In Automated Controls It’s No Longer the Traditional Build vs. Buy

In Automated Controls It’s No Longer the Traditional Build vs. Buy

• 1.
  BUILD OR BUY? Abstract Decadesof experience and research have shown that organizations maximize their return on investment (ROI) when they build or buy solutions that automate core processes. While making the build versus buy decision for automated or ancillary data integrity controls, an organization needs to determine if it is in the business of controls and how each option impacts Capital Expenditures (CAPEX) and Operational Expenditures (OPEX) budgets. “Buy to standardize, build to compete” has been an IT mantra for many years. Yet, executives responsible for developing an automated controls strategy continue to struggle with this question. The decision not only impacts the ability of an organization to meet its immediate controls needs but also has longstanding influence on the ability to maintain and sustain an internal control environment that is aligned with business needs. The rule of thumb has been: if the system is a requirement for business, “buy” is the answer; conversely if the system provides a competitive advantage, then the answer is “build.” Leading organizations that use Infogix Controls have achieved significant cost savings (up to 80%) compared to internal development options. In this paper, we propose an alternative way to look at Build vs. Buy by splitting “buy” into two options: – pre- packaged offering and configurable solution. The pre- packaged offering refers to an off-the-shelf product, while a highly configurable solution combines the virtues of a “build” solution with the flexibility and adaptability of a “buy” solution that is faster to deploy and removes the risk inherent in building internal controls. Regardless of the solution, the decision points remain the same: CAPEX vs. OPEX cost, time to deployment, internal politics, regulatory compliance mandates, architecture, IT staff competencies and strategic importance to the organization’s bottom line. However; as IT departments are increasingly stretched thin, in part due to increased data governance, audit, and overall challenges to close fragmented data integrity gaps, the case for a highly configurable data integrity controls solution becomes a compelling consideration to deliver a tailored system that capitalizes on the benefits of both building and buying. Leading organizations that use Infogix Controls have achieved significant cost savings (up to 80%) compared to internal development options. In addition, implementing Infogix Controls has enabled these organizations to rapidly deploy controls to efficiently meet changing business and audit needs. This position paper provides a framework to compare and contrast build versus buy by evaluating buy in two dimensions – pre-packaged vs. configurable – to delve into the financial and non-financial implications of these options. Introduction An automated data integrity controls solution helps an organization reduce costs, mitigate risks such as fraud and revenue leakage, and streamline compliance efforts by providing a complete audit trail of the control activity. A number of recent market trends like the exponential increase in transaction volume, adoption of real-time distributed systems, and compliance requirements are forcing organizations to automate their internal controls environments. While the importance and criticality of automated controls in sustaining a cost-effective internal control environment is paramount, executives are traditionally faced with the dilemma between building custom controls versus buying off-the-shelf solutions. While conventional wisdom may provide a clear-cut answer, executives and project teams are often tasked to present a business case for the option that is best aligned with short-term and long-term organizational needs. While the “buy” option gives an organization the flexibility to rapidly deploy controls to meet immediate needs, it also requires financial OPEX commitment in terms of license and maintenance fees. Similarly, the build option gives flexibility to develop features and functionality that are more closely aligned with the short-term needs, but it’s also fraught with several risks such as scope and cost creep In Automated Controls It’s No Longer the Traditional Build vs. Buy Exploring an Alternative Perspective An Infogix Position Paper by Lane Lambert and Chris Kosin
• 2.
