Is It Time to Move Your Workstation
to the Cloud?

By Graham Warner Director and Global Head of Client Access Products, Trade and Financial Supply Chain, and Region Head of Client Access Americas [email protected]

For most large multinational corporations, the question about treasury workstations today generally is not whether they should use one — since most already do — but rather if they should use one that operates "in the cloud."

Over the past decade, and particularly since the global financial crisis, growing numbers of treasury managers have migrated from spreadsheets for establishing their daily cash position to more sophisticated treasury workstations. These systems are viewed as critical tools in helping them move toward bank-agnostic systems and formats and centralized operations.

Traditionally, companies have purchased treasury workstation software and installed it on their own office servers. Now, however, most major workstation providers offer or are developing cloud-based workstations — hosted services where the software and data reside on the vendor's server.

The decision about whether to stay with a traditional software-on-site solution or rent a treasury workstation in the cloud should be driven by a well-informed business case, including a thorough evaluation of benefits and risks.

Potential Cloud Benefits

There are several models for cloud-based workstations, but the most popular is "software as a service" (SaaS). A corporation acquires a traditional workstation by purchasing a software license and using the firm's own information technology (IT) resources to maintain and upgrade the software. In contrast, with the SaaS model, a corporation rents the software from the vendor, which manages and upgrades the system behind the scenes. A cloud-based workstation enables you to perform all the traditional functions of a workstation but access them remotely via a web browser.

Treasury managers have turned to cloud-based workstations seeking several benefits, including:

• Reduced IT capital and operating costs. Many companies spend up to 75% of their IT budgets on maintaining systems and infrastructure. Indeed, setting up and implementing a traditional treasury management system often takes between 6 and 18 months, requiring a major investment in IT resources. The duration of a cloud-based implementation is generally much shorter, and companies don't have to invest in hardware and associated infrastructure.
   
• Increased IT flexibility and agility. The nature of technology is that there is always something new and better coming along. With a cloud-based system, it's a relatively simple matter to add a new service or expand your entitlements within the system. To take advantage of technology advances, you no longer must add hardware or software to your own environment.
   
• Better management of legacy applications. Merger and acquisition activity can leave a corporation with a host of legacy systems. Moving to the cloud can make it easier to sunset some of that costly legacy infrastructure.

Understand the Risks

In addition to the potential benefits of cloud-based workstations, there are risks that must be factored into your IT investment decision.

A primary risk is data security. When you operate in the cloud, your data resides beyond your company's firewalls and you must trust that your vendor has strong controls and security in place. There's a related reputational risk in the event of a data breach.

Another concern is the risk of "vendor lock-in." Your workstation in the cloud will become the backbone of your treasury operation. But what if one day you want to end your relationship with your workstation vendor? That could be challenging. So you want to select the right vendor to ensure the marriage lasts.

Continuity risk is another issue. With a cloud-based workstation, you must rely on your vendor's contingency plans to avoid service disruptions, in the event of a power outage or other disaster situation.

Regulations also pose a risk. For instance, some countries don't allow corporations to house their data outside of the country, making a cloud-based workstation unfeasible. The current country-by-country regulatory approach to cloud computing can undercut the full potential of a cloud computing solution.

Risk Mitigation Strategies

You can mitigate the risks associated with cloud-based workstations. Much of that effort involves due diligence prior to vendor selection. For example, part of evaluating a vendor's privacy and security controls is confirming it has SSAE 16 certification. The Statement on Standards for Attestation Engagements 16 recently replaced the Statement on Auditing Standards (SAS) 70 as the standard for reporting on controls at service organizations.

It's also important to choose the most appropriate type of cloud. You generally want to avoid a "public cloud." With this model, customers have no visibility or control over where the infrastructure is located. All customers on public clouds share the same infrastructure pool, which may pose security risk. A better choice is likely a "private cloud," where host services are provided to a limited number of parties and access is firewall-secured; a "hybrid cloud" that incorporates both a private cloud for sensitive data and a public cloud for more widely disseminated services; or a "community cloud," a private cloud shared by a number of different organizations with common needs.

Another way to mitigate the risk of a cloud-based treasury workstation is implementing it in phases. Rather than making a transition to the cloud all at once, start by piloting the least risky module before migrating to other modules.

Establish the Business Case

Treasury management systems that operate in the cloud can offer major advantages and efficiencies. The question that treasury managers need to answer is: Do these efficiencies outweigh the risks?

Additionally, keep in mind that this is relatively new technology. You need to decide if you are comfortable being an early adopter. Ultimately, the decision to migrate to a cloud-based system should be driven by your company's specific needs and how well you believe you can manage the associated risks.