What's stopping CFOs putting their money on cloud computing?

The challenges facing finance chiefs - and how to overcome them

Heavy investment in in-house financial systems, combined with fears about reliability and data security, have put many CFOs off cloud computing. However, moves are now afoot to address some of those concerns. Cath Everett reports.

The appeal of cloud computing to finance directors has grown recently, in direct correlation with budget squeezes and a desire to cut costs in difficult economic circumstances.

But most CFOs, unless they work in start-ups or small companies, have so far been wary of putting sensitive financial data into the cloud, even though some are already using such services to analyse small anonymised statistical datasets.

Many CFOs have also already invested heavily in SAP or Oracle and are unlikely to evaluate new options until these large on-premise systems have reached the end of their useful life. Even more CFOs have been put off by concerns about information security and assurance.

But these concerns are now being addressed. An independent group called Common Assurance Metric is putting together a cloud vendor audit and certification programme to help organisations manage the risk of going down this route. The scheme is expected to launch by the end of this year.

So what are the challenges facing CFOs contemplating using the cloud for financial systems?

1. The problem of definitions
One of the first obstacles that CFOs will encounter when evaluating whether or not to use cloud services is that the term can mean different things to different people.

Yet the issue is not simply one of semantics, but rather one of information governance, because organisations need to know where important data is being held - not least for compliance and auditing purposes.

The two most confusing terms that are often used interchangeably are:

• Cloud computing
  Cloud computing is a form of outsourcing, by which vendors supply mainly computing services to lots of customers over the internet. Services can range from applications such as billing, which is classed as software as a service, to IT infrastructure - such as storage - or infrastructure as a service, and application development environments, or platform as a service.

  The services are provided via massively scalable datacentres running thousands of virtualised processors. This approach means that workloads are not processed on a single machine but are distributed across multiple servers, which can be located anywhere in the world.

  Moreover, because applications are multi-tenant in nature, which means a single version of the package runs on a server and is accessed by multiple customers or tenants, system resources can be shared among a large pool of users, which cuts costs.

• Managed or hosted services
  This second approach is also a form of outsourcing, but in this case suppliers host either vanilla or customised applications on a single dedicated machine based in a datacentre in a location of the customer's choice. Such applications are not shared with other clients, but services can still be accessed over the internet.

  Some traditional cloud vendors such as IBM and Amazon are now beginning to broaden out their range of services by providing customers with local datacentres and even dedicated servers on which to run their applications, but Derek Kay, director of cloud services at Deloitte, said that such options do inevitably cost more.

  "We're seeing more richness in provision and more differentiation on pricing but if you want the cheapest possible service, the idea is that you give away the most control. The more control you want to retain, the more expensive it is," he said.

Recommendation
Ask providers to clarify how they intend to deliver your service so that you understand the risks involved and know exactly what you are getting for your money.

2. Information assurance concerns
Because it is the CFO's job to sign off on projects, he or she bears ultimate responsibility if things go wrong and sensitive financial data is lost, stolen or replicated. As a result, finance chiefs need to think...