Cloud computing
CPA Australia Ltd (‘CPA Australia’) is one of the world’s largest accounting bodies representing more than 139,000 members of the financial, accounting and business profession in 114 countries.
For information about CPA Australia, visit our website cpaaustralia.com.au
First published CPA Australia Ltd ACN 008 392 452
Level 20, 28 Freshwater Place Southbank Vic 3006 Australia
Legal notice
Copyright CPA Australia Ltd (ABN 64 008 392 452) (“CPA Australia”), 2012. All rights reserved.
Save and except for third party content, all content in these materials is owned by or licensed to CPA Australia. All trade marks, service marks and trade names are proprietory to CPA Australia. For permission to reproduce any material, a request in writing is to be made to the Legal Business Unit, CPA Australia Ltd, Level 20, 28 Freshwater Place, Southbank, Victoria 3000.
CPA Australia has used reasonable care and skill in compiling the content of this material. However, CPA Australia and the editors make no warranty as to the accuracy or completeness of any information in these materials. No part of these materials are intended to be advice, whether legal or professional. Further, as laws change frequently, you are advised to undertake your own research or to seek professional advice to keep abreast of any reforms and developments in the law.
To the extent permitted by applicable law, CPA Australia, its employees, agents and consultants exclude all liability for any loss or damage claims and expenses including but not limited to legal costs, indirect special or consequential loss or damage (including but not limited to, negligence) arising out of the information in the materials. Where any law prohibits the exclusion of such liability, CPA Australia limits its liability to the re-supply of the information.
Business interest in cloud computing has grown significantly over the last few years, and is likely to continue to increase as businesses focus on keeping costs under control and the understanding of cloud computing, including its flexibility, improves. While cloud computing is beneficial for many businesses of all sizes, it is not without its risks.
This document introduces some of the advantages and disadvantages of cloud computing to assist businesses in deciding whether or not to move to “the cloud”. It is important to have a clear reason for switching to “the cloud” and defining what the business hopes to achieve from such a switch.
“The cloud” can be implemented to varying degrees. Cloud computing in its simplest form involves moving data storage from in-house servers to a third-party service provider with centralised servers for many clients. It can also involve moving entire operating systems and software to “the cloud” so that users can connect via an internet connection to the
application they want.
Advantages to cloud computing
There are many advantages to switching to “the cloud”. Below are some of the key advantages for business: Automatic software upgrades – software upgrades usually occur automatically in “the cloud”.
Collaboration – cloud solutions can help with collaboration, idea sharing and analysis of data, both internally and externally, from a business.
Easy access to data and software –when connected to the internet, data and software can be accessed anytime, anywhere in the world. This can assist with expansion to other premises, whether locally or internationally, and make it easier for employees to work from home (although laptops can have special issues working offline due to licensing). Future proofing your business – businesses using cloud solutions can ensure the latest version of their software is
implemented. Further, it is expected that many software developers will move more towards only releasing and supporting their product in “the “cloud”.
Higher reliability – cloud solution providers usually operate systems that are more reliable than in-house servers. Improved back-up and recovery – backing up in “the cloud” and recovering data from “the cloud” is considered
easier (but not necessarily more reliable) than it is on physical, on-site devices.
IT maintenance becomes easier – the main IT task for a business using a cloud service provider is maintaining computers, and their link to the internet, rather than maintaining and protecting servers and software. In this context, IT should become less of a distraction to a business employing cloud solutions.
Quick deployment – the entire system can be functioning within a matter of minutes should you need it to (such as in the case of emergency).
Reduced costs – many people argue that the most important benefit of cloud computing is the cost savings. Cost savings come in various forms, including:
not having to buy, upgrade and maintain servers and related hardware
reduced electricity use, as servers and the related cooling use a lot of electricity
reduced IT maintenance costs, as the cloud computing supplier becomes responsible for systems maintenance, upgrades and security
not having to make an upfront investment in software or purchase software for each computer
Scalability – businesses using cloud solutions can find it quite simple to scale up to meet peaks in demand by temporarily purchasing more server space. Business can therefore avoid going through lengthy and sometimes
expensive processes of upgrading hardware, redesigning and rebuilding systems to expand, or having under-utilised hardware and storage space.
Security – the level of security offered by a reputable cloud provider usually exceeds the level businesses, particularly smaller businesses, can provide themselves.
Disadvantages to cloud computing
It is important to understand the potential disadvantages of cloud computing before deciding whether to adopt a cloud computing solution. Below are some of the disadvantages to cloud computing:
Control – in a cloud solution, there is less control over software preferences, and businesses can no longer ask friendly IT staff to install software or make modifications to a software package to meet their needs.
