In long-term outsourcing, POLISH maintains two lines at once. The contract defines scope and responsibility, and relational governance determines how matters the contract does not address are handled. Research evidence supports the two as complements, and public-sector outsourcing is also subject to legal requirements for a written contract that sets out rights, obligations and liability for breach.
What research says about contracts and relational governance
Poppo and Zenger, 2002 used a sample of information services exchanges to test whether formal contracts and relational governance can substitute for each other. The results point to joint use: managers tended to pair more customized contracts with higher levels of relational governance, and the interdependence of the two was associated with better exchange performance. The study covers information services exchanges.
Goo et al., 2009 surveyed information technology executives in South Korea and likewise found support for complementarity. A well-structured service level agreement (SLA) had a significant positive effect on relational norms, harmonious conflict resolution and mutual dependence, and also helped the partnership between the two parties develop. The study also found that the change characteristics of an SLA may weaken trust and commitment, which makes the SLA act more like a substitute for relational governance. The sample is IT executives in South Korea, and Taiwanese agencies operate under a different procurement system.
Lee and Kim, 1999 tested partnership quality across 74 outsourcing relationships, and the results show that partnership quality predicts outsourcing success. Participation, communication, information sharing and top management support all affect partnership quality positively. The study covers information systems outsourcing.
Lacity et al., 2009 reviewed 191 articles on IT outsourcing, and the abstract notes that relationship management has remained a long-standing and difficult topic across nearly 20 years of research. On this basis, POLISH treats the contract and relational governance as two pieces of work to be done together, and arranges participation, communication and information sharing anew every year.
What a public-sector outsourcing contract must contain by law
Article 10 of the Cybersecurity Management Act requires government agencies and designated non-government agencies, when outsourcing the building or operation of information and communication systems or the provision of information and communication services, to select suitable vendors, to require an effective information security management mechanism from the vendor and supervise it, and to set out rights, obligations and liability for breach in a written contract.
Article 7 of the Enforcement Rules of the Cybersecurity Management Act lists the matters an agency should consider when selecting and supervising an outsourced party, and requires regular audits of that party, or an inspection when an incident comes to light. The table below sets out what the two articles state.
| Contract and supervision matter | Source provision |
|---|---|
| Rights, obligations and liability for breach set out in a written contract | Cybersecurity Management Act, Article 10 |
| Selecting a suitable vendor, requiring an effective information security management mechanism and supervising it | Cybersecurity Management Act, Article 10 |
| Staffing | Enforcement Rules, Article 7 |
| Subcontracting | Enforcement Rules, Article 7 |
| Security testing of customized systems | Enforcement Rules, Article 7 |
| Incident reporting (the provision requires reporting immediately and gives no specific number of days) | Enforcement Rules, Article 7 |
| Handling of data when the contract ends | Enforcement Rules, Article 7 |
| Regular audits, or an inspection when an incident becomes known (the provision requires audits to be regular and gives no specific number of days) | Enforcement Rules, Article 7 |
The Administration for Cyber Security, 2026 measures for strengthening information security at each stage of acquiring information and communication systems likewise require agencies, when outsourcing, to select vendors with suitable experience and to supervise the vendor's information security practices.
The information security law FAQ from the Administration for Cyber Security explains the approach further: attention goes to selecting the outsourced party before outsourcing and to supervision afterward, and the recommended way to carry this out is through contract provisions and project management. An agency may require the outsourced party to have sound information security measures or third-party certification, state this in the tender documents and make it a scored item. The FAQ also recommends stating the certification and audit-acceptance requirements in advance, to avoid disputes over performance.
Outsourced customized development requires proof of security testing. For core systems, or for procurements worth ten million New Taiwan dollars or more, the testing is carried out by the agency itself or commissioned separately from a third party. The ten million New Taiwan dollars refers to the amount of the whole procurement, regardless of whether it covers hardware, software or services.
On the Outdoor Education Resource Platform, in the Ministry of Education project, POLISH took the work on from the design tender through to the engineering tender, cooperated with the vulnerability scans required by the competent authority, patched medium- and high-risk items, and handled appeals against false positives. The scans were arranged by the supervising agency, and POLISH assisted with patching and retesting. For the evidence that delivery and operations leave behind, see Delivery and Operations Evidence in Public-Sector Projects.
Matters the contract does not cover are handled by type
A contract cannot spell out everything. Each of the cases below comes from the Outdoor Education Resource Platform engagement, and each was handled differently.
- Matters the contract does not coverRaised in meetings or the shared discussion thread
- The project team decides the contentClarify the boundary firstThe platform implements only what is needed
- The terms need to grow with the platform contentPOLISH drafts first; meetings revise it step by stepAfter each discussion, the project team refines the terms
All cases come from the Outdoor Education Resource Platform engagement.
For the promotional emails of the Taiwan Outdoor Education Season, the two sides agreed that the project team would edit and send the emails from its own mailbox. POLISH asked the project team to plan first how prizes would be distributed across the activities, so that the platform scope to be implemented could be decided. The platform's role is support and announcements, and activity content follows the project team's judgment. The boundary has to be settled first, because only then is it clear what to build.
In the platform registration flow, the information for four member types requires agreement to cooperation terms. POLISH first drafted preliminary terms for one of the types and asked the project team to confirm the terms with the relevant units. POLISH also proposed scheduling meetings in the discussion thread, with the project team refining the terms after each discussion. The project team then drafted preliminary terms for all four member types.
