|
ARM SOXRepository
White Paper: Sarbanes-Oxley Information Management Strategy:
How the technology of the ARM SOXRepository can solve your SOX compliance and help you grow the business.
August 2003 Version 1.0
Executive Summary
This white paper introduces the concept of a Sarbanes-Oxley repository. Alacrity Results Management® SOXRepositoryTM for managing enterprise information An enterprise repository is a preferred solution to the problem of simultaneously comply with SOX, reducing the costs of SOX compliance and gaining a new capability that can help organizations gain competitive advantage.
Alacrity Results Management® SOXRepositoryTM is a new paradigm that combines low cost information warehousing with performance reporting in a way that outperforms traditional technologies. It offers an order of magnitude cost advantage, faster and more easily changeable implementation and lower maintenance costs. It is also more capable that traditional relational databases and OLAP tools.
ARM represents a significant opportunity for low risk innovation in companies. It promises:
 The ability to comply with SOX.
 The ability to comply with evolving SOX practices at low cost on a timely basis.
 The ability to have a low cost enterprise model and reporting firmly tied to large quantities of auditable and usable operational, planning and financial data extracted from existing systems.
 The ability to map relationships in the firm both for SOX compliance and for improved planning, management, and monitoring of key business drivers and links.
 ARM offers the ability to link operational data with risk, financial and budgeting data, market and market research data with product management data and plans, sales and channel data with marketing and sales activities, costing information with volume information, project information with process and organizational structure information.
 ARM can replace existing OLAP solutions and effectively provides an information warehouse as free extra functionality.
Introduction
OK, you’ve got one of those intractable business problems.
 The Sarbanes-Oxley Act (SOX to its friends and foes) says you need to be able to represent that your numbers and controls are good.
 At the same time, your CIO has been tasked with cutting spending by 35% on IT.
 And, as CEO, you are going to get fired unless you improve the performance of the company, which means innovating. Doing new things. Fixing old things that aren’t working right. (Remember quality improvement and business re-engineering?)
Now along comes the parade:
 the consultants who tell you that you need to spend more money on internal controls;
 the accountants who want to increase your audit bill because they now have to do more work;
 the CIO who says, he can’t do more on less; and,
 in through the back door, the business unit managers all have to have technology to do their jobs.
Throughout the organization, people are spending money on technology, because it’s now so inexpensive that you can put it on your expense account. Except, those little expenditures start to add up into a big number, particularly when it turns out that they are rather important to the business.
It’s enough to make a CEO rip the hair from his or her head, put on weight and decide to reinvent the three martini lunch.
The Good News
At the risk of sounding like a country evangelist under a big tent, there is some good news. But to understand the good news, you need to believe a couple of important truths:
First, there is a dramatic difference between good technology and bad technology.
Second, whatever you decide to do is going to be wrong and you are going to change your mind, so you should act accordingly.
Third, most of the advice you are getting is obsolete. Most of the technology you are using doesn’t actually work very well. The emperor may not be totally naked, but his clothes have gaping holes.
Fourth, good people actually do make a difference. While there may be some situations where contracting out to low cost countries may make sense, people often forget that in rapidly changing business requirements the cost of developing something is often far less important that the cost of getting it right – and by getting it right, we means something that actually produces profits and increased capabilities. To be even more cynical, it’s hard specifying complicated new things. So you are better off, doing it in chunks. Doing small short projects and learning quickly.
Fifth, strategy and tactics do matter here. You can comply with SOX, and gain no competitive advantage. In fact, for most companies, what you spend on SOX will probably suck resources away from profit making projects. The real question is: “How can you can seek competitive advantage and comply with SOX?”
What will most firms do to comply with SOX?
Most firms’ compliance with SOX will be pretty standard. Some kind of risk assessment will be done (dollars or time spent). New processes, reporting systems, checks and balances will be put in. Upgrades to software, typically the ERP software or accounting systems will be made.
Everything will take longer and slow down -- just what you need in a world where your foreign competitors don’t have to bother.
The alternative approach: gaining advantage from your SOX investment
Many years ago, I listened to an experienced manufacturing consultant talking about lessons learned in good manufacturing. He made a comment that has the simplicity of brilliance. He said:
“If you come up with a solution that solves more than one problem at the same time, you can be pretty sure that it is a good idea.”
