Cloud computing: Why it matters to your business Prepared by: Ashish Gadnis, Business Development Director, McGladrey LLP 612.376.9237, ashish.gadnis@mcgladrey.com October 2013 Whether you work for a large conglomerate or a two-person startup, cloud computing is having a huge impact on your business. You may already use it and benefit from it, but if you re not your competitors most likely are. Here s why: The cloud provides competitive advantage to companies that use it to reach different economies, currencies and markets without the overhead of on-premises technologies. Hardware and infrastructure as barriers to market entry are diminishing. With the cloud, a company can think big; without it, a company will see its opportunities restricted, unless it is a behemoth with the resources to run its own information technology (IT) infrastructure. The cloud is disrupting a capital-intensive status quo. Companies traditionally set up their IT departments by buying a server and installing software, and also hiring an IT staff, then housing the staff and servers in large, climate-controlled environments. Companies then used the system to, say, manage inventory and finance. At regular intervals, the software producer released a new version, and companies either upgraded or, in most cases, kept the status quo in place for operational or financial reasons. You stayed on version 1.1, and suddenly the software is up to version 6.0, and you re still using systems that are increasingly obsolete and hard to maintain. Cloud computing completely breaks that perpetual upgrade expense cycle. When applied correctly, the cloud enables fixed expenses for hardware, software, facilities and staffing to either decline or shift to other uses, as the functionality moves to servers and service providers outside of the company. An apt comparison might be electrical and water access: Utilities provide the power and water whenever you need them. When you walk into your home today, you don t worry about the power being on; you don t need your own generator. You don t worry about the water supply or needing your own water tank to fill up buckets of water for future use. In return for utility service, you simply pay a monthly fee based on usage. Cloud computing moves that utility framework to computer technology. It can essentially transform the delivery and support model in some of the most critical IT services. Functions that typically can shift to the cloud include:
y Email and contact management y Sales management and automation y E-commerce and marketing y Inventory, services, manufacturing y General ledger (GL), accounts payable (AP), accounts receivable (AR), finance and accounting y File management and collaboration At the most robust level, the benefits of cloud computing include: y Highly scalable solutions y Integration with disparate sources y Social media readiness y Support of global needs, e.g., language, currency, compliance y Nimble and global business operations y Multichannel approaches for both the sales and delivery side examples include retail, e-commerce, business-to-business (B2B), all enabled via cloud applications y Faster time to market y Real-time decision support y 360-degree views of the entire business supply chain As functions migrate to the cloud, companies gain competitive advantage in three key ways: y Reduced IT costs Shift the cost model of IT to start paying for just what you use and not everything you have. Cloud computing also offers the flexibility to scale resources up or down based upon changes in demand. y Business enablement The cloud provides companies, large and small, access to very powerful and sophisticated resources capable of processing data and delivering value at mind-boggling speeds. Companies with an idea get the IT infrastructure they need to ramp up operations, paying a fee and sidestepping the long process of hiring staff and building out the infrastructure. y Operational agility Cloud computing significantly reduces the efforts of recovering systems and applications in the event of an outage. Rather than maintaining multiple data centers and remote work sites, you can sustain operations with just an Internet connection. Separating the sizzle from the steak If you like what you re hearing, but aren t sure exactly what this is all about, relax. For all the talk and marketing sizzle around the cloud, the reality behind the image is quite mundane. The cloud is simply racks of servers, hardware and software, provided by companies you already deal with. The physical infrastructure is the same as what you find in a typical IT function. The big difference is what those massive banks of hardware and software actually do: They re running simultaneously to enable companies to tap into IT services provided by third parties as part of their business value chain. By doing so, they are managing e-commerce, websites, sales processes, order processing, fulfillment and cash. And they re doing it all with the latest iterations of the programs they use, without worrying about whether and how to install upgrades. They no longer have to manage separate, siloed systems for accounting, inventory and e-commerce that must somehow be wired together like a giant electronic hairball. You re no longer responsible for taking that upgrade CD, implementing or installing it on a server, waiting for some guy to update the software and hardware and then test everything. 2
Instead, the cloud service provider does that for you. The cloud enables companies to tap into software from third-party service providers when and where they need them, no different from turning on the electricity. IT departments still exist, but they can focus on high-value activities, such as analytics and writing code, rather than hassling with upgrade paths and keeping the server farm at the right temperature. Cloud computing simply transfers the corporate server with your applications and your users to the Internet. That s just what companies do with Salesforce.com. A sales executive can deploy his sales force worldwide on a multinational account strategy through Salesforce.com, checking the pursuit pipeline and status in a way that s independent of devices and browsers. The information exists in the cloud with global access. Before, that sales executive faced enormous problems upgrading or even accessing systems in, say, China or India or Brazil, due to incompatible systems or problems dealing with different IT cultures. And when Salesforce.com or another platform like NetSuite upgrades, your business continues as normal. That s a radical change from the traditional on-premises IT model, in which you must wait to get into the IT pipeline to get a Microsoft email upgrade. Five to 10 years ago, that was the norm. Now, upgrades happen instantly because of Microsoft Office 