IMGCAP(1)][IMGCAP(2)]One of the hottest IT trends promoted by vendors such as Amazon, Google and Microsoft is cloud computing.
They advertise the cloud to businesses as the solution to all IT data storage needs with significant savings to the bottom line. Although IT departments are concerned with the security and reliability issues that the cloud brings, business executives are adopting the cloud without necessarily understanding the risks involved in cloud computing.
Visiting any of the cloud providers Web sites, you will see promises of reliability, security, 99 percent-plus uptime, SAS 70 Type II audits, and various certifications such as HIPAA, PCI and SOX compliant. But can you trust handing over your data and applications to the cloud?
Is SAP ERP in the Cloud Already?
In November 2010, the movie studio Lionsgate announced it was planning to move SAP into the Amazon Web Services cloud. Lionsgate’s reasoning for moving to the Amazon cloud was the cost effectiveness over building its own data centers. The plan included moving SAP enterprise resource planning modules, including accounts receivable, accounts payable, general ledger and business intelligence applications to the cloud using Freedom OSS to assist in the transition.
However, in a June 2011 interview, Lionsgate CIO Leo Collins mentioned that only the SAP sandbox and email are in the Amazon cloud. He added that Lionsgate is continuing to grow their own data centers since placing the mission-critical SAP system in the cloud is complex and difficult.
This is confirmed by the 2011 (fiscal year-end March 31, 2011) SEC 10K filings of Lionsgate. In the 10K filings, Lionsgate’s auditing firm Ernst & Young mentioned no changes in internal control over financial reporting. The lack of mention or disclosure in the 10K filings by Lionsgate management or the auditors demonstrates that Lionsgate had not put SAP in the cloud. It might be a while before we see the SAP ERP systems fully functional in the cloud. Even with the SAP sandbox in the cloud, the data should be encrypted or made anonymous when transferred.
Reliability and Security Issues in the Cloud
The cloud still has reliability issues to overcome before companies adopt it. There are three types of clouds: public, private and hybrid clouds. A public cloud refers to outsourced application software and outsourced data hosting at a service provider’s data center. A private cloud is when the application software and hosting service are purchased from the provider and maintained by the client on a private network. A hybrid cloud is a custom blend of public and private cloud characteristics defined by the client.
Amazon Web Services experienced a system glitch in its Virginia data center last April, causing servers to write multiple backups and crash. The crash took thousands of Web pages of social media and startup companies’ offline, including a federal government Web site, some for days. It also took Amazon more than a day to figure out what went wrong, and 11 hours of data was permanently lost. The crash also showed that Amazon placed backups in the same data center, or even within the same server box. By placing backups within the same server box, Amazon neglected to follow its own protocol and advertisements promoting instantaneous backups at multiple data centers.
Some cloud providers such as Salesforce.com outsource their data centers. The data would not be stored with Salesforce.com, but with a third-party data center. If permanent data loss occurred in a similar fashion as the April 2011 Amazon Web Services glitch, there would be finger-pointing in determining who would be liable: Salesforce or its data center partners.
There are also physical reliability issues. Last August, Microsoft and Amazon cloud data centers in Ireland were completely disabled when a lightning strike disabled backup generators and transformers. The data centers went offline for a day. Only a month later, in September 2011, Google Docs and Microsoft’s online version of Office went offline. A hardware memory bug caused Google Docs to go offline and Microsoft Office was disabled because of faulty Domain Name Server address configurations.
Cloud-based accounting information systems are not immune either. Intuit, a provider of online payroll and bookkeeping, caused an uproar among small businesses when they were unable to access Intuit’s cloud-based accounting information system. Small businesses were unable to process credit card payments and transactions for a whole week in May 2011. This was after Intuit promised to make changes after a similar outage occurred in June 2010.
The Future of the Cloud?
Cloud computing needs more maturity before it can be used for accounting information systems. In December 2011, a survey by CoreNet Global and Newmark Knight Frank indicated that more than 50 percent of companies are still investing in their own data centers. Their reasons were they preferred to not outsource IT and manage their own data centers because of risk management, and known data center locations. Nearly three-quarters of the surveyed companies outsource some of their data to the cloud.
But the cloud is here and the major ERP providers understand that the cloud will have an impact in defining the future accounting information system landscape. SAP bought the SaaS cloud company SuccessFactors last December for $3.4 billion. This was an attempt by SAP to catch up with competitors such as Oracle and Salesforce in the cloud computing arena. This was in response to Oracle, which bought RightNow Technologies for $1.5 billion last October 2011 in response to criticism from Salesforce.
However, it’s best to wait until the security and reliability bugs have been worked out. Companies should take a wait-and-see approach before placing mission-critical data or applications in the cloud. In the meantime, companies should continue to rely on traditional means of data storage, by putting their data behind a corporate firewall at a corporate-owned data center.
If the security and reliability issues don’t deter companies from the cloud, a private cloud should be used with a traditional backup of the data. But accounting information systems are not yet ready for the cloud.
Henry Chao has worked on programming accounting information systems for government entities and Dr. Paul Sheldon Foote is a professor at California State University, Fullerton, who focuses on information technology development in accounting.