The Bauhaus, the 1920s and 1930s German design school, that brought industrial materials to home design and architecture (e.g. the first tubular steel chair) argued that “Less is more.” It was there way of saying that good design has high pay off.
The same is true in information management (i.e. information technology and the processes they support).
Knowing about your compliance with SOX does not create any competitive advantage, but having a superior understanding of your business, your suppliers, your business model, your customers, your competitors can help and there is potential opportunity to combine your response to SOX with developing the performance information you have always wanted, but which past technologies did not permit.
The flaw of most information management systems is that they are like a hangover. The real costs are the downstream costs of operating, maintaining and upgrading the system. The upfront costs are often the least important piece. So all those new systems that you put in to support Sarbanes-Oxely will leave a lingering multi-year hangover.
But even worse, most firms plain just have too many information systems. It’s hard getting rid of the old ones. So you end up with:
Transaction systems for running the day to day operations of the business e.g. ERP and business process support systems.
Sales and customer relationship management systems for managing the relationships with customers
Information warehouses for storing the information from the transaction systems and CRM systems.
Integration applications that tie together the systems that don’t naturally talk to each other.
 The web front end systems for presenting your company to the world.
Outsourced services purchased from third parties which require integration and are also need SOX reporting and analysis.
Specialized functional systems for particular narrow areas in firms e.g. risk management reporting systems in financial institutions, budgeting systems, computer aided design, computer aided engineering, building security systems, etc.
Business intelligence systems for making the inaccessible information in the information warehouse accessible and usable.
Spreadsheets and ad hoc analysis, tools and models that are maintained by individual users.
Mobile systems running on cell phones, PDA, notebook and off site computers.
So the bottom line of all this complexity is that the information you need is probably in multiple places in your organization. And it’s very expensive to clean it, maintain it and make it useful, let alone audit it.
So what would an ideal solution look like to this problem?
The old adage in strategy is:
“If you don’t know where you are going, any road will take you there.”
The same is true with SOX. If you don’t know what a good solution would look like, how can you evaluate what you are doing. So, let’s take a look at the alternatives and the players:
The Auditors
SOX does not allow them to solve your problem any more. They may be able to sell you some training, but with the exception of Deloitte, all the audit firms have spun of their consulting arms. All they can do is tell you what you are doing wrong when they audit you. Which is too late.
The Consultants
You are going to be spending money on consultants. There’s not much debate on that. But as with any consulting, there’s good use and bad use of consulting. The good use is use the consulting firm to make sure that you are spending the minimum amount of money on compliance and getting the maximum strategic benefit out of the exercise.
The delicate conflict of interest here is that consultants make money by selling you time. Good and ethical consultant, who place your interest first, are sometimes going to have to recommend the use of technology as a substitute for their time. So making sure you choose the ethical consultant is key.
Even worse, many of the IT oriented and business process reengineering consultants aren’t very good at figuring out how information management can help you grow your business. So you should make sure there is strategic involvement in this apparently unimportant SOX consulting.
The Vendors
While vendors will sell you training and consulting, most of their revenues are going to come from selling new or upgraded software. Which may or may not be a good idea. But installing lots of new software is always time consuming and probably breaks other systems.
A radical approach: the ideas and technology behind “ad hoc”
So, here’s our take on the problem.
We’re pessimists. We think whatever you do is probably going to be wrong. So, you should try not do a lot of it. And what you DO do, ought to be changeable easily and at low cost. But it ought to be auditable and traceable.
And now we are going to introduce some hard won business lessons and also introduce a little IT engineering to explain why we believe this to be true.
Eating your cake and having it too
IT is flexible: it can be optimized for anything. The old rubric in IT is that you can optimize for three things:
1. Low cost IT
2. Flexible IT
3. Rapid development
and you can only ever do two out of three.
For most technologies, this rubric is true, but modern software design as implemented in the ARM SOXRepository actually disproves the rule. You can have all three, but you can’t with the technologies that you have in house today.
Getting things wrong (descending the learning curve)
In our experience of working with large companies, what typically seems to happen is that the first project you do costs you about twice as much as it ought to. Actually, 2X is pretty good, in really novel areas such as those tackled innovative software companies, it often seems that about 75-90% of spending is wasted.
If you ask a typical company that has spent $10M on information warehousing, how much it would cost them to do it, now that they are more expert, in our experience, they tend to feel they could do it for half.
