An enterprise that provides standardized outsourced IT services has signed a new contract with a...

Managing a “demanding major client” within existing risk tolerance requires a fact-based risk analysis of what could go wrong in service delivery and how likely/impactful those outcomes are. The best approach is to use historical KPI performance (e.g., availability, incident response times, change success rate, backlog, defect rates) to build realistic risk scenarios for this contract—identifying where performance variability could breach new expectations and what controls, capacity, or process changes are needed. COBIT risk management practices emphasize analyzing risk scenarios with supporting evidence and using performance/risk metrics (KPIs/KRIs) to understand and monitor exposure.

Benchmarking (A) can help with competitiveness, but it is less direct than scenario-based analysis grounded in the enterprise’s own delivery data and may not reflect the specific contract demands. Adjusting risk tolerance (B) to match a client is the wrong direction—risk tolerance is an enterprise governance decision driven by stakeholders, not negotiated per-customer. Transferring risk to insurance (D) may reduce financial impact, but it cannot guarantee reputational protection and does not remove the need to manage operational delivery risk.