A Sense of Validation

Purveyors of hosted software have long touted the virtues of their distribution model. There are plenty, too. A rented application, delivered direct to desktop via the Internet, reduces the need for IT staff. Monthly subscription fees are relatively cheap — at least when compared with a million-dollar software license and a 20 percent annual maintenance charge. And the rollout time is short, often weeks rather than months. Now, add one more plus: hosted apps can help lighten the regulatory load.

Indeed, users are discovering that hosted applications — also known as software as a service (SaaS) — are uniquely suited for businesses in highly regulated sectors. Why is that? Because many Web-hosted applications and processes have already been vetted by regulators.

That eliminates the need for customers to individually validate systems, as is often the case with onsite technologies. "If it's a SaaS application, the responsibility to get this software authenticated relies on the vendor," says John Hagerty, an analyst with AMR Research, a Boston-based technology research firm. "That takes a lot of the hassle off the clients."

The Flipping Point
Consultants say medical and pharmaceutical operations, in particular, can benefit from SaaS's pre-approved status. In pharma, for example, a company is required to maintain "validated systems," meaning the technology has been blessed by regulators and is in compliance with all mandates. "If you're using a third-party provider," says Hagerty, "you should be able to inherit its validation."

That's how it works for Ventana Medical Systems. A maker of medical-diagnostics equipment, the Tucson-based company must regularly certify its systems with the Food and Drug Administration. "In a regulated industry [like ours], you spend most of your time validating and updating software," notes Anthony King, vice president and chief information officer at Ventana. "It really doesn't add value to your business."

Web-hosted software flips most of that responsibility onto the software provider — in Ventana's case, Salesforce.com. "We don't have to validate the Salesforce.com tool, only the way we're using it," says King. "That becomes a pretty straightforward validation." King believes that Web-hosted technology cuts Ventana's business validation work "from man-years to man-hours."

Corporate customers say rented applications also help them do a better job of managing crucial regulatory information. This is a bit surprising, given that many managers have steered clear of rented software because of concerns about data security. But in reality, companies that use more-traditional onsite software and data-storage tools often spread key data across multiple systems. "In a regulated industry, if you have data in two places, you can almost guarantee that it's going to be wrong in one place," says Jim McGeever, CFO of NetSuite, a SaaS provider.

Southwest Windpower, a maker of turbines, relies on NetSuite and other SaaS technologies to host crucial corporate databases. Southwest uses the data, among other things, to document hazardous materials used in the construction of its windmills. The hosted approach ensures that the information, which is sent to U.S. and European regulators, is kept secure and consistent. It also means Southwest's employees and business partners can view relevant data from any location. "The information is available 24/7 worldwide," says Susan Casebeer, Southwest's CFO. "That's what I love about SaaS."

Carbon Copies
This is not to say that hosted programs solve all regulatory problems related to software. Compliance rules and procedures vary widely across sectors — and regulatory bodies. Thus, a potential adopter needs to carefully examine a Web-based application to determine if it applies specifically to the company's industry. And no matter how secure a hosted piece of software is, regulators will still hold customers accountable for poor recordkeeping or lax internal controls.

Those caveats have not deterred many clients. Users say rented apps help solve a world of compliance problems, including regulatory reporting requirements. Chemical giant DuPont, for instance, uses a SaaS-driven compliance system developed by Enviance to streamline its toxic-waste reporting to the Environmental Protection Agency. (For more on environmental reporting, see "Cleaning Up Carbon.") The technology collects toxic-release inventory data from 63 U.S. sites and then sends the information to the EPA. Says Aldo Morell, DuPont's director, safety, health, and environment: "It automatically generates the form that is submitted to the EPA from the site."

The system has also helped DuPont slash the time it takes to enter and process data into the reports. Equally valuable: Enviance monitors EPA regulatory changes and modifies the reporting software accordingly. That frees DuPont from having to alter the application. Says Morell, "That saves us money."

John Edwards, a frequent contributor to CFO, is author of The Geeks of War.

Certifiable
A hosted application helps one insurer keep up with a welter of state regulations.

• 1
• 2
• next »