So, hiring expertise makes a lot of sense, if experts can save you 50% of your budget and deliver on time, you are probably ahead of the game.
Iterating: or it takes three times to get it right
One of the most common blunders in management is look at a problem like SOX and think that it is a ‘one time’ problem. We can pretty much guarantee that it will take at least three generations to get it right.
Again, conventional wisdom in information management is that:
 The first generation of solutions ‘sort of’ works.
 The problems get fixed in Generation Two.
 And the complete rewrite of Generation Three is the first proper solution that allows you to see what good software will look like in the future.
Inconvenience
The larger the organization the more likely it is that what you want isn’t where you want it to be and if it is you can’t use it. Which is why about 40% of IT expenditures today tend to focus on integrating information sitting in different places.
The wrong tools
The tools your people are most familiar with and prefer to use are probably not the ones that are the best solution to your problem. And this is where we get into engineering of IT solutions.
In the olden days of computers, computers were small and not very powerful. Hard disks were slow and very expensive. A lot of effort was put into building highly efficient tools for managing data that could be optimized and processed quickly.
The most common technology that has become standard today is a relational database using the SQL languages. Oracle, IBM and Microsoft all have offerings. But relational databases, wonderful though they are don’t do a very good job of dealing with really complicated relationships between data. (If you’re technical interested, the problem is that they can’t handle a many-to-many relationship.)
So a new class of technology was invented. First developed by a company called Compete! (later purchased by ComputerAssociates), imitated by Lotus with its elegant Improv products, there are now a class of products which are referred to by the astoundingly inelegant name of OLAP or online analytical processing. These tools can be thought of as multidimensional spreadsheets which you can rotate and look at different views of your data. (Technically, this is called “pivoting”. ) You can actually rotate your 3-D workbook in Excel and look through a column or row in each of the worksheets, but few people do it.
The problem with OLAP tools is that they become big and difficult to understand very quickly. One small international firm we looked at recently has grown their budget consolidation to 10 gigabytes (imagine a 10 gigabyte spreadsheet that takes between 10 and 24 hours to calculate). The problem is that this technology does not scale sufficiently well that you can actually model the connections that SOX demands. As a general rule, OLAP systems run into exponential or runaway growth when you get to seven dimensions and businesses typically need to represent about 17 dimensions for a full representation of their complexity.
So to solve the problem, both relational databases and information warehouses end up having to do what always happens in information technology – you break up the problem into smaller problems (You’ll hear terms like information mart and OLAP cube from vendors.)
Net result. More complexity. More opportunities for errors. And a difficult to audit system. Not to mention, it’s rather complicated, expensive and time consuming trying to map different technologies together and then maintain them as changes occur.
(For the technical reader, the “impedance mismatch” problem occurs in spades here when you link object oriented front ends with a relational database tables with OLAP architectures)
More is not less. It’s the opposite of the Bauhaus adage. Here we are going in the opposite direction of my manufacturing consultant. Our solutions have been failing and getting more complicated.
What would the right tool look like?
Well, the right tool would have the following characteristics:
Timely: it would be able to handle a lot of different types of data and be able to manipulate data from multiple data sources on a close to real time basis.
Scalable: it has to be able to handle a lot of data without causing lengthy recalculations.
Manage complex connections: it has to be able to represent all the possible interesting connections in the organization if it is going to be useful in spotting anomalous, risky or impermissible behavior.
Easily and rapidly changeable: the system has to keep up with the rate of change in the organization at low cost.
Accessible: the information has to be made easily available to multiple stakeholders in the organization so that processes have high visibility.
Auditable: it’s not enough to look at data, you have to know where the data came from, whether it’s good, bad or incomplete and how it is calculated.
Secure: access rights need to be managed to prevent data from being altered.
Distributable: most organizations of any size have data in multiple locations. Being able to create a virtual repository of information is lower cost and more resilient, a rather important issue with the example of the August 2003 black out in mind.
Low total cost of ownership: it should ideally use modern archictures designed for low cost maintenance and evolution.
Good integration capabilities: simple and industry standard tools should available to get data into the systems
Leverageable: the system should take advantage of commonly used reporting and analytical tools for work based upon it, e.g. spreadsheets.
Enterprise representation: the system needs to be able to represent the entire business, its suppliers, customers, regulators, stakeholders and employees within one representation scheme.
Modeling: the system needs to be able to analyse its own data and perform normal mathematical, logical and tracking of performance and events.
