In the last decade, the arrival and development of the ‘cloud’ has had a profound impact across financial services, both in Australia and globally. I’m not talking about the cloud the old man is yelling at but referring to the term ‘cloud computing’.

The concept of cloud computing dates to the 1960s. The phrase originates from the cloud symbol used in flow charts and diagrams to symbolise the Internet. Today, the ‘cloud’ is a term that gets thrown around a lot, but what is it and how does it impact what you do? This blog outlines what it is and provides insight for trustees and service providers.

Cloud Computing

In its simplest definition, the cloud or cloud computing involves storing and accessing data and programs over the Internet instead of a local computer hard drive. Data is synced with other information over the Internet. With an online connection, cloud computing can be done anywhere, at anytime.

There are usually three models of cloud services:

1. Software as a Service (SaaS)

2. Platform as a Service (PaaS)

3. Infrastructure as a Service (IaaS)

SaaS: Software as a Service

SaaS represents the most commonly utilised option for businesses in the cloud market. SaaS uses the Internet to deliver applications, which are managed by a third-party vendor to its users. Many SaaS applications run directly through a web browser, which means they do not require downloads or installations on the client side.

Commonly used SaaS products include Salesforce, Sonata, Netwealth and Recreo.

PaaS: Platform as a Service

PaaS allows businesses to design and create applications that are built into the PaaS with special software components. These applications, sometimes called ‘middleware’, are scalable and highly available as they take on certain cloud characteristics. PaaS delivers a framework for developers that they can build upon and use to create customised applications.

Commonly used PaaS products include Force.com, GROW, FNZ and IRESS.

IaaS: Infrastructure as a Service

IaaS delivers cloud computing infrastructure, including servers, network, operating systems, and storage, through virtualisation technology. IaaS provides the same technologies and capabilities as a traditional data centre without having to physically maintain or manage all of it. IaaS clients can still access their servers and storage directly, but it is all outsourced through a “virtual data centre” in the cloud.

Commonly used IaaS products include Amazon Web Services (AWS) and Microsoft Azure.

Advantages and Disadvantages of SaaS, PaaS and IaaS

Key Considerations

As all SaaS, PaaS and IaaS offer management from a central location (hosted on a remote server) and everything is accessible over the Internet, it is important to determine the total cost of ownership and conduct a cost-benefit analysis. One key consideration is the cost impact to IT and the business. Cloud can be considered a form of outsourcing and the organisation does not need to worry about staff and skill sets required to maintain a system. This may reduce OPEX in areas such as human resources and information technology.  

Conversely, any outsourcing of core business processes requires a very strong vendor management capability and associated human resource skillset to determine and manage key SLA's and vendor delivery. The outsourcing then requires a critical review of business continuity and disaster recovery planning, including management of vendor risk, “What happens if they cease to exist tomorrow?"

A review of Infrastructure OPEX is required to ensure that data links to the cloud are sufficient. Especially where only some components are retained internally and need to communicate efficiently to cloud components

In terms of data security, there are options of public or private clouds. Depending on the security levels required by the organisation, data might be in public or private clouds and needs to be considered.

We see that the industry is moving to the cloud mainly on front-end applications and some bespoke processing on the backend. On the front end, this includes things such as portal design, reporting and analytics. For example, Office 365 offers Dynamics 365 which is a cloud-based business applications platform that combines components of customer relationship management (CRM) and enterprise resource planning (ERP), along with productivity applications and artificial intelligence tools. This allows organisations to provide services for development, testing, and deployment of applications and is accessible to numerous users via the same development application. 

On the back end, this can be virtualisation technology, so resources can easily be scaled up or down as your business changes, services are highly scalable, dynamic and flexible (things that get the techies excited).

Another consideration is the ownership, who owns which part of it? Should the cost of the cloud migration be shared? Is there a need for an organisation to retain complete control of any aspect of the systems?

Also linking data across other investment platforms that are already on the cloud, how can that be done? This all needs to be considered when migrating to the cloud.

The New Operating Model

Back in September 2018, Australian Prudential Regulation Authority (APRA) released an updated information paper on cloud computing (the original paper ‘Outsourcing involving shared computing services (including cloud)’ was first published in July 2015). The update reflected APRA’s observation of the growing use of cloud computing services by trustees and service providers.

Recently, we have seen some trustees and service providers migrate the core systems of its business onto the cloud, heralding a broader push to more efficient and agile operations. APRA has an open stance on this but do have complex regulation and requirements that trustees and service providers need to follow.

The big change in administration services that is coming to our industry is that software developers offering registry systems to trustees, hosted on the developer’s infrastructure or to an outsourced hosting service.

The benefits on offer:

• Open, real-time access to data and technology.

• Trustees does not have to maintain versions of any of the technology.

• Trustees can increase and decrease their computing power and capacity when needed.

• Repeatable administration processes remain the responsibility of the administrator (not the trustees).

Trustees and service providers looking to move to the cloud need to ensure that the APRA standards and guidelines are reviewed, the main ones we see are:

• Outsourcing and offshoring (SPS231 and SPG231)

• Managing data risk (CPG235)

• Business continuity management (SPS232 and SPG232)

• Security risk in IT (CPG234)

In selecting your cloud supplier, it is important to translate APRA’s standards and guidelines into your technology governance and risk framework while ensuring it is included in the request for proposal (RFP) documents when going to market to select your cloud supplier. Nevertheless, working with APRA for their approval is also very important.

We will continue to see the future of the new operating model evolve around cloud services. The availability of virtually limitless computer processing, network and data storage will allow organisations to offer financial services without the need to purchase and maintain costly infrastructure and support staff. It is all about how to use automation, security and cloud-native services to enhance service offerings and process improvements.

Conclusion

There has been continuous evolution of cloud computing service offerings with regulators such as APRA becoming more comfortable with cloud use as organisations have become more mature in the way they look at adopting it, but it isn’t without risk. It is of utter importance that the necessary risk management and diligence be conducted when selecting your cloud supplier.

As with all system migrations, the new registry system needs to be configured according to the rules of the products, reports and interfaces need to be developed, data needs to be migrated and other applications integrated.

Kin Fok – Lead Consultant

If your organisation needs assistance with cloud computing and the new operating model, QMV can help.

Please reach out to QMV for further information on p +61 3 9620 0707 or submit an online form.  

ABOUT QMV

QMV provides trusted advisory, consulting, technology and legal services to Australia’s leading superannuation, insurance, banking and wealth management organisations.

Like what you see? Please subscribe to receive original QMV content! 

You may also benefit from our free monthly pensions and superannuation regulatory updates.