CLOUD COMPUTING for Construction Accounting BY BRIAN J. THOMAS

Transcription

1 CLOUD COMPUTING for Construction Accounting BY BRIAN J. THOMAS Copyright 2012 by the Construction Financial Management Association. All rights reserved. This article first appeared in CFMA Building Profits. Reprinted with permission.

2 Cloud computing addresses many of the efficiencies contractors seek, including mobile accessibility, scalability, and more expansive Information Technology (IT) capabilities without massive outlays and larger long-term fixed costs. The collaborative work enabled by cloud computing is particularly useful for a contractor s accounting and financial reporting needs, allowing multiple vendors, subcontractors, and other stakeholders to be involved in these efforts. A concrete contractor in the Dallas-Fort Worth area uses a popular small business bookkeeping application hosted on the cloud. One of the company s two owners resides in San Antonio, TX, about 250 miles away, and spends 75% of his time overseeing company projects in that area. The company also works on longer-term projects in Huntsville, TX, which is approximately 170 miles away from both Dallas-Fort Worth and San Antonio. The contractor has six full-time administrative or management employees (including the two owners), and the number of foremen and crew members fluctuates depending on the volume of work. There is no IT specialist on the payroll. In terms of overall size and annual sales, the contractor is regarded as a small business. However, it must address the logistical concerns of employees who work hundreds of miles away from each other and ensure disparate individuals have access to accounting and financial information. While every business faces unique circumstances, this concrete contractor s use of the hosted bookkeeping software illustrates the benefits of utilizing cloud computing. Benefits of Cloud Computing Mobile Accessibility At any given time, a typical contractor has multiple projects underway, with each job incurring its own set of income and expense items. The ease with which cloud-based services may be accessed enables field staff to enter income and expense items as they re incurred into a common bookkeeping application, which bypasses the need to fax or information to the home office. In fact, it s increasingly common for field staff to place orders and receive inventory through smartphones or tablets. The increased popularity and use of laptops, smartphones, and tablets means that a contractor s IT network can now extend to virtually any location, whether it s a remote jobsite, hotel room, or office trailer. Because crucial information does not reside within an internal server, it can be accessed more easily from mobile end points. Scalability Cloud computing increases a contractor s flexibility to quickly scale its IT needs up or down based on business demand. Even extensive needs for additional cloud computing services at a new jobsite can often be arranged and implemented within a day. Since service fees are typically based on monthly usage, IT needs and costs can likewise be scaled back during slower business times. The first exhibit on the next page cites the top five motivators for adopting cloud technology based on responses from more than 4,000 IT professionals in 93 countries and 25 industries, with flexibility and scalability reported as the top motivator. Reduced Need for In-House IT Cloud computing can also reduce a contractor s need for inhouse IT acumen. A survey of more than 500 GCs, builders, remodelers, and specialty subcontractors with $2-51 million in annual revenues found that while construction and real estate companies seek greater efficiency, they do not have large in-house IT departments (as shown on the next page). Construction accounting processes have come to rely heavily on IT; greater functionality without the need for in-house expertise increases cloud computing s appeal. Lower Fixed Costs Regularly upgrading hardware or software equates to greater efficiencies and improves a contractor s ability to maintain CFMA BP July-August 2012

3 FOCUS Cloud Computing CONSTRUCTION ACCOUNTING accurate records and monitor financial performance. Since capitalizing on cloud computing only requires Internet access, fixed costs associated with software and hardware are eliminated. Collaboration Opportunities On any given construction project, how many entries must be made for material costs, per diem allowances, invoices, labor, etc.? How many people are involved in compiling that information? Cloud applications can be used to share project schedules, engineering plans, inventory totals, receipts, invoices, and other information among the project owner, GC, and subcontractors. The ease and accessibility of cloud-based applications and files can enable that information to be created once and then shared across organizations. In addition, subcontractors, suppliers, PMs, and other stakeholders can more easily collaborate in updating and reviewing financial information while work is underway. For example, billing can be handled more quickly for time and materials (T&M) jobs, and owner approvals of time for T&M jobs can be scanned into a database. Cloud-based services also aid in accumulating the approved field directives for the change order process. Cloud computing can also assist in documenting expense activity on a timely basis, thus providing PMs with updated job cost reports an important tool in monitoring project progress. (For more information on technologies that enable project collaboration, read Beyond Virtualization: Moving from Remote Access to True Collaboration by John B. Chaney in the July/August 2011 issue.) Consider & Address Disadvantages & Challenges Even though there are considerable potential advantages to cloud computing, there are also a number of concerns that should be addressed. For example, there may be integration challenges between multiple solutions or an increased dependency on vendors for support. It s also important to consider the process and factors involved in changing providers. In addition, there are different concerns associated with each cloud computing deployment method (public, private, hybrid): Cloud service provider (CSP) customers are often concerned about public cloud security, privacy, and capacity. While services provided exclusively for one customer in a private cloud alleviate many public cloud concerns, the cost can be a significant disadvantage. Hybrid cloud computing enables customers to enjoy advantages associated with both models. However, compatibility and integration issues between a private and public cloud must be addressed for the hybrid model to function effectively. What to Include in an SLA To help reduce these concerns, formally define a provider s services, and clarify a contractor s expectations, consider addressing the following in a Service Level Agreement (SLA): How will mobile device access be allocated to TOP 5 MOTIVATORS FOR ADOPTING CLOUD TECHNOLOGY 58% Flexibility and scalability 45% Reduced operating expenses 42% Efficiency 40% Reduced capital costs 35% Redundancy and disaster recovery 43% of construction or real estate companies in the U.S. have one IT staff person 36% have no in-house IT staff 57% of survey respondents believe efficiency is the most important action to take in % of respondents assigned high importance to mobile technology TECHNOLOGY TRENDS IN THE CONSTRUCTION INDUSTRY Source: 2011 IBM Tech Trends Report, published by IBM s developerworks. Source: Opportunity 2012: Construction Industry Technology Trends, published by Sage Construction and Real Estate. July-August 2012 CFMA BP