Intelligent: the system should be able to spot deviations from acceptable performance, e.g. upper and lower acceptable performance measures.
Scoreboards: the system should support performance reporting, balanced scorecards, variance analysis and all the measures required for business activity monitoring (BAM).
Extensible: the system should have a modern architecture that can support commonly used programming paradigms such as XML, flat files, Excel spreadsheets, .Net, Java, etc. Perhaps even more importantly it should support the option of software agents or free standing small software programs that peek into the database and are tasked with tracking certain types of events. (Agents can work with other software agents to track more complicated patterns of events.)
Alacrity Results Management SOXRepository
Such a tool does exist, it is called Alacrity Results Management (ARM) from Cherniak Software. Developed to solve complicated process reporting and planning problems, it provides a leading edge system that has been developed over seven generations. It is an ideal SOXRepository.
ARM is a new paradigm in information technology. One that has dramatically different cost and performance advantages over older and more traditional technologies. It’s key benefits are that:
Much less expensive: ARM is about an order of magnitude less expensive to own and implement than other solution.
Industrial strength: ARM is based upon such an industrial strength underlying technology that it has not practical limits to the complexity it can represent in an organization.
Scaleable: ARM scales by being installed across multiple servers distributed throughout an organization. Each server can handle a billion objects. But it can appear as one virtual database.
No exponential growth problems: ARM offers all the capabilities of an OLAP system with the none of the size and complexity constraints.
Category leading complexity representation: ARM can handle more complexity than relational databases.
Low change costs: ARM is easier to change and requires less technical expertise to operate than other solutions, in spite of its greater power. ARM comes with a meta-language that allows automated construction of a flexible and changeable, auditable model of the business, its activities and performance.
Robust and debugged. with low maintenance costs: ARM is mature but implemented in a modern extensible object oriented paradigm and uses a leading object oriented database that has been developed over the past twenty years.
Demonstrated success in complex environments: ARM is deployed and working in large and complex reporting environments and has been used for modeling, planning and operational management.
 ARM offers IT departments an opportunity to reduce their costs by consolidating a number of different systems into one ARM repository. ARM can act as an information repository or information warehouse, an OLAP and reporting tool.
 ARM has been deployed to track processing and manufacturing information, market models, budgets and plans, projects, timelines and resources, activity based costing models, and balanced scorecards.
A technical description of ARM
Technically the ARM SOXRepository is a business intelligence tool with a “node and link” architecture that has been implemented in a federated object database using a component based object oriented technology. It runs on most common server operating systems e.g. UNIX and Windows 2000.
ARM can act as an OLAP tool, information warehouse, modeling tool, consolidation engine and integrates with Crystal Reports and Excel.
Each node is analogous to a small pre-built OLAP cube that automatically manages a collection of worksheets, automatically manages time relationships, versions, labels/charts of accounts and time series data with built in measurement of the quality of data and acceptable performance limits.
Links can represent consolidation trees, processes, relationships, dimensions or any connection that needs to be modeled to monitor or model the organization.
ARM SOXRepository
ARM offers companies the opportunity of setting up a SOXRepository where key information about your enterprise is represented and reported on.
ARM can be set up quickly, modified easily and will grow over time without running into constraints. ARM allows you to tackle your SOX problems using Pareto’s Law – focus on the 20% of information that accounts for 80% of your exposure and then over time increase the fine grain of your SOX monitoring.
ARM is a flexible and forgiving solution with high capability and low cost.
Contact Information
Alistair Davidson
Eclicktick
29 Clinton Street, Suite 305
Redwood City, CA 94062
Phone: +1-650-298-9077
Web log: alistairdavidson.blogspot.com
Howard Weinstein
VP Marketing
Cherniak Software
10 Commerce Valley Dr. East, Suite 400, Thornhill, ON L3T 7N7
Canada
Phone: +1-905- 771-7011 x110 Fax: +1-905-771-6288
E-mail: howard@CherniakSoftware.com Web-site: www.cherniaksoftware.com/ARM
Copyright 2003, Alistair Davidson, all rights reserved. Trademarks: Alacrity and horse logo is a registered trademark of Alacrity Inc. under license to Cherniak Software, Alacrity Results Management and SOXRepository are a trademark of Alacrity Inc. and Eclicktick Corporation respectively under license to Cherniak Software.
|