make-or-buy decisions

A make-or-buy decision is a strategic management tool used to determine whether a company should produce a product, component, or service in-house (Make) or purchase it from an external supplier (Buy). This decision goes beyond a simple cost comparison to include a comprehensive assessment of core competencies, production capacity, technological control, and supply chain risks. Within a risk management system, this decision is the starting point for supplier risk management. Choosing to 'buy' obligates the company to comply with standards like **ISO 9001:2015, Clause 8.4 (Control of externally provided processes, products and services)**, which requires establishing controls for supplier selection, performance monitoring, and risk mitigation. Furthermore, outsourcing involving sensitive information necessitates implementing supplier security controls as outlined in **ISO 27001:2022, Annex A.5.19 to A.5.23**, to ensure information security across the supply chain.

Applying make-or-buy decisions in enterprise risk management follows a structured process: 1. **Strategic Assessment**: Align the decision with corporate strategy by identifying if the product/service is a core competency. If so, 'make' is preferred to protect intellectual property. 2. **Quantitative Cost-Benefit Analysis**: Calculate the Total Cost of Ownership (TCO), comparing the fixed and variable costs of 'making' against the purchase price and associated costs of 'buying'. 3. **Qualitative Risk Assessment**: Using the **ISO 31000 risk management framework**, evaluate and compare the risks of both options, such as supply disruption, quality inconsistency, and IP leakage for 'buy' versus operational risks for 'make'. For example, a Taiwanese IC design house must weigh licensing fees against R&D costs, while also assessing the risk of technology dependency from buying. This process enables quantifiable benefits, such as increasing supplier compliance rates to over 95%.

Taiwanese enterprises face three primary challenges: 1. **Supply Chain Concentration**: High dependency on a few key suppliers, especially in the tech industry, amplifies disruption risks when choosing to 'buy'. The solution is to establish dual-sourcing strategies and conduct supplier risk assessments based on **ISO 22301 (Business Continuity Management)**. 2. **Inadequate IP Protection**: When outsourcing R&D or manufacturing, SMEs in Taiwan are vulnerable to trade secret theft due to weak contracts or monitoring. Mitigation involves implementing **ISO 27001**, enforcing robust NDAs with specific security clauses, and conducting regular supplier security audits. 3. **Asymmetric Decision Information**: Inaccurate internal cost accounting can lead to underestimating 'make' costs or overlooking the hidden costs of 'buy' (e.g., management overhead). The remedy is to adopt Activity-Based Costing (ABC) and data-driven Supplier Lifecycle Management systems. A priority action is to map core technologies and complete risk assessments for critical suppliers within three months.

Winners Consulting specializes in make-or-buy decisions for Taiwan enterprises, delivering compliant management systems within 90 days. Free consultation: https://winners.com.tw/contact