accounting & finance technology update · 2017-05-02 · platform as a service (paas) ̶usually...

April 28, 2017

Accounting & Finance Technology Update

Experis | April 28, 2017 2

Agenda

Agenda

Technology Options- ‘The Exponential Curve’

Common Definitions- Subscription-Based Models

Data Ownership & Residence Considerations

Client-Side Risks & Considerations

Cloud-Based Technology Services ‘Best Practices’


Technology Trends- ‘A Look Back’ – Information Technology (IT) Support Structure

• CIO- Strategic and Tactical

• Directors- Network, Security, Application Development (Functional Alignment)

• Managers- Specialists for each Major Business Application

• Business Analysts- Assigned to Directly Support Business Applications

– Annual Business, Accounting, and IT Cost Structures Increase (Greater than Inflation)

– ‘On-Premise’ Applications Still the ‘Norm’

• Single Platform (Supporting Multiple Disciplines)

– ERP (Enterprise Resource Planning)

– CRM (Customer Relationship Management)

– Human Resources and Payroll

– Reporting and Dashboards

– Interfaces (including ‘Specialized’ Operational Applications)

• ‘Home-Grown’ Systems Still Existed but Decommissioning of ‘Idle’ Systems Underway

– Hosting Structures Growing and Maturing

– IT Support Service Providers Born through Demand for Cost Containment (Recession and Recovery)

– Cloud-Based Applications were in Concept-to-R&D (Research and Development)



Technology Trends- Current Movement – Information Technology (IT) Support Structure

• CIO- Strategic and Less Tactical

• Directors- Network, Security, Application Development (Service Provider Liaisons)

• Managers- Handle Few Remaining ‘On-Premise’ Infrastructure Farms (Maintenance and Support)

• Business Analysts- Eliminated with Application Support Handled by Businesses

– Users Segregated by Type and Assigned ‘Portals’ as a Point-of-Entry to Applications

– Data Taxonomy Developed and Documented within Cloud-Based Offerings

– Total Cost of Ownership (TCO)- Accounting Treatment Considerations

• Upfront Investment in Terms of Set-Up (Implementation and Short-Term Support)

• Loss of Implementation Capitalization Treatment

• Annual Subscription Invoicing (Prepaid + Amortization)

• Supplemental Invoicing (Contract Structure is Key to Avoiding Unexpected Costs)

– Vendor

– Contractor ‘Seepage’

– Hosting Structures Replaced by Outsourced Infrastructure (IaaS) and Platforms (PaaS)

– COMPLETE IT Support Service Providers Born through Demand for Cost Containment (Recession and Recovery)



Technology Trends- Current Movement (cont.) – Cloud-Based Application Offerings Have Exploded (Multiple ‘Entry Point’ Applications)

• ERP (Enterprise Resource Planning)

– Order-to-Cash (‘Specialty’ Sub Offerings Emerging)

– Purchase-to-Pay (‘Specialty’ Sub Offerings Emerging)

– Fixed Assets (‘Specialty’ Sub Offerings Emerging)

– Manufacturing and Cost Accounting (‘Specialty’ Sub Offerings Emerging)

• CRM (Customer Relationship Management)

• Human Resources (HRIS) and Payroll

– Web Timekeeping and Vacation Tracking

– Benefits Portals

– Stock-Based Compensation

– Pensions

• Project Management and Accounting

– Construction Projects

– Software Development Projects

– Methodology-Specific Platforms

• Procurement (Strategic and Tactical) Platforms

• Logistics (Warehouse Scheduling); Import/Export Solutions



Technology Trends- Current Movement (cont.) – Cloud-Based Application Offerings Have Exploded (Multiple ‘Entry Point’ Applications)- cont.

