cfo.com

Print this article | Return to Article | Return to CFO.com

Cloud FAQs for CFOs

What finance executives should know about cloud computing, and why they should know it.
David Rosenbaum, CFO.com | US
July 12, 2012

Q: OK, I'll bite. As simply as possible, explain the cloud so that I don't have to go to any more conferences or listen to any more lectures.
Once upon a time, if you ran a business and needed electricity, you made it yourself. You had a generator; you bought coal and burned it. Your business wasn't making electricity, but you had to devote resources to producing it and staffing the machines. Maybe you even had a chief electricity officer. Back in the day, some manufacturing companies did. Then power plants were built, and it became cheaper and more efficient to buy electricity and simply write a check to an electricity provider.

Today, it's becoming cheaper and more efficient to buy computing power, data storage, IT applications and services, and even infrastructure — accessing it all through the Internet — than to make and manage the stuff internally. It's cheaper — and the cost is still dropping — because cloud providers can leverage huge economies of scale by hosting many customers in their data centers (in what's called a multitenant environment) and optimizing the use of their servers.

There's also the private cloud, which means you've done what the cloud providers do within the walls of your own company. You've virtualized your data center, ideally making your servers and your IT operations cheaper and more efficient. By creating these virtual machines, you've also made it easier to implement and integrate new applications, and you've improved the performance of the systems you have, which you and your employees can access through a browser on any device you support.

Finally, some organizations use the public cloud for some work and their private cloud for other work, and that's called (sensibly) a hybrid cloud.

Q: But I'm a finance officer, not a technologist. Can you guarantee that the total cost of ownership for the cloud is lower than what I'm already spending for my on-premises IT?
That depends upon what you're already spending. Do you know?

According to Forrester senior analyst Dave Bartoletti, most companies are not all that good at knowing how much it really costs to run an application because IT departments "are still seen as cost centers." The company buys the servers, the storage, and the applications, and flips the switch. "What does it cost to run?" Bartoletti asks rhetorically. "Who knows? You just depreciate the assets over a certain amount of time and after they're fully depreciated, you buy more." Even organizations that account for staff costs, maintenance, energy — all the indirect spend that goes into producing a service the business needs to run — will probably not be able to cost out individual applications with any degree of accuracy. How much, for example, does your e-mail cost? "If your CIO can't tell you it's x, y, z, per box," Hotels and Resorts CIO Mike Blake tells CFO, "that's a problem."

"Enterprises are making significant investments in cloud technology in pursuit of lower costs," says Dave Zabrowski, founder and CEO of Cloud Cruiser, a provider of cost analytics for cloud consumers, but "if you can't see what you're spending, there's a good chance you're spending too much."

And that problem, that financial black box, has been the bane of the finance officer's life in the IT age. The cloud, if nothing else, presents an opportunity to open that black box, although it doesn't do so by itself.

Q: How can the cloud open the box?
"With cloud computing," Blake (formerly head of capital budgeting at Sears) tells CFO, "things are brought down to cost accounting. It's price p times quantity q equals whatever you're buying." And because the p of cloud infrastructure is dropping so quickly (Amazon Web Services, for example, keeps dropping its prices for web hosting and other services), Bartoletti insists that now is the time for CFOs to figure out their IT costs so that they can know whether a point of inflection has been reached where moving applications or infrastructure to the cloud is indeed cheaper for their organization.

It might not be, it might be: it's the CFO's job to know.

Q: Why is it my job? My job is hard enough. Why can't IT do this work?
How business savvy is your IT department?

"The financial and contractual acumen required to purchase and manage cloud services is quite different from the traditional capex and depreciation model well understood by chief information officers," says William Forrest, a principal at McKinsey. "Purchasing on a subscription basis and managing demand is much better suited to the types of things CFOs typically buy rather than IT guys."

