Many organizations choose to shift some business processes and activities to outside service providers. This approach has become prevalent because of the benefits of obtaining access to low-cost human resources, reducing costs in the day-to-day management of certain functions, obtaining access to better processes and systems, and allowing management to focus more on the entity's mission.

Outsourced service providers can help organizations to perform business processes such as procurement, payables management, payroll, pension and benefit management, investment management, and stock-based compensation programs. Outside service providers may also perform technology activities that support business processes, providing services to procure, manage, and maintain previously internally managed technology systems. Advances in technology have created cost-saving opportunities through access to comprehensive architectures providing on-demand and scalable shared technology that supports more complex and changing business operations and that may be cost prohibitive for management as an internal investment.

This dependence on outsourced service providers changes the risks of business activities, increases the importance of the quality of information and communications from outside the organization, and creates greater challenges in overseeing its activities and related controls. While management can use others to execute business processes, activities, and controls for or on behalf of the entity, it retains responsibility for the system of internal control. For instance, management retains responsibility for specifying objectives, managing associated risks, and selecting, developing, and deploying control to effect components and relevant principles.

The Framework can be applied to the entire entity regardless of what choices management makes about how it will execute business activities that support its objectives, either directly or through external relationships.