A little knowledge of Clouds may be a dangerous thing

11th March 2012

Business can opt for cloud services without involving people with finance,  IT or legal expertise in the decision-making process, but if they want to maximise the benefits of utilising the cloud, this may not be the best approach, as FSN writer Lesley Meall discovers.

Freedom of choice can be overrated, whether you are trying to identify the most cost effective fuel tariff for your business or the most cost effective way for it to source the information technology (IT) it needs. The increasingly widespread availability of on-demand cloud-based services and our growing comfort with all things ‘internet’ have taken buying decisions out of the hands of the few and into the hands of the many. But the ease with which you can practically and financially access data storage, software, infrastructure, processing power and more, ‘as a service’, belies the complexities that must be factored into the IT decision-making process if the ‘as a service’ approach is to deliver all of its potential benefits. 

Without specialist expertise, decisions about using on-demand software and services can retrospectively seem to demonstrate shortsightedness and tunnel vision. Take ecommerce, a Software as a Service (SaaS) application that many first-time cloud users begin with. ‘I used a free open source online shop solution and set it up myself, says Andreas Doppelmayr, founder of Barbershop.no. So far, so good. But as the business developed, the system couldn’t, and it wasn’t long before he had to upgrade his web shop (to software with credit card payment facilities) and integrate this new solution with the cloud-based accounting solution he had started using – and some of these hurdles could arguably have been avoided with more informed planning. 

There are also scenarios where the public cloud may have less to offer than more traditional managed services, but you need to know a little about these alternatives in order to compare them. As one finance director who wishes to remain nameless says: ‘We decided on a cloud-based customer relationship management system without giving any thought to our long term IT strategy, and if we hadn’t received some external advice before we committed the business to taking that route we would have wasted a lot of money.’ If what you want is on-demand web-based access to software and infrastructure (such as computers for processing and storage) this can be provided by public clouds, private clouds and a mixture of the two.

If you do not appreciate the range of possibilities and their relative merits this can lead to some potentially costly mistakes. ‘When they determine how they are going to use the cloud, businesses should be looking at their strategy for the next five to 10 years,’ suggests Mike Camburn, a partner at KPMG, and as he adds, ‘they should be looking at their contracts too.’ Public cloud services are characterised by a high degree of contract standardisation, with consistent terms for every customer, and although some providers do offer their users a choice of different levels of service (for on-demand infrastructure, for instance), these do not (so far) have a great deal in common with the sort of ‘partnership’ approach of more traditional managed services.

So at powerPerfector, the provider of Voltage Power Optimisation (VPO)® technology, the operations manager Michael Bishop chose a set-up that provides employees with access to IT resources via a mixture of on-demand services, with some located in the public cloud and some being ‘hosted’ on the servers of a traditional managed service provider (in what could be called a ‘private cloud’). Bishop selected the SaaS offerings SalesForce.com and FinancialForce.com because they are ‘very easy to work with’ and they were ‘very easy to configure’; he even did some of the bespoke work needed to ensure that FinancialForce met powerPerfector’s ‘quite complicated requirements in areas such as revenue recognition and invoicing’. 

Bishop trained as an accountant and he has spent years looking after IT systems, so he has a certain amount of expertise, which helped during the initial implementation and customisation of these systems, but he still opted for a more personalised and supportive approach for some of the other IT tools that powerPerfector requires. ‘We migrated our entire desktop, which is mostly Microsoft Office,’ he says, and this is now delivered by a hosting company (which provides it ‘as a service’ using virtualisation, an approach you can learn more about in other FSN articles here and here) – and this comes with the sort of service level agreements and contracts that you might expects of a managed service or outsourcing arrangement. 

There are also data privacy, security and sovereignty issues to consider. ‘When you go into the cloud you think you can forget about hardware and software, so a lot of organisations don’t consider issues such as data security or sovereignty until there’s a problem,’ says Rob Rachwald, director of security strategy with Imperva (a security specialist). ‘A minority of organisations are getting very smart about incorporating information security and sovereignty into their contracts with cloud-based providers,’ he says, but for the vast majority this is not the case. So it is important to remember that although the cloud allows you to abdicate responsibility for managing all sorts of computing-related processes, compliance with data protection law is not included. 

Users of cloud services also need to consider the physical location of their data. ‘This is a complicated area,’ says Alistair Maughan, a partner at the international law firm Morrison Foerster. Data that lives in the cloud can end up on the servers of third party service providers in all sorts of geographical locations. Because service providers use service providers who use service providers (potentially ad infinitum) to host and backup data, its physical location can be hard to pin down; likewise the legislation that applies to it and the jurisdictions in which this can apply. ‘Generally speaking, the law that’s applicable is the law of the country where the data controller is located,’ says Maughan. But there are some exceptions. 

Non-data protection legislation may need to be considered too, as the nationality of the service provider that is processing or storing your data can have implications. ‘The issue of whether a government or public authority can gain access to data that is located outside their national jurisdiction is an issue,’ says Maughan. The reach of the USA Patriot Act extends beyond the country’s geographical borders. ‘The US government can request information that is under the jurisdiction or control of a US company,’ he explains, regardless of the physical location of the data or the nationality of its owners (and governments in some other countries have similar rights). So the legal implications of using cloud services can be complex. 

There are also financial issues to consider and FSN has explored the great capital expenditure vs. operating expenditure debate here. ‘From an accounting point of view, the CapEx versus OpEx debate is more nuanced than “ the cloud is good because it shifts capital expenditure to operating expenditure”,’ says Richard Anning, IT Faculty head at the Institute of Chartered Accountants in England and Wales (ICAEW). The way cloud computing is financed can have unexpected consequences. For example, because cloud computing is paid for from business unit sales and operating expenses it has an impact on earnings before interest, taxes, depreciation and amortisation (EBITDA), and this can impact adversely on the performance of business units – and the performance bonuses of those working in them. 

Even within the discipline of accounting, opting to use the public cloud, various types of private cloud, or an approach that mixes the two can impact on all sorts of things, because any decision on how to finance access to technology resources can have an impact in more than one area of accounting. ‘It can effect financial management, financial reporting, and tax,’ he explains, ‘and accountants who specialise in these will be thinking about CapEx and OpEx in different ways’. The accounting definition, classification, guidelines, scope and implications of CapEx all vary depending on context, and there are thorny issues to consider such as such as capital lease arrangements, tangible and intangible assets, their depreciation and amortisation, and accounting for different national tax jurisdictions. 

No two businesses are alike, so as KPMG partner Mike Camburn explains: ‘Organisations have different tax obligations, and at the same time they may have different tax advantages that they are able to benefit from’ if they structure their arrangements effectively. But to do this businesses must look beyond the obvious and immediate benefits of the cloud delivery model and clarify their short term and their long-term strategies for the cloud. ‘It’s important to do this to generate cash benefits where possible, and also from a longer-term corporation tax perspective to maximise the effective tax rate,’ says Camburn. So as he adds, when it comes to maximising the benefits of cloud computing: ‘Companies should be talking to their advisers.’