What CFOs can do, Bartoletti suggests, is to work with IT people to teach them the basic principles of financial management. "Build a simplified model of capex and opex by application," he says. "Inventory the cost to the business of services on a per application basis because that's how you're going to move to the cloud. It will be piecemeal: enterprise resource planning [ERP], customer relationship management [CRM], Salesforce. Try to figure out the costs for one or two key applications. That will help advance the communication between the CFO and IT, thinking in terms of service, not infrastructure. It's not about renting servers or disk drives; it's about what it costs to get the job done." Or, as Forrest says, "It's up to the CFO to set expectations for a reasonable spend for IT. What's the value add of the IT function? IT typically hasn't done a good job in defining that, and they've been protected from that sort of business introspection due to IT complexity."


One of the promises of the cloud is that it can remove that complexity — getting down to p times q — and reduce the price that complexity exacts. As a capital expenditure, much of the complexity is hidden in the budget and then forgotten. As an operating expense, it becomes far more visible. As cloud financial-management and accounting-services provider Intacct CFO Marc Linden tells CFO, cloud computing "clears the air. I get a bill. All I have to do is read the bill. That makes the cost-benefit analysis a lot easier. I can ask, 'This thing is expensive. Here's what we expected. Are we getting it?'"

If a company's internal IT organization claims it can meet or beat a cloud provider's price, Forrest suggests that CFOs should ask their chief information officers to give them what he calls a "fully loaded cost" for each server the company owns, and the applications that run on it, including depreciated capex, opex, and all the labor involved in managing it. Forrest believes IT departments are generally poor at capturing the labor cost. IT will "take the cost of a server and the cost of the data center and divide by the number of minutes running the server and say that cost is as good as a big cloud provider. But that's just the capex price. "If your CIO can't give you the fully loaded cost, you can reasonably point out that the claim that they're as inexpensive as a cloud provider is not credible."

After all, for CFOs one of the most compelling differences between cloud and on-premises computing is the way it's paid for. On-premises computing requires capital expenditure; cloud services are typically purchased on a subscription model and are accounted for as an operating expense. And, then-Hewlett-Packard CFO Catherine Lesjak told CFO that in her opinion "paying cash over time is better than paying cash up front."

Q: Capex, opex. It's all cash. Why should it make a difference to me?
Whether or not you agree with Lesjak, even if paying for a traditional perpetual software license with all its cost predictability sounds better to you than a renewable subscription (with potential volume-use cost escalators that can raise the price, as former CIO, cloud consultant, and CFO columnist Rob Livingstone points out), "pay-as-you-go" IT, according to former CFO, executive coach, and CFO columnist Susan Cramm, "frees management to focus on the product, not the plumbing."

And with this freedom comes agility.

Q: What kind of agility?
"IT used to come up with ideas and run [them] through the solution-delivery life cycle — build, test, deploy — and it could take two years," Blake tells CFO. "Now you can get an application up and running in a few minutes. No one's waiting for IT anymore."

"Developers are using the cloud to test things out," says Forrester's Bartoletti. "A developer wants to try something; he goes to IT and gets told it will take six months. So he just goes to Amazon to rent a server for a couple of cents an hour." That ease of access, combined with the acceleration of the development process, enables businesses to bring products to market faster, not to mention more cheaply than ever before. That, and not just lower costs, is why PricewaterhouseCoopers's Digital IQ Survey of nearly 500 U.S. business and technology executives found that 30% of PwC's top performers are already invested in cloud applications and 87% expect that investment to increase this year.

Unfortunately, that combination of ease of access, low cost, and speed is one of the reasons you probably have cloud services, or cloud applications, running in your business even if you and your CIO are unaware of them.

Q: How can I have cloud applications and services in my organization and not know about it?
It's called "shadow IT" for a reason, and everybody's got it. In the case of the developer who goes to Amazon because he doesn't want to wait for his boss to grant him server time, he's accessing platform-as-a-service. Then there's the business-unit leader who, as HP's Lesjak described, "wants a new service and the CIO says it will take six months to set up, test, and deploy. [So] the business guy goes to a cloud provider who says he can get it set up in two weeks." That's software-as-a-service (SaaS). And no one, neither the CIO nor the CFO, is any the wiser, even, sometimes, when the bill shows up.