For contingencies the contract does not itemize, there is also a fixed commitment: when a problem occurs in the system, POLISH will assign staff to handle it immediately. For how severity levels and targets are written, see How to Write an SLA That Works.
How the relationship is maintained
Checking proactively and preparing everything at once
POLISH checks before the other side asks, and prepares all materials in one pass.
A few days before the platform was due to send invitations to colleagues at partner units around the country to upload data, POLISH reviewed the admin console's invitation and registration flow item by item, aligned it with the back end, and settled it. An administrator enters an email address and basic details and then sends the invitation. An invitee goes from the invitation page straight into registration, skips the role selection step, and arrives with the data the administrator already entered; completing the form finishes registration, with no approval step. The aim was to lower the barrier for administrators entering records one by one and for new members registering, and to finish before the data upload date. The back end confirmed that it could be implemented this way.
Before a new phase began, POLISH proactively scheduled a meeting with the project team to align on the phase's items and the advertising content, and the result was reported to senior management once confirmed. On the day the project team's reporting schedule moved earlier, the project team asked POLISH to supply a draft plan for the next period first. The two sides moved the meeting up by about an hour, kept the original video link, and obtained the material needed for the report on time.
When the visual for the Taiwan Outdoor Education Season was finalized, POLISH supplied complete sizes for every use in one pass, covering social posts, stories, website banners and the remaining uses, with aspect ratios including 4:5, 9:16, 16:9 and 1:1. With the key visual and the sizes prepared together, each channel can take the files directly afterward.
POLISH makes recommendations; the project team decides
POLISH offers recommendations and comparison versions, and leaves the decision to the project team.
For the call-for-entries poster, POLISH proactively provided comparison versions at several aspect ratios (1:1, 4:3, 9:16), with and without the event flag, and exported the large files in one pass after the project team confirmed. The project team wanted the title to show the year. POLISH recommended showing the event period instead, because the event spans years and a year in the title would mislead later viewers. After the project team confirmed and adopted the recommendation, POLISH exported the version with the flag and, following an added request, supplied an extra fan page banner size of 1200x462.
Only one key visual is used for external promotion of the Season, a decision made by the project team, to avoid confusion. The other version is used within the site or on social media. Social media and the platform both then published the announcement that the Season had started.
On the day the live site's front end and admin console were switched over, a POLISH engineer first told the project team that work would basically follow the original schedule, and that anything needed from the project team would be raised right away. During the day, progress was synchronized through several short live voice meetings. The engineer concentrated on the switchover, the other staff were not interrupted, and people were brought in immediately when needed. After several short meetings, the front-end and admin-console switchover was complete.
The rhythm of multi-year cooperation
After the annual event ended, POLISH posted a brief analysis to the discussion thread. The project team said the following week's team discussion would need more detailed data, and POLISH supplied it the same day. After the discussion, the project team organized its feedback into a list and sent it back, covering adjustments to the mechanism, expansion of partnerships and venues, and target setting for the following year. The list became input for the next year's planning.
The diagram shows the review after one annual event. Position indicates order, not a schedule.
In multi-year cooperation, feedback comes from several directions. The project team forwarded feedback from partners and venue staff to the discussion thread, and POLISH replied that it had been received. On one occasion, the project team also asked POLISH to produce two images for wider promotion that same day. POLISH delivered the images that day and said it would continue to safeguard the platform going forward.
What to look for when choosing a vendor
At the tender and contract-signing stage, the vendor's written submissions can be checked against the regulations and the official FAQ. On the relationship side, the vendor's practice in past engagements and third-party comments are the evidence to look at.
- Whether the tender documents state requirements for information security management measures, certification and acceptance of audits, and list these as scored items.
- Whether the proposal explains the staffing and subcontracting arrangements.
- Whether the contract provides for incident reporting and for the handling of data when the contract ends.
- How the vendor handled matters the contract did not cover in past engagements, and whether concrete examples can be given.
- Third-party comments on collaboration with internal teams, with confirmation of which engagement a comment refers to.
A Gamania product lead, commenting on a brand redesign engagement, said that POLISH works efficiently with internal teams within a corporate framework. The comment concerns one brand redesign engagement and does not cover long-term operations.
For the evaluation scorecard and the pre-signing checks, see Evaluating a Software Vendor: A Scorecard and Pre-Contract Checklist. When changing vendors or taking over an existing system, the handling of data at contract end and the current state of the system need to be confirmed together. The process is in Full-Codebase Audit Process for Taking Over an Existing System.
Situations where this does not fit
- Small procurements with a fixed contract scope and a one-time delivery. The trend in the research is that the less customized the contract, the lower the level of relational governance paired with it.
- Projects with no decision-making contact yet. Relational governance depends on someone being able to decide during discussions, so when the contact is undecided, settle who decides what first, and then discuss the communication rhythm.
- Matters the law requires to be agreed in writing. Rights, obligations and liability for breach have to be written into the written contract and cannot be left to verbal understanding.
What to prepare before starting
POLISH recommends having the following materials ready before the first discussion, so that the contract and actual practice can be compared item by item.
- The tender documents or a draft contract, including requirements for information security management measures, certification and acceptance of audits.
- The contacts on the project team and at the supervising agency who decide external content and event rules, and the scope of each contact's decisions.
- A fixed communication channel and meeting rhythm, and the schedule milestones that must be reported to senior management.
- Documents needed for administrative procedures, such as a formal quotation.
- The previous year's performance data and feedback, as input for the next year's planning.
For POLISH's services, see Long-Term Operations and Platform Development. Once the materials above are ready, contact POLISH to arrange the first discussion.