• Transportation (Trucking and Rail Car Movements; Maritime Container Offering in Development)

• Tax Compliance, Reporting, and Returns (including SOX Compliance)

• GRC; SEC Filing (including XBRL- Financials and Disclosure); ACL and Data Analytics Platforms

• Budgeting and Forecasting; Finance and Performance Analysis (F&PA); AI and Predictive Analytics

• Reporting and Dashboards (Business Intelligence)

• Interfaces (between Cloud-Based Applications based on Standard Interfaces)

• Understand and Leverage Vendor ‘Seeds’ (Avoid Customizations)

– Changes in Accounting, Regulatory, And Information Landscape Driving Client Decisions • Revenue Recognition Adoption- Recording and Disclosure (ACS 606)

• Capitalized Leases

• Inventory and Cost Valuation

• Estimates and Judgements (External Audit Focus)

• PCAOB (Public Company Accounting Oversight Board)

• Corporate Governance Data Enablement- Boards of Director and Audit Committees

• Increased Business Tax Defense

• Legal Discovery

• Disclosures; Social Media; and Transparency (‘PROVE IT’)



Technology Trends- Potential Future Scenario – Information Technology (IT) Support Structure

• CIO- Roadmap, Strategic, and KPI (Key Performance Indicator) Driven

• Directors- Support CIO in Execution of Roadmap; User Community & Service Provider Liaison

• Managers- Eliminated with Infrastructure and Application Support Handled by Service Provider

• Business Analysts- Eliminated (Cloud-Based Applications- ‘Run and Maintain’)

– Cloud-Based Application Implementations; ‘On-Premise’ Applications Gone; Historical, Legacy Data Moved to Warehouses

– Subscription-Based Pricing Models Challenged; Cloud-Based Vendors ‘Forced’ to Consolidate to Reduce Costs and Compete

• ERP, CRM, and HRIS Combinations Occur; Operational Applications Emerge (Manufacturing)

• Vendor and Service Provider Alternatives Reduce in Number

• Offshoring Decreases and On-Shoring Increases (Cost Differentials Shrink)

• Interface Reduction

– Supports Continuous Accounting Services

– Outsourced Infrastructure (IaaS) and Platforms (PaaS) mature to include Cybersecurity, AI (Artificial Intelligence), Mobile Device (Virtual Office)

– Annual Subscription Replaced with Long-Term, Strategic Pricing Master Agreements (including Service Metering)



Technology Trends- Potential Future Scenario (cont.) – New Cloud-Based Offerings

• Architecture, Design, and Construction Management

• Software Development (24-7 Development including Game Developers)

• Trading Platforms & Bitcoin (Virtual Currency)

• Multi-Bank (Financial Institution) Shared Administrative Resourcing

• Trucking & Shipping Alliances (Dispatch Management)

• Warehouse Management (including Fulfillment) and Logistics (Truckload Sequencing)- ‘Order Pool’ Visibility and Scheduling

• Order-to-Cash Management (EXAMPLE: Pharmaceuticals Already Utilizing)

– Management Accounting Implications

• Manufacturing (Specialized versus General)

– Bill of Materials (BOM)

– Routers

– Technical Instructions (TI’s)

– Interface between ERP applications for Inventory and Cost Accounting

• Increased Use of AI (Artificial Intelligence)

• Supply Chain Sharing & ‘Trade-Off’ Alternatives

• ‘Make or Buy’ Automated Alternative Decision Making




Applications

Security

Databases

Operating Systems

Virtualization

Servers

Storage

Networking

Data Centers

Applications

Security

Databases

Operating Systems

Virtualization

Servers

Storage

Networking

Data Centers

Applications

Security

Databases

Operating Systems

Virtualization

Servers

Storage

Networking

Data Centers

Cus

tom

er M

anag

ed

Cus

tom

er M

anag

ed

Provider Managed

Provider Managed

Provider Managed

Infrastructure as a Service (IaaS)

Platform as a Service (PaaS)

Software as a Service (SaaS) PLUS


Infrastructure as a Service (IaaS) Vendor Responsibilities are usually Security, Operation, and Maintenance/Support of Hardware

Resources

Cybersecurity is Typically Shared (Liability and Insurance Considerations)

Infrastructure Levels Can Vary Based On Client Requirements and/or Value Proposition • Network Management

• Infrastructure and/or Storage Hardware (including Data Center)

• Help Desk and User Support Functions

For Start-Ups, Can Be Affordable But Requires Close Monitoring (Typically Year-to-Year Service Agreements); Once Size Crosses Certain Levels the Economic Benefits Begin to Decrease