365 s presence all on the cloud. Can cloud systems be tailored to specific corporate functions? Until around 2010, the offerings were, in fact, standardized, rather than customized. Then, cloud computing shifted, so that platforms became more open source. In the example of ERP, these services have a core offering of accounting, GL, inventory, finance, supply chain manufacturing and other services. As the core is upgraded, providers can layer on top of it features that customers can configure, customize and extend. Say your company wants to deploy to the manufacturing sector the same core you deploy to the distribution sector after all, the GL is the GL, the inventory is the inventory, the supply chain is the supply chain. After deploying the core, you can configure the work flow, the business processes, the fields and forms to meet specific business needs. That s how cloud providers are entering the enterprise solution space. These customizations stay in place as the providers upgrade the cloud platform, something very difficult to achieve through on-premises systems, as my conversations with CEOs and CFOs attest. The human capital consideration Also, the cloud enhances companies access to human capital. Cloud providers hire talented programmers and experts in disciplines like security and infrastructure. They operate in what can be called an ecosystem of expertise. They have to do that to maintain the quality, agility and security required of cloud providers. That s the baseline of admission to the services. A corporate IT department, except for the largest companies, would be hard-pressed to match these talent ecosystems. If you have QuickBooks or Excel or EPICOR, your IT staff will spend a fair amount of money and time in integrating hardware and software, rather than focusing on generating the insights needed to execute your corporate strategy. My suggestion: Let somebody else deal with inventory management feature sets. Let somebody else deal with changes in GAAP accounting. Let somebody else deal with XBRL. Addressing all of these on-premises is laborious and, ultimately, adds little value. Leave those issues to the cloud providers who deal with them daily. That s the division of labor available through the cloud. 3
The race for always-on access The pace of cloud adoption is accelerating, as companies race to maintain always-on access in the face of disruptions to power or Internet access. After Hurricane Sandy last October, sales of cloud-based products had a huge increase. Why? For starters, it provides a great capability to reduce risk of downtime, while offering a higher level of operational agility, for a much lower cost than managing multiple data centers and failover sites. What do they gain? Every cloud vendor provides guarantees in their service-level agreements (SLAs). Typically, they range between 99.5 and 99.95 percent availability, very good compared to your traditional IT. Recovery time objectives (RTOs) and recovery point objectives (RPOs) are guaranteed from zero to four or two to 24 hours, depending on your industry. Risks to consider An increasing number of companies are turning to the cloud to house technology systems, software and data. The cloud s allure comes from decreased costs, lower maintenance and diminished need for infrastructure, software and staff, all within a platform that appears safer than many internal solutions. While these are all benefits of moving operations to the cloud in an optimal situation, significant regulatory, security and privacy risks also exist. Here are common risks to consider: Access The access to information and technology assets becomes more critical daily; therefore, leveraging a model that places reliance on external factors outside of your immediate control can initially be a difficult concept. How much control do you want to cede to an external vendor? However, if you take a moment to break down the real risk, this may not be as bad as you might fear. Consider the following diagram: Diagram 1 The above diagram is a very simple depiction of a cloud model you may decide to use, with the circled letters representing potential points of failure. In the event that you experience failures in points A or B and lose access to your asset, how would the failure differ than if the asset were on-site? In most cases, there is no difference, but if there is, then this is a potential risk or challenge you should evaluate. 4
For the purposes of this paper, we will not dive too deeply into the scenario of the entire Internet going down (point C). If it does, we ll go with the general assumption that there is probably a bigger crisis taking place. Points D and E represent the network and connection of the potential service provider, which is probably the real question you need to consider. Most service providers in this space have very well-defined SLAs posted on their sites, with quantitative metrics, such as availability, capacity, input/output (I/O) and connection speed. If you leverage this type of model, you will need to consider these SLAs and overall reliability of your provider to determine if they are acceptable for your business. Compliance, regulatory standards and security This is usually one of the biggest challenges for organizations to overcome to leverage cloud computing, especially those under heavy compliance and regulatory standards. Typically, cloud computing requires sending or hosting your corporate data at an off-site location. If the data is sensitive to your organization, customers or business partners, this risk needs to be addressed at the beginning of your evaluation. Migrating to the cloud creates a host of compliance concerns, primarily related to regulatory requirements, such as Payment Card Industry Data Security Standards (PCI DSS), the Health Insurance Portability and Accountability Act (HIPAA), Financial Industry Regulatory Authority (FINRA) and the Financial Information Security Management Act (FISMA/FedRAMP). These regulations are fluid, and carry restrictions on how data is stored and the level of security that is placed on information and records. Organizations should confer with legal counsel and internal audit to determine which solutions comply with applicable guidelines, policies and regulatory requirements. To help initially address some potential concerns, we can leverage diagram 1 again to begin thinking about a general model for security and protection. For points A and E, consider how the data will be protected on the assets. For points B, C and D, you will need to consider the security for transporting the data. This model may not help answer all of the concerns for addressing security on your assets and data, but can give you a good start. Outsourcing risks Outsourcing is a popular strategy to cut costs, but organizations should