"CFOs are seeing capital requests decrease because SaaS is captured [as an operating expense], not capex," KPMG lead partner Greg Bell tells CFO. And sometimes, as he says, "financial-planning staffers aren't aware of some of these expenditures until they hit a certain dollar level, and by then the investment may be more difficult to corral or change." Lesjak even admitted that shadow IT exists at HP, a corporate, IT-intensive environment one would presume would be pretty well locked down.


Having unaccounted for and unknown cloud applications and services operating within your IT environment introduces a great deal of risk, both financial and technological.

Q: OK. You've been telling me about how great the cloud is, how it's cheaper, makes the IT spend more transparent, and allows my business to be more agile: now give me the other side. What are these risks of which you speak?
Ah, there are so many risks.

With shadow IT, for example, not only can costs pile up sight unseen, impairing your ability to budget and forecast, these ungoverned, unplanned-for applications running in your IT environment can create data silos that resist integration. They thus degrade the operational efficiency that drives finance. Lesjak suggests that CFOs can begin determining how widespread shadow IT is in their organization simply by "looking at your Amex expenses and seeing if there's something there that says Amazon. That's where it shows up."

Q: What about outages?
Outages happen. All the time. Late last month, for example, East Coast electrical storms took down Amazon's cloud. That caused outages for Netflix customers and Instagram and Pininterest users.

Outages are inevitable. What's important is understanding the risk, and understanding that it's your responsibility to mitigate it. James Reavis, director of the nonprofit Cloud Security Alliance, tells CFO that in another outage event, he found a company "that hadn't even checked the box to make sure it had the backup services it wanted."

Make sure you check the box when you sign your contract.

"It's a business-recovery decision for CFOs," says Ben Trowbridge, founder and CEO of Alsbridge, a sourcing advisory and benchmarking firm. "What does it mean to your business to be out for a couple of hours or a couple of days? Perhaps you can afford to have your business down intermittently." In that case, Trowbridge says, you may be able to forgo the cost of having your site backed up so it can be moved to another set of servers in case of an outage.

For large businesses, McKinsey's Forrest advises contracting with more than one infrastructure vendor. If you have a "split vendor policy," he says, "your business might not be taken down" during outages.

Forrest also suggests mitigating the risk of becoming too dependent upon one cloud vendor by following an
80-20 rule, maintaining at least some relationship with another cloud provider. If the company that distributes your product, for example, is the same company that's running all your computing services and hosting your web site, Forrest says, then that company would know as much about your business as you do. And that may not be ideal.

Q: Now that we're talking about risks, what about data security? Wouldn't my data be more secure in my own building, behind my own firewall, than sloshing around in some third party's data center?
In the connected world in which we live, security is relative. And the risk of doing business has risen no matter where your data is stored. According to data collected by Panda Security last year, 50% of the computers they scanned were infected with some kind of computer threat: Trojans, viruses, worms, spyware, hacking tools, you name it. That includes the computers (and phones and tablets) your employees are using to access your systems in your building behind your firewall. They can get through the firewall because they're your employees and you've allowed them access so they can do their jobs.

It's pretty obvious, however, that the cloud can concentrate risk. When something goes wrong in a large, shared data center, it can affect a large number of organizations. And precisely because of the complexity of those large data centers, it may be difficult to identify (and fix) whatever's gone wrong. Again, large businesses can invest in system-replication facilities and redundancies that can help move applications and data to backup sites. Smaller organizations, without great resources, must do the dirty work of risk-benefit analysis. 

On the other hand, security at cloud providers tends to be more professional, and certainly better funded than small businesses can usually afford. But it's up to CFOs to vet their providers' security, and to make sure their certifications, policies, and procedures fulfill their business's regulatory requirements. Further, suggests Timothy Chou, former president of Oracle On Demand who teaches cloud computing at Stanford University and is a CFO columnist, begin investigating insurance instruments as risk-mitigation tools.

