Holding and Enterprise Outsourcing | Sector-Specific Teams

Last updated: November 11, 2026

Outsourcing for holdings and corporate groups means running shared functions across several subsidiaries, such as SAP and ERP support, project management offices, security monitoring, finance and HR operations or software development, with an external partner under one governance model. For a group, the question is rarely whether a single task can be done cheaper; it is how to standardise service quality across companies, keep control and audit trails, and allocate costs fairly between subsidiaries. This page explains the typical problems of groups, how outsourcing relates to a shared service centre, which functions can be outsourced, relevant rules and standards, delivery and engagement models, the transition process, SLAs and KPIs, pricing factors, M&A situations, risks and a vendor checklist.

Typical challenges of holdings and corporate groups

Fragmented processes: each subsidiary runs its own tools, vendors and ways of working, which makes reporting and control difficult.
Duplicated cost: the same roles, licences and support contracts are paid several times across the group.
Uneven service quality: large companies in the group get good support, smaller ones are left behind.
Talent competition: SAP consultants, security analysts and experienced project managers are hard to hire and retain in every company.
Change pressure: acquisitions, carve-outs, ERP migrations and new regulations arrive faster than internal teams can absorb.

Shared service centre, outsourcing, or both?

Approach	Strength	Weakness	When it fits
Internal shared service centre (SSC)	Full control, group know-how	High fixed cost, slow to scale, long set-up	Large, stable volumes and a strong internal management team
Full outsourcing	Fast start, variable cost, access to specialists	Requires strong vendor governance	Non-core functions with clear service definitions
Hybrid (SSC plus partner)	SSC keeps decisions, partner adds capacity and specialist skills	Interfaces must be well designed	Most groups: core in the SSC, peaks and specialist work with the partner
Build-operate-transfer	Partner builds and runs a team, later transferred	Transfer terms must be agreed up front	Groups that want their own centre in the long run

Scope: functions that can be outsourced

Function	Typical roles	Scope examples
SAP / ERP	SAP functional and technical consultants, ABAP developers	AMS support, change requests, roll-outs to subsidiaries
PMO	Project and programme managers, PMO analysts	Portfolio reporting, group-wide programmes, migration projects
Software development	Developers, QA, DevOps	Group portals, integrations, internal applications
IT operations	Service desk, system and network engineers	L1/L2 support, monitoring, end-user support
Security	SOC analysts, vulnerability management	24/7 monitoring, patch and vulnerability follow-up
Finance back office	Accounting and reconciliation specialists	Accounts payable, reconciliations, month-end support
HR and payroll operations	HR operations specialists	Personnel files, payroll inputs, onboarding administration

Rules and standards in corporate groups

Topic	Who it affects	What it means for outsourcing
Turkish Labour Law No. 4857 (subcontracting rules)	Groups with Turkish subsidiaries	Outsourcing must be a genuine service, not disguised hiring of the group’s core workforce
Turkish Commercial Code (group companies)	Turkish holdings and subsidiaries	Intra-group services and cost sharing should be documented
Transfer pricing rules	Groups allocating costs across companies and countries	Allocation keys and service evidence must be defensible
KVKK and GDPR	All companies processing personal data	DPAs per controller, rules for intra-group and cross-border transfers
Sector supervision (e.g. BDDK, SPK, insurance)	Banks, brokers and insurers in the group	Additional outsourcing notification and control rules may apply
Listed company and SOX-type controls	Listed groups or subsidiaries of listed parents	Controls over financial reporting must cover outsourced steps
ISO 27001-style security frameworks	Groups with security policies	Vendor controls aligned with your policy and audit plan

These are general points. The team operates in Türkiye under the Turkish rules above; local rules in the country of each subsidiary apply as well and should be reviewed by your legal advisers.

Delivery models: remote, on-site, hybrid

Model	Typical use in a group
Remote	SAP AMS, development, SOC and back-office work from Istanbul
On-site	Service desk or project managers at headquarters or plants
Hybrid	Workshops and go-lives on-site, daily operations remote

Engagement models

Model	Corporate use	Governance note
Dedicated team	A permanent team serving several subsidiaries	Steering committee with group IT and business owners
Staff augmentation	Specialists joining internal teams for programmes	Your managers lead; clear role descriptions avoid disguised employment
Managed service	SLA-based operations such as AMS, service desk or SOC	Monthly service reviews and service credits
Project-based	Roll-outs, migrations, integration after an acquisition	Stage gates and change control

Process: corporate transition steps

Step	Content	Typical duration
Assessment	Current processes, volumes, tools and costs per subsidiary	1–3 weeks
Service design	Scope, service catalogue, SLAs, cost allocation model	1–2 weeks
Contracting	Framework agreement, call-offs per company, NDA, DPA	Depends on your approval process
Team set-up	Selection and onboarding of the team	Typically 1–2 weeks
Knowledge transfer	Shadowing of current staff or vendor, documentation	2–6 weeks
Pilot	One or two subsidiaries first	1–2 months
Roll-out	Remaining companies in waves, steady-state reviews	Per plan

SLA and KPI structure

Area	Indicator	Explanation
Support	Response and resolution time	By priority and by subsidiary
Support	Backlog age	Open tickets older than the agreed threshold
Projects	Milestone adherence	Planned versus achieved milestones
Finance operations	Close-cycle support	Tasks completed by the agreed day of the month close
Security	Time to triage	From alert to first analyst action
Quality	Error rate in sampled work	Back-office and data tasks
Satisfaction	Internal customer survey	Per subsidiary, quarterly

Pricing factors

Method	How it works	Corporate use
Monthly per person	Fixed fee per team member	Dedicated teams and long programmes
Managed service fee	Fixed fee for a defined service and SLA	AMS, service desk, SOC
Unit price	Per ticket, transaction or document	Back-office volumes
Fixed project	Fixed price per scope	Roll-outs and migrations
Framework with call-offs	Group framework, each company orders what it needs	Cost allocation to subsidiaries

Costs depend on seniority, SAP modules, languages, shift coverage, on-site share and reporting needs. We quote after an assessment and do not publish prices.

