Keep

Your Head
Above
Clouds
the

10 Technology • Disclosures • November/December

Stay on Top of Cloud Computing Trends
By Haven S. Pope, CPA, CFE
E
ven before the struggling econo-
my, companies have consistently
sought ways to save valuable re-
sources and increase their competitive
edges without sacrificing efficiency or
productivity. The significant decline in
the market has urged business owners
and executives to seek unconventional
ways to achieve their business objec-
tives, possibly by using new technolo-
gies. Although cloud computing is not
a new concept in the IT community,
the current state of the economy may
be a key factor in helping it go main-
stream.
The term “cloud computing,” where
“cloud” is typically used as a metaphor
for the Internet, is loosely defined as a
technology in which scalable resources
are provided as a service over the In-
ternet. Companies using this service
can operate effectively without having
in-depth knowledge of the underlying
technology or infrastructure.
This is possibly a new concept to
most organizations, and will take some
time for implementation. However, in
many cases, cloud computing services
provide a similar interface for end us-
ers, so the transition may be relatively
seamless in their eyes.
Whether you are a CPA whose firm
or company is considering turning to
cloud computing, or you have clients
exercising this option, it could be ben-
Technology • Disclosures • November/December 11
eficial to learn more about the nuts and
bolts of this emerging technology.
How does it work?
Cloud computing exists in a variety of
forms, some more complex than others.
The more common forms employed by
organizations are software as a service
(SaaS) and infrastructure as a service
(IaaS).
Software as a Service (SaaS)
With SaaS, a vendor hosts software
on their web servers and the customer
purchases licenses to use the software
as a service on demand. This is an alter-
native to typical software licensing, in
which software is installed on individual
PCs and a company purchases individual
licenses or a site license for a specified
number of users. SaaS can be easier to
deploy across a large organization be-
cause the IT staff does not need to access
each terminal to install the software. In
addition, because the vendor is hosting
the software, professional technical sup-
port may be more readily available for
smaller organizations, which may not
have a large IT staff.
Infrastructure as a Service (IaaS)
IaaS goes a step further by providing
almost all of a company’s computing
resources as a service over the Internet.
Instead of acquiring all of the necessary
equipment, such as servers, data center
space and networking equipment, a
company could purchase these resources
from an outside vendor. The individual
PC platforms would be virtualized,
meaning that the operating system,
memory, processor and other comput-
ing resources would be supplied by the
vendor’s server on demand. End users
should not see a difference between a
traditional standalone PC and a virtual
machine, except that their personal pro-
file (i.e. documents, settings, website
favorites) can be easily transferred to
another terminal as it resides on the
server (or “in the cloud”) and not on
a specific PC. Similar to a utility, this
service is typically billed based on usage,
so the monthly cost would vary pro-
portionately depending on the amount
of activity.
Other forms of cloud computing
include platform as a service (PaaS) and
in-house cloud computing. PaaS is a de-
rivative of SaaS, but instead of providing
access to specific software applications,
vendors provide web-based software
development tools and related services
over the Internet.
In-house cloud computing is simi-
lar to IaaS, but it is not outsourced.
Instead, the organization develops the
cloud internally as an alternative to uti-
lizing standalone PCs. w
Benefits
There are many reasons to consider
moving toward cloud computing; one of
the best could be the potential cost savings.
However, there are other benefits that may
rank just as high for some organizations.
Cost savings
Likely one of the main reasons for mov-
ing to cloud computing, cost savings is a
key benefit of this technology. On one
hand, it allows organizations to reduce the
level of internal staff required to support
the company’s infrastructure and software.
On the other hand, it also frees up the
capital invested in hardware and software,
as well as the physical space needed to
house everything, whether on or offsite.
Because some services are billed based on
usage, companies also can help minimize
costs during non-peak periods versus pay-
ing fixed costs associated with maintaining
their own equipment and staff.
Technical support and expertise
Companies offering cloud computing
options typically specialize in the services
they supply, so they can often provide a
higher level of technical support and ex-
pertise than could be provided in-house.
IT professionals are often stretched thin
and, especially for smaller businesses,
are required to perform several different
functions. In these cases, the depth of their
expertise in one area may be limited due to
the breadth of knowledge they are required
to have in multiple areas.
Data security
Because a significant amount of their
resources may be devoted to maintaining
and protecting their data centers, certain
vendors may have the ability to implement
security measures that are more effective
than those of their clients, especially small
or mid-sized organizations. Therefore, it
may give management more peace of mind
to have their confidential data housed in
a more secure location than they could
provide themselves.
Dynamically scalable
If a growing company were maintain-
ing its own infrastructure, it may need to
maintain enough equipment to allow for
unrestricted future growth, which could be
much more than it needs right now. With
12 Technology • Disclosures • November/December
cloud computing, service providers can
quickly adjust their offerings based on the
needs of their clients. Their clients could
quickly expand their services as needed
and proportionate to their growth, and this
could be implemented more quickly than
if they had to do it themselves.
Response to change
Technology changes rapidly, making
it difficult for organizations to stay ahead
of the curve amidst their many priorities.
Cloud computing arrangements allow
organizations to focus on the priorities
that will best serve their businesses and
their customers, while service providers
focus on ensuring they provide the best
service and maintain the technology for
their clients. This will typically allow them
to stay more in tune with the changing
environment and respond accordingly. All
of this would be done in the background,
preferably, with minimal impact on the
end users.
Reaction to issues
Data loss, downtime, viruses and hack-
ers. These are just some of the enemies that