  BUILD OR BUY? thatcan directly impact business performance. Therefore, it’s time to consider looking at the “buy” option from a different perspective to determine the most optimum use of CAPEX and OPEX, and deliver the best ROI. Option A: Custom Built Controls While custom built controls allow an organization the luxury of a complete control solution tailored for specific, unique business needs, there are significant and unanticipated challenges. The complexity of today’s disparate computing environments only magnifies the difficulties of implementing and integrating custom integration applications. Problems inherent in building and evolving these solutions to rapidly changing business and regulatory changes include: • Cost of Development • Cost of Maintenance • Cost of Audit • Cost of Training • Ability to Expand and Evolve • Time to Deployment Most companies underestimate the resource requirements for developing controls in-house. Many don’t consider challenging factors like compatibility of customizations along with supporting new technology platforms. Though all of these factors are critical considerations for choosing a custom built option, let’s expand upon the following three areas that must be considered in greater detail: 1. Expensive to Develop 2. Expensive to Maintain 3. A Lack of Process Improvement Expensive to Develop Undoubtedly, expense is the number one risk associated with custom building a controls application. Industry studies show that companies do not achieve the ROI when building a solution versus buying an off-the-shelf package. A custom built solution requires a wide range of technical expertise such as software developers, application architects, and user interface designers that are often scarce resources that can be utilized for other higher priority projects. In-house development can be more costly than it appears, with significant cost over-runs for organizations of all sizes. These over-runs can range from changing requirements to failing to understand the business requirements early in the project definition stage. Additionally, developers must be trained and code must be carefully tested. One should also bear in mind the loss of time and resources that could be devoted to other projects. In fact, according to a 2015 CompTIA survey published in eWeek, about a third of respondents re- deploy staff from low-priority IT projects. The overall cost of ownership can be significant in manpower and systems usage. It has been estimated that only 26% of all software development projects succeed. Expensive to Maintain Total costs during the software lifecycle can extend seven or eight years and a significant percentage of those costs occur after implementation. In short, maintaining and upgrading a custom built integration application can be an expensive proposition. Additionally, in situations where department knowledge is siloed, alternate plans must be made when the programmers who developed the original application move on to other projects or leave the organization. The maintenance burden of custom integration applications is complex and time-intensive. With a loss of the knowledgeable source, the maintenance burden can grow extensively. Compounded with the risk of poorly documented functions, the need to make necessary changes to the application can be complex and time consuming to implement. No Real Process Improvements Most companies underestimate the resource requirements for developing controls in-house. Many don’t consider challenging factors like compatibility of customizations along with supporting new technology platforms. The risk of not being well-versed in industry best practices and regulatory requirements is another concern. In reality, unless your organization is a software company, building software applications should not be central to running your business.
• 3.
  BUILD OR BUY? OptionB: Pre-Packaged Controls Solutions The decision to purchase a commercial off-the-shelf (COTS) data integrity solution is a viable option for many businesses to accelerate deployment, lower development costs, and provide authoritative industry expertise. Nevertheless, the following potential challenges remain: • Development of new controls can require vendor support and external consulting • Limitations on product architecture, scope, and capabilities limit the ability to expand • Maintenance cost, upgrades, and infrastructure requirements yield additional OPEX budget Development and Customization of Controls Many solution providers offer a pre-defined set of software controls that are seemingly ready for deployment. While the initial phase may fulfil short-term requirements, a pre- packaged solution often requires substantial resources to customize or expand the controls to the organization’s unique business requirements. A thorough risk assessment is often required to address complete regulatory compliance. Limited Scope and Capabilities The major reason for acquiring a pre-packaged solution is to effectively and efficiently support one or more business processes. However, this could be a shortsighted view; it’s in the best interest of the organization to not limit the scope to just the project at hand. In order to gain the greatest ROI, the software provider must be able to adapt to an ever-evolving process and meet future business requirements. The failure of a solution to meet this capability will merely result in a short-term fix and not a long-term solution. Pre-packaged solutions often require an organization to change their business process, rather than having the software adapt to the business’ needs. Maintenance Cost Ideally, the selected provider chosen is on the forefront of technical advancement. Of course, with this advancement comes the need to upgrade over time and with each upgrade comes cost in addition to the vendor’s annual maintenance fees. Upgrades are vital so that the