Variable Agreements and Client Console Allow Flexibility to Size Up or Down Resources Based on Need (Virtual Provisioning); Some Agreements can be Time-Based (or Service Level Agreement)- ‘Pay-as-you-Go’

Access Cloud Computing Resources via Internet (Bandwidth and Speed availability depends on International, Regional and Local Providers); Lines/Accountability ‘Blur’ if Service is Slow/Unreliable (On versus Offshoring)

Software (Operating System and Network Provisioning) Licensing need to be Considered in the Vendor Service Agreement

Internal Controls require an SSAE #18 Report if Client is Public (Subservice Provider Considerations)



Platform as a Service (PaaS) Usually considered by IBM and Similar Providers as the ‘Layer’ Between SaaS and IaaS

Usually Comprised of… • Operating Systems & Some Network Support Functions

• Integration Components

• Middleware and Other ‘Facilitation’ Architecture Tools

• Business Process and/or Workflow Tool Management

• SharePoint (or Other Collaboration Tool) Platforms

• Database and Data Warehouse Services (including Database Management: Dashboard and/or Reporting ‘Views’)

Development Support Considerations- Can Provide Offsite, Vendor-Supported Environment for Building and Developing Web Software • Internet-Based Applications

• Intranet-Based Applications

• Web Forms (Gaining Popularity with Customer-Facing and Supply Chain Interfacing Requirements)

• IoT (Internet of Things)

Service Options (Availability against Vendor Inventory should be Considered) • Public-Managed

• Private-Managed

• Hybrid



Platform as a Service (PaaS) (cont.) Cyber Risk Assessment & Cyber Security (Vendor Cyber Assessment)

• Risk Assessment

– Historical Incidences- ‘Root-Cause’, Impact, and Response

– Process and Methodology

– Frequency of Assessment

– Client Reporting Process

• Intrusion Monitoring Tools and Scenarios

– Responsibility for Intrusion Monitoring (Client and/or Service Provider)

– Service Provider (Recommend ‘All In One’ with IaaS Provider)

– Subservice Provider

• Tactical ‘Breach’ Response

– Notification of Incident

– Quarantine and Service Restoration

– ‘Point of Entry’ Identification

– Application of ‘Patches’

• Business Interruption and Cyber Insurance Policies



Software as a Service (SaaS) – Access is Subscription-Based Over the Internet (ERP Anywhere; On-Demand Availability)

• Kiosk, Desktop, Laptop, Smartphone, IPad Access Options

• Concurrent versus Named Users- Enterprise, Customer, Vendors/Suppliers, Transportation, Contractors

• Module-Specific, Portal-Assigned (BEST PRACTICE: Role-Based versus named User-Based)

– Multiple ‘Assigned’ Cloud Space Offerings (Application and Data) • Public

• Private

• Hybrid

– Should require a TCO (Total Cost of Ownership) Analysis considering • Application Implementation and On-Going Maintenance

• User Support and Response

• IT Infrastructure Costs (On-Time and On-Going)

– Service Agreement Drives Everything in the Client and Service Provider Relationship

– Base / Seeded Application Functionality should be Maximized versus Customization

– Standard Interface Toolset should Consider ALL Cloud-Based Application Requirements

– Internal Controls require an SSAE #18 Report if Client is Public (Subservice Provider Considerations)



‘On-Premise’ Data Residence Client Owns ALL Aspects of the Data

• Data Classification and Security Strategy Required

Federal Law

State Law

GDPR- General Data Protection Regulation

Legal- Discovery Process Requirements

• User Security and Access (Internal and External Requestors)

• Data Policies including Data Archiving

• Redundancy & Disaster Recovery

• Database and/or Data Warehouse Management

Data Definitions across Multiple Applications/Databases

Data Taxonomy and Relationships

Dashboards and Business Intelligence Tools

Accountability & Span (potentially including Internal Controls) of Control is Greatest • Still Vulnerable in Terms of Employee Awareness & Handling of Sensitive Data