realize the potential impact of these solutions. The strategy removes a significant amount of local knowledge about your applications and their usage, and, if a problem or abnormality occurs, it may not be recognized in a timely manner because of the new team s lack of familiarity. Without close monitoring, outsourcing often does not allow your company to view and manage applications as desired. An outsourcing strategy does not eliminate the need for IT staff, as personnel are still necessary to maintain devices, such as users laptops, used to access data in the cloud. In addition, even with an outsourcing arrangement, many companies retain some IT infrastructure in-house, where they may be freed from maintenance chores (moved to the cloud) to focus more on added-value activities. Fear of letting go In many cases, some organizations are just more comfortable having a physical device they can see and touch. They appreciate the ability to walk up to their server, and hit the reset button if needed. (However, if they are, we ll need to discuss your change management process). In any case, this starts to hit on the shift in culture in IT. In our experience, this shift in culture should not be ignored or discarded, but rather, discussed and addressed. Getting your IT staff onboard with this change is just as critical as getting your legal department to 5
agree. As an ally, your IT staff can become innovators and value generators throughout the process. If they are opposed, then they re more apt to generate additional roadblocks and delays. Looking at cost issues A cloud platform can significantly reduce IT costs for an organization, although the savings may not be as imminent as many expect. Some analysts find that, on a three-year total cost of ownership (TCO), cloud technologies tend to be 30 to 50 percent cheaper than on-premises solutions. Two factors explain this significant difference. First, with cloud computing, the cost of IT hardware starts to diminish; in some cases, they almost vanish as the cloud providers assume hardware investments. Second, other IT costs, such as real estate and staff, decline as a company needs fewer staffers to maintain a massive data center infrastructure. Cloud solutions often require revised business processes, which carry an upfront financial and time expense, while special audits and regulatory reviews can disrupt normal operations. When evaluating a cloud platform, executives must ensure these risks are properly accounted for to avoid potential damage from lost productivity or sanctions. Pathways to making the move To make the move to the cloud, think carefully about the vendors and advisors who can help make that happen. The path can be complex, and varies based on your current operations, IT infrastructure, strategy and human capital. You will be best served by collaborators who assess your total business situation and give you straightforward advice. Going to the pure cloud level may be the ultimate goal, but you can start at less lofty levels. The move to the cloud can happen in stages, based on a company s readiness to outsource IT functions. The three stages, each enabling more impact on operations, are: y Infrastructure as a Service (IaaS) The first layer that firms tend to outsource if they want to retain control of their platform and applications y Platform as a Service (PaaS) Firms outsource platforms if they are comfortable with outsourcing infrastructure first, but hesitant on the application side y Software as a Service (SaaS) Outsourcing software to the cloud is the last stage, when companies are confident that IaaS and PaaS are already factored in by the SaaS provider When evaluating service providers, there are a few key factors you want to initially consider. Specifically, you want to find a provider who can offer an SSAE 16 or a SAS 70 Type II document. Payment Card Industry (PCI) compliance is another major feature for companies involved in e-commerce and credit card transactions. Credit card providers mandate such compliance. Major platforms offer this compliance, freeing companies from building compliance on their own. Looking ahead Companies are testing cloud computing at different levels, based on their readiness. At the highest level, true cloud computing, they are tapping into software as a service. Accurately assessing what s doable is crucial, as in developing a plan for moving to the next level. The benefits truly start accruing when companies access software programs at the SaaS stage. The need for that will only grow in coming years, as cloud computing evolves further in impact. It is an appealing model, but migrating to the cloud before evaluating security and privacy risks, regulatory impact and the potential for hidden costs can result in significant financial and 6
reputational damages. An organization considering a transition to the cloud must undergo an analysis to determine the true costs of an appropriate solution, and whether the benefits outweigh the risks. As organizations continue to shift more and more of their applications and systems to the cloud, they are beginning to realize just how much they are enabling another transformational strategy... mobility. This functionality can free employees from on-site operational constraints, and allow employees to conduct business anywhere, while on the go. Are you ready to go? 7
800.274.3978 www.mcgladrey.com This publication represents the views of the author(s), and does not necessarily represent the views of McGladrey LLP. This publication does not constitute professional advice. This document contains general information, may be based on authorities that are subject to change, and is not a substitute for professional advice or services. This document does not constitute assurance, tax, consulting, business, financial, investment, legal or other professional advice, and you should consult a qualified professional advisor before taking any action based on the information herein. McGladrey LLP, its affiliates and related entities are not responsible for any loss resulting from or relating to reliance on this document by any person. McGladrey LLP is an Iowa limited liability partnership and the U.S. member firm of RSM International, a global network of independent accounting, tax and consulting firms. The member firms of RSM International collaborate to provide services to global clients, but are separate and distinct legal entities that cannot obligate each other. Each member firm is responsible only for its own acts and omissions, and not those of any other party. McGladrey, the McGladrey logo, the McGladrey Classic logo, The power of being understood, Power comes from being understood, and Experience the power of being understood are registered trademarks of McGladrey LLP. 2013 McGladrey LLP. All Rights Reserved.