organization can take advantage of the latest feature and security enhancements, but as commonly accepted: upgrades do have a cost to the organization in regards to manpower and time requirements. Additional cost could include infrastructure upgrades. Option C: Configurable Controls Solution Ever-changing technology and business model pressures are forcing industries to deliver new and improved products and services at a pace most companies struggle with providing the resources to maintain. With a configurable controls solution, it is possible to attain the best of both “build versus buy” worlds: buy a customizable industry-specific solution built on best practices for that industry, from an outside firm, all while allowing for future expansion and continuous growth. The advantage of a configurable controls solution is the ability to capitalize the vendor’s best practice expertise in creating and identifying an ideal solution while minimizing internal resource constraints and CAPEX budgets. The key attribute of a configurable controls solution is in the software development that is purpose-built to allow configuration to the unique business processes of the organization. This approach minimizes the company’s financial risk while deriving a positive impact on the ROI over the lifetime of the controls application. As with any option, there are challenges to the configurable controls solution. These include: • Evaluating vendors that offer a best-in-class buy solution that is purpose-built to be customized and tailored to your unique requirements. • Identifying a break-even point for measuring ROI or capturing value • Seamless integration amongst existing organizational infrastructure • Configurable capability to ensure seamless expansion opportunity Deciding Which Option is Best In order to help determine which option is best suited for the needs of your organization, here are some insights to help make a sound decision1 : 1 Gilbert, J.B., “Build vs. Buy” White Paper 2006, EH&S and Crisis Management Solutions
• 4.
  BUILD OR BUY? 1. Performa Needs Assessment. A needs assessment allows you to objectively identify the needs of various internal and external stakeholders. If a needs assessment cannot be conducted with internal resources, a third party with best practice expertise can provide a credible recommendation to build a business case. 2. One Size Does Not Fit All. Adapting your business processes to off-the-shelf software or adapting the software to the business can be a challenge. Consider what alterations will be required to adapt the system for your organization. 3. The Business Issues are Not Unique. Chances are, while a business may have a unique perspective, another business has addressed the same issues, but with a different twist. Learn from others before trying to reinvent the wheel. 4. IT Best Practices Should Be Employed. Follow these suggested development philosophies for creation, deployment, and extended life of software systems: • Adapt the process; right-size and continually improve • Balance competing priorities of the stakeholders • Collaborate across impacted teams • Illustrate value repetitively • Quality needs to remain the focus beyond software requirements 5. Measure what’s Important. Create Key Performance Indicators (KPIs) to measure quantitative, relevant and comparable principles. 6. Software as a Business is Risky. Unwanted risk is a potential problem that may cause loss or threaten the success of a project through increased CAPEX or OPEX cost, deployment delay, or benefit reduction. Some risks include dependencies, management issues, lack of knowledge, and issues with both organizational and regulatory requirements. 7. Software Development is a Niche, and Not for Everyone. If you decide to build, be sure to invest in enough resources for both the development and maintenance of the application. 8. Avoid Speed Traps. Do not intentionally or inadvertently give in to unrealistic deadlines. Unclear requirements, roles and responsibilities can curtail the pace of the project and compromise the business requirements. 9. Watch for Hidden Costs. Budget for the present and the future of the application. Plan for maintenance and upgrade expenses so that you have a comprehensive view of the costs. Why Leading Companies Choose Infogix Infogix as a configurable controls solution provider offers many advantages to a customer looking for a tailored solution. With its internal team of product developers, strategic service managers, and project and implementation experts, Infogix offers various alternatives to partner with you in developing and deploying a customized, automated controls solution in a timely, and cost-effective manner. The Infogix data integrity controls solutions sits on top of your data processes and monitors the data looking for errors, or risk, and provides detailed visibility and reporting. A benefit of using Infogix lies in the improvements and upgrades possible through available support and maintenance agreements. Infogix, with over 32 years of experience, works with some of the world’s most data-intensive organizations across multiple industries. Infogix understands industry requirements from both business user and technology perspectives. Infogix solutions can be incorporated into all business processes required for successful implementation. Infogix uses the philosophical approach for its best practices, which allows continuous learning and improvement. Infogix software provides the capability to feed data into powerful analytic reporting, which enables valuable real-time capabilities and trends on KPIs. This allows for significantly improved and faster decision-making. Financial Benefits With decades of industry experience and knowledge, Infogix has internal case studies demonstrating substantial financial benefits. On average, Infogix customers have enjoyed the following advantages:
• 5.