Can Cost More in Long-Run from Resources Required to Maintain Internal Infrastructure (Even in Virtual Server Scenario)

• The Longer You Wait to Migrate to Cloud Increases Difficulty & Complexity



Cloud-Based Data Residence Client Possesses Only CERTAIN Aspects or NONE of the Data (as Dictated by Service Level

Agreements with Vendor(s)) • Stewardship of Data Delegated to Vendor / Service Provider

• Ownership of Data Still Remains with Client (Liability / Recourse Depends on Agreement)

• User Security and Access (Internal and External Requestors)

• Data Policies including Data Archiving and Request Handling Follows Service Agreement

Requests Should Still Route through Client

Database and/or Data Warehouse Management • Data Definitions across Multiple Applications/Databases

• Data Taxonomy and Relationships

• Dashboards and Business Intelligence Tools

Can Offer Cost-Effective Options (You Pay for What You Use) • Access & Availability

• Space Consumption Driven

• Technical Resources (Personnel & Hardware)

Access Over Internet can Improve Remote Availability (Security Remains a Consideration)

Growth to Account for ‘Big Data’ and Machine Learning (Artificial Intelligence)



On-Device Data Residence Data is Downloaded/Refreshed to Personnel Devices (Based on established Frequencies)

Facilitates Mobile Business Management- ‘Business-On-The-Go’ for C-Suite

Highest Cost Option and Is Not an Overall Strategy on it’s Own (You Would Still Require Data Residence in a Server Environment)

• Security Prevents One Data ‘Push’ Strategy (ie. Personnel Would Only Get Certain Data Elements Due to Space Considerations)

• Amount and Time Period of Historical Data Requires Larger, Dedicated Devices (and More Frequent Data Purging)

• Benefit is Usually Real-Time, virtual access to data (Can Process Transactions from Anywhere and at Anytime)

• Data Update/Replication over Cellular is Expensive and Time Consuming

• Data Visibility can be Small if User Screen has Significant Data and Graphical Depictions

Dashboard & Reporting Representation can be Limited (especially with Smartphones)- Data File Size; Calculations; and Graphics

Higher Risk of Unauthorized Access to Sensitive Data (Security is Only as Strong as the Device Password)

Can Lose Firewall & Cybersecurity Protections

Transaction Data can be Archived from Devices prior to Data Center Upload (Traders and Instant Messaging Confirmation of Trading Activity- Regulatory and Legal Concerns)



Business, Accounting, & IT Change Management is Key Begin Migration to Cloud-Based Services and Software Without a Roadmap

Agility to Modify Existing Business Processes to ‘Fit’ Service Provider/Application Requirements (Client Losses Some Level of Control)

Ease of Implementation Depends on: • ‘Trusted Advisor’ View of IT Throughout the Enterprise

• Degree of Leveraging Base Data ‘Seeds’ Already Existent in Applications

• Engagement of User and IT Community During Design, Configuration, and Unit Testing

• Reducing Internal and External Interface Points

Only Slight Reduction in Implementation Cycle Time and Costs • Master Data Files Still Require Analysis and Cleansing

• Interfaces Still Have to Be Considered and Required to ‘Fit’ to the Service Provider Schema

• ‘Proof-of-Concept’ and User Acceptance Testing Still Have to Occur (including Documenting Results for External Audit

Cost Visibility and ‘Negativity’ Due to Higher Consultant Reliance and Enterprise Visibility of Costs

Could Actually Increase Cost- Tendency to Build Redundancy & Duplicate Infrastructure/Services (especially when Multiple Service Providers are Involved)

IT Can Become a Silo Approach versus a Team Effort



Business, Accounting, & IT Change Management is Key (cont.) Real Estate’ (Responsibilities) Become ‘Blurred’ Between Outsourced Service Provider(s) & Client

• User Security, Privileges, & Workflow

• Interface Component Location & Management

• Business Continuity & Disaster Recovery Plans (including Service Restoration)

• Application of Service Packs & Maintenance (including Cross Vendor Compatibility Assessments)

• Management of IT Support Issues (including Application & Database Maintenance & Support)