Outsourcing for Holdings and Corporate Groups — overview

Outsourcing during mergers, acquisitions and carve-outs

Transactions create temporary peaks: data migrations, ERP integration, transitional service agreements (TSAs) and duplicate systems that must be run until cut-over. An external team can run legacy systems while internal staff focus on the target model, provide a PMO for the integration programme, and later be scaled down when the TSA ends. In a carve-out, the partner can help the separated company stand up its own IT and back-office operations quickly.

In-house team, freelancers and an outsourcing partner

Criterion	In-house team / SSC	Individual freelancer	Outsourcing partner
Control	Highest	Low	Contractual, with reporting
Speed to scale	Slow	Fast for one role	Teams from 1 to 200+ people
Continuity	Depends on retention	Weak	Replacement process for staff
Specialist breadth	Limited to hires	Single skill	Many roles from one partner
Fixed cost	High	Low	Variable
Audit support	Internal	Hard	Logs, reports, audit rights

Risks and safeguards

Risk	Safeguard
Disguised employment of outsourced staff	Clear service scope, vendor management of people, legal review
Loss of know-how	Documentation, runbooks, shared knowledge base
Unclear cost allocation	Allocation keys and reporting per subsidiary
Data protection breaches	DPAs, least-privilege access, logging
Vendor lock-in	Exit plan, handover period, ownership of documentation
Resistance in subsidiaries	Pilot, communication plan, local service owners

Security, GDPR/KVKK, NDA and intellectual property

Team members use named accounts in your systems, follow your security policies and lose access on their last working day. Work products, code and documentation belong to the group. Security monitoring and access reviews can be reported to your internal audit.

Contract note for EU, UK, US and MENA buyers: 360 Soft works under a B2B service agreement with your company. The standard package includes an NDA signed before any data is shared, assignment of intellectual property in deliverables and source code to the client on payment, and a data processing agreement (DPA) under the GDPR with the EU Standard Contractual Clauses for transfers to Türkiye (the UK IDTA or Addendum for UK data). As a Turkish company we also comply with KVKK, the Turkish Personal Data Protection Law. Team members are employed by 360 Soft under Turkish labour law; you direct the work through agreed channels, not as their employer. This is general information, not legal advice; have your own counsel review the contract.

Vendor selection checklist

Can the vendor serve several subsidiaries under one framework with separate call-offs?
Does it have the specialist roles you need (SAP, PMO, SOC, finance operations) in one place?
Will it accept your audit rights, security policy and reporting format?
Is there a documented knowledge transfer, replacement and exit process?
Can it work remote, on-site and hybrid, including 7/24 shifts where needed?
Will it sign the NDA, DPA with SCCs and IP assignment before starting?

Illustrative scenario

Illustrative scenario, not a client case: a group with companies in manufacturing, retail and logistics runs SAP in each company with different support vendors. It keeps its internal SSC for finance decisions and architecture, and engages an external team for SAP AMS, a group PMO and 24/7 security monitoring. Two subsidiaries go first as a pilot; after the review, the remaining companies join in waves. Each company receives its own monthly report and cost allocation, while group IT sees one consolidated dashboard.

Frequently asked questions

Can one contract cover all subsidiaries?

Yes. A group framework agreement with call-offs or service schedules per company is a common structure; each company can receive its own invoice and reporting.

We have a shared service centre. Do we still need outsourcing?

Often yes, as a complement: the SSC keeps decisions and core processes, while a partner covers specialist skills, peaks and 24/7 coverage.

How do you manage the risk of disguised employment?

We deliver a defined service, manage our own staff and document the scope. For Turkish subsidiaries the subcontracting rules of the Labour Law should be reviewed by your counsel.

Can you serve a bank or brokerage subsidiary?

Yes, within the outsourcing rules of the relevant supervisor; the scope and controls are designed with your compliance team.

How long does the transition take?

It depends on scope; a typical team starts in 1–2 weeks, and knowledge transfer and a pilot usually follow over several weeks.

How do we allocate costs to subsidiaries?

We report effort or units per company so that you can apply your allocation keys and transfer pricing documentation.

Which SAP modules can you support?

We staff SAP functional and technical roles according to your landscape; module coverage is confirmed in the proposal.

Can our auditors audit the vendor?

Yes, audit rights and evidence requirements are written into the contract.

What happens if team members change?

A replacement process with overlap and documentation keeps the service running.

Is on-site work possible?

Yes, on-site and hybrid models are available.

What if we want to end the contract?

The contract includes an exit plan and a handover period so the service can move back in-house or to another provider.

Can the staff work as if they were on our payroll?

No. They remain 360 Soft employees delivering a service; you set requirements and priorities through agreed channels.

Talk to us

Planning to consolidate support, projects or back-office work across your group? Share your structure and we will propose a governance model and team. Call or WhatsApp us on +90 850 335 10 87, email info@360-soft.com, message us directly on WhatsApp, or use the form on our contact page. 360 Soft Marketing Yazılım ve Danışmanlık Ltd. Şti., Nidakule Ataşehir Batı, Barbaros Mah. Begonya Sk. No:1 D:2, 34746 Ataşehir/İstanbul.

Related services

All services: Outsourcing Services

Outsourcing for Holdings and Corporate Groups