In-house workers can phone it in as well. At some point, your recursive watchers of watchers watching watchers has to have a base case of "we trust this entity

In-house workers can phone it in as well. At some point, your recursive watchers of watchers watching watchers has to have a base case of "we trust this entity" (or maybe, "you, the public, trust this entity"). Outsourcing only matters for this if it provides a break in the chain of responsibility. That is, if the person selecting the outsource provider can (successfully) say "hey, not my fault" by pointing to... some entity that whoever they answer to doesn't already trust.