• Dashboards, Business Intelligence, & Reporting

• Interface & Representation Between Multiple Vendors Servicing the Entire IT Infrastructure

• Downtime & Responsibility for Resolution

• Maintenance and Support of Customizations

IT Governance and Accountability of Such Can Become Difficult

Can Increase Introduction Points for Cyber Attacks

Vendor Contractual Inflation Adjustments Can ‘Out Weigh’ Actual Client Costs (if Services were Internal)

Left with Legacy Hardware, Software, &/or Infrastructure Assets (including Data Management of Historical Data)

Future Vendor and Service Provider Consolidations Can Quickly Change the Third-Party Composition



Business, Accounting, & IT Change Management is Key (cont.) – Cloud-Based Cost Savings and Data Risk is Related to Reducing ‘Shadow IT’

– Increased reliance on third-party or Outsourced Service Providers (OSP) for technology and/or support solutions

– Multiple choices and ease of procurement for third-party solutions

– COSO 2013 requirement for management of OSPs • Lack of understanding of what data and solutions are currently provided by OSPs

• Traditional SSAE #16 reports may not provide enough coverage

• Newly implemented SSAE #18 (addresses Subservice Providers)

• Loss of control of critical business data

• Lack of effective controls

– Client

– Outsourced Service Provider

– Outsourced Subservice Provider



Success Factors to Consider Begin with the ‘End in Mind’

• Diagram out the Final IT Infrastructure

Develop the Technology Roadmap including Outsourcing

Develop Budget to ‘Match’ Roadmap

Desired Outcomes- Enterprise; IT; Finance; Customers; Vendors (Supply Chain)

Deployment of ‘Old’, Legacy Systems

• Develop Options & Document Cost/Benefit Model

– Domestic Growth

– International Growth

– Multiple, New Product and Service Lines

• Conduct Internal ‘Readiness’ Assessment and Change Management Dependencies

• Determine ‘Real Estate’ Between Client & Service Provider(s)

• Cybersecurity Protection (including PCI Standards)

• Obtain Senior & Mid-Level Management Consensus

• Negotiate & Confirm Vendor Service Level Agreements

• Map Vendor & Internal Service Against Final IT to identify Gaps

• Implement Internal & External Monitoring Mechanisms

• Establish and Align Service Agreements to Key Performance Indicators



Success Factors to Consider (cont.) Treat Annual Vendor and Service Provider Evaluations as an Annual Exercise versus One-Time

Decision • Collaborative Effort Between the Business, Accounting, and IT

• Cost-Benefit Analysis (Vendor Evaluation and External ‘Benchmarks’)

• Service Level Analysis & Provider/Vendor Responsiveness

Involve User Community in Service Provider Evaluation

Service Provider Survey Availability

• Service Provider/Vendor Agility & Flexibility

• Alternate Service Providers/Vendors (Obtain and ‘Refresh’ Bidding and Evaluation)

• Considers Long & Short-Term Enterprise Strategy

Organic & Market Growth

Acquisitions

Divestitures

Domestic versus International Operations/Growth Strategy; Tied to Service Provider/Vendor Global Presence & Service Offering Availability

Board of Director & C-Suite Engagement in Efforts as a Corporate Strategy

Cloud-Based ERP Applications Can Support Upcoming FASB Changes • ACS 606 Revenue Recognition

• Leases (Balance Sheet Placement)



Success Factors to Consider (cont.) Avoid Long-Term Commitments with Service Providers (Unless Necessary from a Sunk or On-

Going Cost Perspective)

Increase Communication with External and Internal Audit

Always Require Independent Control Attestation Reports (SSAE #18 Reports) for Service Providers (including SaaS, IaaS, and PaaS) Client Still Has to Obtain & Review at Least on an Annual Basis

‘Big Data’ Management is still a Consideration (Projected to Continue with 40% Growth)


Contact Information / Q&A?


Robert (Bob) Mellgren Experis Finance Senior Manager, Risk Advisory Services Mobile: 817.975.1295 Email: [email protected]

Contact Information

mailto:[email protected]

accounting & finance technology update · 2017-05-02 · platform as a service (paas) ̶usually...

Documents