Q: Speaking of regulatory requirements, I do business in Europe and there are a plethora of rules about how my data can be stored and where it may reside. How can I control that in the cloud's multitenant environment in which data is constantly moving around?
Governments, according to Livingstone, are trying to reach agreements on common operating standards to mitigate that risk. However, he suggests, it would not be wise to hold one's breath until they come together. Until those agreements (which are being lobbied for by the major cloud vendors) are hammered out, he emphasizes, CFOs need to "know how to conduct an audit of the cloud infrastructure, as well as where, how, and in what manner the data (and the systems that access and manipulate it) is being managed."


There are other legal issues to consider. Daniel Garrie, managing director of ARC E-Discovery Dispute Resolution and a court-appointed Special Master in governance and e-discovery cases, raises the issue with CFO of data retention in the cloud. "How long do you have to keep e-mails?" he asks. "If you don't plan strategically for adopting cloud, you may fail to realize that [your provider is] keeping your e-mails for a year instead of, say, 90 days. Then you get sued and you have e-mails popping up you thought were gone. And then you have to provide them."

And if your provider can't come up with them, you can't, as Garrie points out, say to the judge, "The cloud ate my evidence." In litigation, that's called spoliation of evidence, and the court frowns on it.

The larger message: in the cloud, your relationship with your vendor, especially the openness and transparency of your communication, is of critical importance. In the cloud, "the vendor becomes your outsourced IT department," Intacct CFO Linden tells CFO. "Therefore, the nature of your relationship with the vendor changes. It becomes closer and more interactive."

Q: And what if my vendor goes out of business?
That would be unpleasant, wouldn't it? "Always have a plan for where you'd go if your provider shuts down," Forrester principal analyst Liz Herbert tells CFO.

But even before that, vet your vendor. Andrew W. Klungness, a partner at law firm Bryan Cave who specializes in cloud issues, places responsibility for mitigating cloud risk right in the CFO's lap because "cloud is a financial decision." Klungness advises CFOs to make sure their provider is solvent and carries insurance. "A financially sound vendor is likely to be there when you turn on the lights Monday morning," he tells CFO. "Check breach incidents and lawsuits against them, and ask for customer references."

Always ask for references when engaging with a potential vendor. Alsbridge's Trowbridge believes CFOs should also talk directly with the provider, to a businessperson, not a technologist, "or even worse, a technology salesperson."

Q: All this talk of risk is seriously depressing. Let's get back to what the cloud can do for me. Can it really transform my business as people say?
That's why CFOs should be interested in the cloud. Saving money through cloud computing is simply hardware arbitrage.  Instead of your expensive servers, it's the cloud provider's cheaper servers, and it's passing its savings on to you, the customer.  But as attractive as that may be, it's limited. "We've seen people making decisions on SaaS based on the fact that they don't have to write a big upfront check," CFO Linden tells CFO. "You don't want that to be the deciding factor for something core."

So what factors are important?

Imagine you're a manufacturer that makes a type of candy — say a sweet, yellow, marshmallow-y baby bird — that only really sells during a specific holiday season. Or you're a retailer of fur hats and during the summer you don't sell many on the East Coast unless you discount deeply. The cloud shines, says Forrester's Bartoletti, when a business is handling dynamic loads, seasonal variations, and cyclical demand, either predictable or unpredictable. That's because instead of paying for the capacity to handle maximum volumes (stocking up on servers) and then seeing that capacity underutilized (as those assets gather depreciating dust), you can simply stop paying for them, turning off the spigot. That's nearly impossible to do with one's own infrastructure. But cloud providers designed their data centers precisely to do that: scale up and down quickly, shift workloads from overutilized to underutilized servers, taking advantage of economies of scale.

Plus, "Anyone who has a strong dependence on a public web face, or uses a web site as a primary means of revenue generation" should consider the cloud, says Bartoletti, "due to its ability to quickly scale costs up and down." So, he advises, let the cloud provider do it for you. And when you've shifted your costs out of your corporate infrastructure, and you're no longer in the business of supporting devices and hardware, then you can invest in innovation. "It's a shift from information technology to business technology," says Bartoletti. "Each technology decision gets made on a business basis. CFOs need to articulate to IT what services the business needs rather than hearing from the CIO about how many servers it needs."

