if you served notice tomorrow, what would you get back, in what format, by when, and could you run the process on it? If any of those three has no confident answer, that is the gap, and it will not close on its own - these clauses are only negotiable before signature and at renewal. Book a decision session and we will work through your actual position: which functions are sound candidates and which are not, what your current arrangement is really costing once the retained team and the exit are counted, and whether the right move is to outsource, to renegotiate, or to keep the work and fix the system underneath it. If our honest answer is the last of those, we will tell you - it is a shorter conversation and a more useful one.