businesses face every day. As with security,
data protection must be a top priority for
cloud computing vendors. Therefore, they
may be able to dedicate a higher percentage
of their resources toward protecting client
data, recovering lost information and/or
ensuring their data centers quickly get back
online after an outage.
Mobility
With companies becoming more decen-
tralized, along with increased globalization
and telecommuting, improved mobility
is a common strategy among many orga-
nizations. Having quick and easy access
to company resources from a variety of
locations has become a necessity. Because
everything is Internet based, computing
in the cloud can significantly increase
mobility by making everything accessible
through a secure web interface. In addi-
tion, with IaaS, laptop data security can be
significantly increased because only limited
information, if any, is stored on the PC.
The computer is only used to access data
stored in a secure location.
Risks
Security concerns
Despite the possibility that a cloud
computing vendor can offer enhanced data
security, the opposite may be true as well.
While it is more likely that the larger,
more established vendors can offer the ap-
propriate level of security, there is still no
guarantee the security measures are always
operating up to the standards clients would
expect. Because the company has limited
direct control over their data maintained
in the cloud, they may be unaware of any
deficiencies in the security controls until a
serious issue arises.
Implementation costs
As with any new project, there will likely
be considerable upfront costs related to
converting to a cloud computing platform,
depending on how significant the change is
for the organization. If they have already in-
vested a large amount of capital to establish
the existing infrastructure, it is important to
consider whether this additional cash outlay
will result in sufficient cost savings in the
future. There will likely be a monthly or
annual subscription charge associated with
this new arrangement, which must also be
considered.
Dependency
Because the software and data are being
hosted by the vendor, the company becomes
dependent on the vendor to operate. If the
business function being hosted in the cloud
is critical to the company’s operations, any
service interruptions or deterioration in ser-
vice quality or consistency could impact the
company’s performance and ability to serve
its customers. It is critical that the company
evaluates possible alternative solutions if a
situation like this were to arise. (See also
the section on disaster recovery planning,
page 13.)
Limited options or variety
In order to keep implementation and
operating costs down, vendors may de-
velop a product that only allows for limited
modifications, similar to an “off-the-shelf”
software package. Not only does this limit
an organization’s ability to customize the
product to its specific needs, it may also
limit its ability to differentiate itself from
competitors using a similar product. While
this might be more cost-effective now, it
may prove more costly in the long run if the
organization must move to a new vendor as
its needs evolve.
Other considerations
Depending on which area of the business
you are considering moving into the cloud,
it will most likely be a significant change in
how the company functions and may affect
several business areas — some of which
were unintended. Therefore, it is important
to perform several actions before entering
into a cloud computing arrangement.
Identify business function(s)
The decision will be based on the solu-
tions available that suit the needs of your
business. It may become clear that certain
functions are essential to the business, and
management may be more comfortable
keeping those in-house (i.e. sales transaction
processing). Other functions may be con-
sidered ancillary and can easily be migrated
to an outside vendor (i.e. e-mail, payroll).
Regardless of which function is migrated,
the impact on other areas of the business
must be evaluated to limit any unintended
consequences that could adversely affect the
success of the project.
Assess risks
It is important to consider the risks as-
sociated with any new arrangement. As
discussed previously, cloud computing
does not automatically represent a greater
security risk. However, management must
determine the acceptable level of risk and
evaluate each situation accordingly. This
new arrangement could also enhance other
business risks as well, such as business in-
terruption and data integrity. These risks
should also be evaluated and, if necessary,
management should establish the appropri-
ate safeguards to mitigate these risks.
Identify vendor(s)
The vendor will, of course, be dependent
on the type of cloud computing service or
combination of services being utilized. There
are multiple major service providers offering
various forms of cloud computing. Each po-
tential vendor should be evaluated carefully
to ensure they can offer the services and level
of security desired by your organization.
Therefore, a lot of research will be required
to determine the best solution(s).
Technology • Disclosures • November/December 13
Planning for disaster recovery
Every business should have an adequate
disaster recovery plan in place. Moving to
a cloud computing arrangement does not
necessarily replace this need. It is likely
your vendor will have certain safeguards in
place to help limit the damage caused by data
loss or downtime. However, your company
should consider developing a separate plan
in case the vendor is unable to recover your
data or is incapable of doing so in a reason-
able amount of time.
Is it time
to make the move?
Cloud computing appears to be a vi-
able option for companies of varying sizes;
whether the goal is cost savings, increased
efficiency or just to reduce the need for in-
house IT professionals. Moving some opera-
tions “into the cloud” can allow companies
to reclaim resources historically allocated
to procuring, maintaining and supporting
the technology necessary to function — it
can be the ideal, capital-friendly solution for
growing businesses.
That said, it is not a decision that should
be taken lightly, and thus requires in-depth
analysis to determine the benefits and risks
involved.
Now that your head is “in the clouds”
and you have a better understanding of
how cloud computing works, is it time to
implement these solutions in your work-
place? 
Note: The opinions expressed are those of the
author and not of the author’s employer.
Haven S. Pope, CPA,
CFE, is the manager of
financial reporting at
CarMax, Inc. (www.
carmax.com), in
Richmond. He has
more than nine years of
accounting and auditing experience,
including seven years in public
accounting. He was voted as a Super
CPA in 2008 and also sits on the
VSCPA Editorial Task Force. Contact
him at haven@hjpope.com
or visit his profile on LinkedIn at
www.linkedin.com/in/havenpope.