4 disparate stakeholders, and will any difficulties arise when those individuals seek to work in a collaborative manner? If an accounting application is provided in SaaS format, does the software include any administrative settings that define what data and functions may be accessed by different parties (e.g., subcontractors, customers, lenders, or other parties)? How will collaborative files be transferred (e.g., Excel, Word, or PDF)? LEVELS OF CLOUD COMPUTING Cloud computing services are offered in three general levels: Software as a service (SaaS), platform as a service (PaaS), and infrastructure as a service (IaaS). The particular level a contractor might choose depends on its specific circumstances and needs. SaaS SaaS is an application fully hosted by a software company or CSP that customers access via an Internet connection. Software use is typically licensed on a monthly subscription basis, and some contract provisions can be based on overall usage or number of users. The customer does not need to perform any installations, troubleshoot any difficulties, or download any upgrades or enhancements. However, there are limited options for customizing the software to fit specific company needs or preferences. PaaS PaaS enables users to design the applications that are hosted by a CSP. This level of cloud computing provides the benefits of customized software without having to maintain the supporting infrastructure. IaaS IaaS represents the most comprehensive level of cloud computing. In addition to hosting applications and software platforms, available services include virtual servers and immense data storage capacity. What is the common cutoff date for data input and reporting? Is there coordination and consistent practices among all data processors? Are there any compliance or regulatory issues (e.g., Sarbanes-Oxley compliance for public companies or data discovery requests for litigation matters)? Has the company s reliance on Internet connectivity been considered? Have record retention concerns been addressed and management terms defined? How will an external auditor or tax professional find necessary financial information? If the accumulated data is migrated to another service provider, who owns it? Do provisions exist for defining how such migrations can occur? Attain Proper Assurance Contractors that wish to attain proper assurance for cloud computing functions related to construction accounting would be interested in the AICPA s Service Organization Control (SOC) reports that accompany the use of Statement on Standards for Attestation Engagements (SSAE) No. 16, Reporting on Controls at a Service Organization. 1 The SOC 1 report is designed for providers that offer services related to financial reporting that rely on IT. This report encompasses the objectives of SSAE No. 16. The SOC 2 and SOC 3 reports are based on the following AICPA Trust Services Principles & Criteria: Security Availability Processing integrity Confidentiality Privacy The SOC 2 report includes a description of the service organization s system, a CPA s opinion on the fairness of presentation of the description, and suitability of the system s design. The report also includes tests performed by the CPA to gauge the effectiveness of those controls, as well as the results from those tests. The SOC 2 report can include any combination of the Trust Services Principles & Criteria, which enables the service CFMA BP July-August 2012

5 FOCUS Cloud Computing CONSTRUCTION ACCOUNTING organization to focus on issues most relevant to its operations and customers. The SOC 3 report is a general use report that is more suited for marketing purposes. It includes an auditor s report on whether the system achieved the trust services criteria, but does not include test results. Capitalizing on Benefits Requires Careful Evaluation When considering a move to the cloud, it is critical that contractors evaluate what controls the vendor has in place to monitor various IT considerations, including security, data integrity, and availability. Contractors also need to consider what audits the CSP undergoes to ensure that its operations mitigate risks, and how various compliance concerns would be met. By carefully evaluating such considerations, a contractor can benefit from moving appropriate IT operations to a cloud environment. n THE LIFELINE FOR CLOUD COMPUTING: INTERNET CONNECTIVITY Cloud computing relies on Internet connectivity, which can be disrupted on either the user or CSP s end by such factors as bad weather, technical issues, or a severed transmission line. Also, a jobsite s location may make connectivity an especially challenging concern. In response, contractors must evaluate their dependency on the computing assets they would consider moving to the cloud. Below are several actions contractors can take to manage the lost Internet connectivity risk for critical company assets (i.e., those where even minimal disruption cannot be tolerated). Endnote: 1. The development of SSAE No. 16 represents a larger effort to converge U.S. and international accounting standards. For more on this topic, read Understanding the Information System Audit Process by Victor M. Marshall and Scott M. Lewis in the March/ April 2012 issue. BRIAN J. THOMAS, CISA, CISSP, is a Partner in Advisory Services for Weaver in its Houston, TX office. He manages teams that deliver IT-focused solutions such as SOC reporting (SAS 70, SSAE 16, etc.), system integration, information security, SOX assistance, IT audits, and IT project management. He has more than 14 years of experience in consulting and managing teams, including nearly nine years of Big Four firm experience. Brian holds a BS and Masters in Civil Engineering from the University of Texas at Austin. He is a member of numerous industry associations, including AICPA Cloud Computing and SOC Reporting Task Forces. Phone: brian.thomas@weaverllp.com Website: Ensure that redundant connectivity capabilities (i.e., multiple Internet service providers) exist for the home office and field offices. Perform due diligence on any CSP before utilizing that vendor s services. Ask the CSP how Internet connectivity risks are addressed and what redundancies are in place to prevent connectivity losses. Investigate whether the CSP has ever encountered connectivity issues. If such issues have occurred, ask how those difficulties were resolved and how long it took to restore service. Potential customers can validate responses through Internet searches, as lost connectivity by notable CSPs typically receives widespread exposure. Consider potential regulatory concerns regarding financial reporting due to a CSP s physical facility in another state or country. July-August 2012 CFMA BP