Q: That sounds like the cloud can help me do what I already do more efficiently. But how can it change what I do change the services I provide, the products I make?
The increased computing power available through the cloud can enable organizations both large and small to provide more data-rich products and services. For example, says McKinsey's Forrest, the old business model for providing hospitals with medical-imaging devices was to install the machine, charge the capex cost to the hospital or clinic, and maybe service it for a monthly fee. Now, he says, the device manufacturer can give the hospital the device for free, charge per image, store the image data in the cloud, and provide access to it on a subscription basis. Because the buyer (the hospital) is capital constrained, that's a good deal, and certainly far cheaper than paying big bucks for the machine (which you sometimes use and sometimes don't) and storing the data in its own data center. (Remember what HP's Lesjak said: "Paying cash over time is better than paying cash up front.") In return, the device manufacturer gets the long tail of predictable revenue over time via the subscription: a different way of doing business.


Remember the last time you flew? Did you use the kiosk to get your boarding pass? Perhaps while you were clicking though the screens, you were asked if you'd like to pay an extra $25 for an aisle seat. And maybe you accepted the upgrade because, after all, the machine already had your credit card and all you had to do was click the box to be able to stretch your legs: a very different experience than interacting with a harried agent at the desk while you were trying to check your bags. This added functionality, the opportunity for the airlines to up sell easily and almost antiseptically, is a gift of the cloud.

Forrest provides a personal example: a friend of his owns a small, local chain of furniture stores, and the number-one determinant of the size of a customer's order is whether or not he "clicks with their designer." The old system of matching customer with designer, Forrest says, was the "Death of a Salesman–based model." Whatever designer's name was next on the list was given to the customer. Today, the stores have a new web site that matches the customer to a designer on the basis of shared tastes. "So even for small companies," he concludes, "the cloud is changing business models. The added functionality, the web hosting, all provided by a third party in the cloud — there's no way my friend could have done this before."

Indeed, for smaller businesses, the cloud can be the great equalizer. Trowbridge's Alsbridge sourcing advisory is a relatively small business, with less than $100 million in revenue. But, he says, "We look and feel like a much larger business because we take advantage of so many cloud-based services. Our sales and marketing are in the salesforce.com environment. We have 15 different cloud-based apps. If you roll the film back 10 or even 5 years, we wouldn't have had access to any of those systems. We have access to anything any Fortune 500 business would have. Maybe more, as we're much more nimble and can adopt cloud-based systems much more rapidly than larger businesses.

"I think the cloud acts as an accelerator for small businesses," he continues. "I see CFOs adopting cloud services and not having to sign up for 10-year agreements with big vendors. Instead, they can buy by-the-drink and prove to themselves that the application works."

Q: OK. I'm not sure yet whether this is for me. But what's the best way to start?
Chou suggests beginning by inventorying all your existing applications, and then thinking about what makes your business special. He believes cloud providers are becoming increasingly specialized and that you can match what you do with what they do.

Trowbridge suggests that CFOs, especially of smaller businesses, explore channel providers who can offer a "higher level of touch" to bridge the gap between your business and a big cloud provider. "Dealing directly with Amazon," he says, "is like being handed a brain-surgery kit, being told it's world class and ready to go, and now you can go do brain surgery."

Bartoletti says small businesses can quickly build large user bases without having to build an IT infrastructure. "You don't have to license Office or Sharepoint," he says. "You can run it in the cloud." He also cautions CFOs not to go into the cloud blindly. "Understand the service levels you're willing to accept," he says. "You should go into the cloud with a clear set of service-level expectations and an understanding of the penalties your provider will pay if they're not met."

And PwC principal Phil Garland says CFOs shouldn't go into the cloud alone: they need "a trusted adviser." There's "no way [for CFOs] to keep abreast of the changes," he tells CFO.

That adviser could be your CIO. IT, after all, is not going away. It's just changing — the same that it ever was.




CFO Publishing Corporation 2009. All rights reserved.