  BUILD OR BUY? Infogix Value Lower Development& Maintenance Cost Lower Training Cost Lower Audit Cost Higher Effectiveness in Preventing Errors Summary of Benefits The below graph outlines case study results in the development, maintenance, audit and training resources associated with the implementation of automated controls. Assumptions Infogix Internal Development Effectiveness 0.9 0.75 Development effort per control (hrs) 40 120 Development cost per control ($) 1600 4800 Avg Maintenance Effort per control per year (hrs) 8 36 Avg Maintenance cost per control per year ($) 320 1440 Percentage of controls subject to audit (%) 40% 40% Avg audit effort per control (hrs) 2 8 Avg audit cost per control ($) 32 128 Avg cost cost avoidance per control per year ($) 240 200 Cost of training per year 80 hrs total 5 hrs per interface Infogix Solutions provide significant cost savings compared to internal development options through the use of standardized and reusable controls and components. From the analysis of the numbers, we can calculate the following results: • Cost of Development: 85% lower than the internal developed* • Cost of Maintenance: 80% lower than the internal developed* • Cost of Audit: 75% lower than the internal developed* • Cost of Training: Standardized training versus control specific training *Results based on Infogix internal average case findings.
• 6.
  BUILD OR BUY? Non-FinancialBenefits Benefits of an automated controls solution should not be measured on financial results alone. Listed below are some non-financial benefits that will be recognized. Usability and Productivity Role based intuitive interface to increase usability Reusable components and rules to increase productivity Independence & Standardization Independence to meet audit and compliance requirements Standardized components to decrease deployment time Support & Partnership Multi-tier and dedicated resources to support customer’s initiative Partnership to engage customer in product and company development • Usability and productivity allows more time to use the product than time spent in development, and reduces the chance of a project getting placed on hold for time constraints, or worse, forgotten altogether. • Independence and Standardization provides out-of-box visibility, monitoring and trending capability for audit and compliance purposes, resulting in higher productivity. • When expert assistance is required, Support and Partnership provides the ability to develop complex controls, thereby increasing effectiveness and scaling manpower coverage of an organization. Multi-support levels are offered to tailor the unique business support needs of the client. If staffing or resource availability is an issue, Infogix offers managed services -- a unique combination of people, processes, and technology to operate under outcome-driven service level agreements.
• 7.
  BUILD OR BUY? TheInfogix Value When discussing development and maintenance cost, error prevention, audit cost, and training, Infogix has shown its advantage over the build or pre-packaged options. Customers who use Infogix Solutions have experienced the following benefits: Lower Cost of Controls • Costs 85% lower than the in-house development option • Cost savings through standardization • Lower lifecycle cost Active Product Lifecycle • New releases each year • Minor enhancements and bug fixes throughout the year • Customer driven product roadmap Lower Audit Cost • Reduced testing requirements • Enhanced controls transparency for audit • Audit trail for exceptions Knowledge and Expertise • Access to controls best practices • Participation in maturity model • Participation in product advisory groups Summary The options for implementation of a data integrity controls solution include Build, Buy, and Infogix’s Configurable Controls. The following table summarizes these options and corresponding benefits, cost factors and risks that need to be considered. Option A Build A Custom Built Solution Option B Buy A Pre-Packaged Solution Option C Configurable Controls Solution (Infogix) Summary Your Controls Your Process Vendor’s Controls Vendor’s Platform Your Controls Infogix Platform Definition Controls are custom built to meet business requirements. Each control is custom coded and maintained A pre-defined set of controls are provided as part of a package. Substantial coding and configuration changes are required to develop new controls or change existing controls A controls platform is provided and controls are developed using standardized methods. Benefits Much more control over the solution. Can be customized for maximum business advantage. Can be cheaper because of its fixed set of capabilities to solve a specific problem. Provides the flexibility to customize controls to meet business needs. Costs Cost of control development and maintenance. Cost of control operation and monitoring. Ongoing licensing costs Cost of control customization and maintenance. Cost of control operation and monitoring Ongoing licensing costs. Cost of control development and maintenance. Cost of control operation and monitoring. Risks Project Delays Cost Overruns and Scope Creep. Controls not aligned with business needs. Integration risks. Integration Risks.