Data mining – some cloud solution providers own the data put into their “cloud” and are free to mine that data (particularly providers that provide the cloud solution for free or for a nominal fee). Businesses should ensure the data put into the cloud is owned by them, and that the service provider cannot mine that data.
Data storage location – depending on where the provider locates their server/s, they may be subject to legislative requirements in that location that can impact access to information.
Functionality – some functionality may not be available, or may be very different in “the cloud”. The performance on a cloud-based solution can also be very different to in-house systems. For example, computer functionality may be unavailable in a cloud solution (tasks such as video editing and other bandwidth-intensive tasks are best kept out of the cloud).
Hacking – while security is more likely to be higher in a cloud computing environment than on in-house servers, the sheer volume and type of data that cloud solution providers store from multiple clients make them attractive targets for hackers. Engaging a cloud service provider means outsourcing the security of data to that service provider, so businesses should look for certification from reliable auditors.
Infrastructure –infrastructure must be compatible with the service provider.
Integration with other systems – integration of stand-alone applications, bespoke software or software from a third party may be difficult.
Knowledge of cloud service providers – many businesses lack knowledge about cloud service providers and hence may make mistakes in choosing the best service provider for their business.
Moving between cloud service providers – migrating between cloud service providers may be troublesome. This can make it difficult to change provider.
Password security – as access to data is gained through an internet connection, the security of log-in and password details becomes more important.
Quality of cloud service provider – as with most things, the quality of the cloud service provider can make a substantial difference in the experience.
Quality and speed of internet access – cloud solutions require continuous internet access. If internet access is down, intermittent or slow, it affects the ability to access and upload data. Higher costs may be incurred to maintain and support connectivity. In short, if users are out of mobile phone range they are out of touch with “the cloud”. Reluctance from IT staff – a business’s IT staff may not be supportive of a move to cloud solutions as they may
have valid technical concerns and/or feel threatened by such a move.
Security and privacy –with a cloud service provider, data is stored with a third party. It is important to ensure the level of security around data meets requirements (and that it is a higher level of security than that which is currently provided).
Software licensing – if in-house licences and maintenance agreements are not current businesses may incur increased costs as they migrate to current versions in “the cloud”.
Software pricing – not-for-profits can lose their discount pricing on software if they use “the cloud”.
Technical issues – in spite cloud solutions being generally well maintained, often to a higher standard than in-house systems, there will be times where the system may not work. On balance, it should still be better than running an in-house system.
Hints and tips
Businesses should consider the following hints and tips when selecting a cloud service provider:
Proceed with caution. This may mean that a move to “the cloud” will take longer than expected but the outcome may be better.
Look for a provider you have a business relationship with – don't just go for price.
Look for good governance arrangements, for example, will the provider’s client manager meet regularly with the business?
Do a full cost-benefit analysis to determine what it costs to have in-house IT. You may find that it costs more than you think.
Consider the jurisdiction the contract is signed in. For example, if you have a dispute with your cloud service provider, the dispute may only be able to be resolved through the US court system.
Be conscious of your privacy risks. Your data may be stored offshore and there may be consequences under privacy laws.
Make sure that data is backed up as part of the service. Do not assume it is part of the service. Ask about the level of security provided.
Make sure you have a Service Level Agreement (SLA) and that you read the terms carefully to understand the limitations to the service. The SLA should have clauses on response times, business continuity and disaster recovery. Do your due diligence on your preferred cloud service provider. For example, look for any certification they have, such
as Information Technology Infrastructure Library Certification, do online searches of the service provider and look at the track record and scale of the service provider.
Ask what happens to your data if you choose to leave a service provider, such as deletion of data.
Do not make your decision on your preferred service provider based on cost. A large reputable service provider may cost you more but may provide you the level of service you require and it can help mitigate some of the risks highlighted in this document.
Run trials to test whether the cloud solution meets your needs.
When starting out in “the cloud”, do not outsource important business-critical software, outsource general software such as “point of sale” software or email.
Advise your clients where and how their data is stored. It may also be necessary to amend your agreements with clients to allow you to store confidential client information in “the cloud”.
Be aware of the different types of services cloud service providers can offer. These services are generally grouped into the following categories:
Infrastructure as a Service (IaaS) – this lets you relocate your servers to the cloud computing service provider, but you remain in control of, and responsible for, your software and data.
Platform as a Service (PaaS) – this lets you relocate your servers and operating system, while you remain responsible for your data.
Software as a Service (SaaS) – this is the full cloud package, where the applications you run, your data and the server is managed and operated offsite by your cloud service provider.
Acknowledgements:
CPA Australia would like to acknowledge the following members for their contribution to this factsheet:
Micheal Axelsen FCPA Director Applied Insight Pty Ltd James Fergusson CPA
Suzanne Tripodi CPA Fiorina Jewellery