• 8.
  BUILD OR BUY? Conclusion Withthe accelerating changes in the source systems that support business needs, coupled with increasing reliance on information for critical business operation and decisions, and an expanding (and ever-changing) array of regulation and compliance requirements, the use of automated information controls is a strategic necessity to ensure information accuracy and prevent fragmentation across the organization. Infogix Controls provide out-of-box visibility, monitoring and trending capability. Infogix’s solutions are highly reliable and many are highly productive 10, 20, and even 30 years after their deployment. Regardless of the industry (government, healthcare, banking, insurance, telecom or retail), IT demands are always in motion and on the rise. In the end, everyone is being asked to do more work with reduced resources. In order to determine if build or buy (pre-package or configurable) solution is best, an honest needs assessment should be performed to ensure objectivity. To make a sound decision, we encourage you to review the following questions regarding your business operations: • Is current in-house technology keeping up with the business needs? • Does the needed solution provide a competitive advantage? • Is the solution needed now, or can it be delayed with a stronger focus on it being more specific and correct? The adoption of a Configurable Controls solution is becoming more mainstream and it’s a win-win for any organization looking to improve their applications and to minimize their CAPEX. Furthermore, it reduces the number of in-house developers needed, which helps lower development costs, frees up resources to work on higher priority projects, and allows a more streamlined and scalable design process. Infogix Controls provide out-of-box visibility, monitoring and trending capability. Infogix’s solutions are highly reliable and many are highly productive 10, 20, and even 30 years after their deployment. Many organizations have realized savings between $2 million to $10 million a year when adopting Infogix Controls as their enterprise standard. In order to get all necessary parties on board for this undertaking, a business case should be developed to promote the needs of the various cross functional stakeholders. When developing a compelling business case, consider the following steps: 1. Quantify the benefits of automated information controls 2. Articulate the intangible benefits of automated information controls 3. Quantify the costs of automated controls. Consider both one-time cost and recurring costs 4. Develop the financial model to project return on investment 5. Summarize key findings using a business case 6. Present the business case to all the key stakeholders When evaluating “build versus buy,” the possibility exists to make a sound decision that minimizes risk and delivers the best result for the business by clearly recognizing needs, expectations, and resources strategically in the process. While each situation has advantages and disadvantages, the configurable controls solution is becoming the dominant trend to minimize CAPEX and maximize OPEX.
• 9.
  Visit www.infogix.com orcall 1.630.649.6800 (US, Canada, and International), +44 1242 674 137 (UK and Europe). Copyright ©2015 Infogix, Inc. All rights reserved. Company, product, brand, and mark names and logos herein are the property of their respective owners. For a list of Infogix trademarks, visit: www.infogix.com/legal twitter.com/Infogix facebook.com/Infogix linkedin.com/company/Infogix plus.google.com/+Infogix BUILD OR BUY? About the Authors Chris Kosin and Lane Lambert hold leadership positions as Customer Advocates with Infogix. They collaborate with our clients on a daily basis, providing strategic guidance and ensuring that we deliver value-specific solutions that yield tremendous efficiency gains and cost savings for our clients. Chris holds a B.A. from Northern Illinois University and an MBA with a Certificate in Project Management from the Keller Business Graduate School of Management. Lane holds a degree in Business Management from McNeese State University. Chris Kosin Lane Lambert