"Should we build it, or should we buy it?"

Whether to build or buy a business solution is a classic dilemma and also one of the most challenging. In the case of an audit solution, the dilemma becomes increasingly complex because most enterprises have the resources and talent to build one. The question then becomes, "should we do it?"

To help you answer the question of "should we build it," we will explore six crucial considerations:

• Security

• Reliability

• Scalability

• Adaptability

• Cost 

• More Features at a better price

Security

In the cloud era, the discussion of whether to build a custom solution vs. buying a solution introduces a new and more significant problem: security.

Security is especially critical when your business processes include sensitive financial data. When you build solutions with third-party platforms, like Azure, you also have to worry about third-party compliance. For example, Twilio was breached recently, and our customer had to prove they were no longer using the software to their auditors. Verifying third-party vendors adds the extra burden of demonstrating that your home-grown solution is maintained well. And there's also the challenge of providing an attestation that your third-party vendors have good controls in place.

Reliability

Auditors today require independent verification of your audit software. To do that you must have a separate data source and processes around your audit software to ensure the integrity and reliability of your data and to provide evidence of internal control. 

The amount of data businesses process is increasing, which also increases the need for automated controls. Automated controls make a homegrown solution unsuitable because trust surrounding the independence of your data is vital. In other words, if your data is not accurate or complete, your findings will be incorrect, and your business will be impacted.

A SafePaaS customer that built a homegrown audit solution discovered they were missing critical information regarding superuser access. This left the customer unable to see the whole picture. They could see 93% of access to data, which for an audit is not good enough - you need 100% visibility for an audit. Using SafePaaS, we discovered the customer was missing 7% of their risk. As soon as they installed SafePaaS, they gained the completeness and accuracy their auditors required. Using an industry-standard solution like SafePaaS comes with expertise, built-in best practices, and the ability to extract 100% of your data that is tested for completeness and accuracy.

Scalability

As the volume of data begins to grow, customers realize they can't manage the quantity of their data.  Moreover, the cost of managing data in data centers is prohibitive. Data Centers can become limiting factors in your scalability. These factors have increased the adoption of cloud technology, however, homegrown solutions are not the same in the cloud. This leads to many homegrown systems being abandoned and customers having to move to a cloud vendor which means disruption to audit. 

And reliability remains a problem in the cloud because you're building it yourself. Therefore, your auditors can only rely on the completeness and accuracy of your data if they get a third-party auditor to audit your homegrown solution.

Adaptability

In the 1990s, homegrown solutions were prevalent. But in 1999, during the Y2K crisis, we learned that these solutions were not adaptable and could not meet business requirements. Y2K is the term used to refer to the pervasive computer programming shortcut expected to cause chaos as the year date dropped from "99" to "00."

What Y2K taught us about the adaptability of homegrown solutions is that they can't be easily modified and aren't agile. We also learned that skilled resources for these homegrown solutions were limited. The workforce no longer included the COBOL programmers that designed the systems because they had retired. Adaptability requires the capacity to quickly change and grow to meet business demands, something homegrown solutions lack.

Adaptability in business processes is equally as important as the adaptability of our solutions. COVID taught us many lessons on adaptability, the largest being the adaptability of our operations. During social isolation and travel bans, auditors and businesses had to adapt. A typical audit is conducted on-site, so your controls can be observed. But due to the pandemic, auditors and Business Process Owners had to adapt to the unique circumstances and find ways to verify controls off-site.

Events that completely change our operating environment are not unique and will occur in the future. Businesses need to plan for disruptions to emerge resilient. Resiliency is the ability to anticipate unknown risks with a plan that protects your business. One of your most effective defenses is having technology that allows your business to shift and change while retaining the ability to report your financial results to management and the market. 

Cost

IT projects are renowned for their difficulty and exceeding budget and timeline.

• According to Forbes, nearly 1/3 of IT projects exceed their budget

• 17% of project failures jeopardize the survival of the company

• 1/5 of projects overrun their budget by 200%, and

• According to a 2020 Consortium for Information & Software Quality report, unsuccessful software projects cost companies $260 billion, and software systems with operational failures cost $1.56 trillion

In addition to the cost of building a homegrown system, you must also consider the cost of ownership. The cost of ownership is the annual amount spent on maintaining your software, not adding functionality, or improving your system, this expenditure is only to maintain your status quo. 

Maintenance costs of homegrown or customized solutions can quickly become one of the largest expenses in your IT budget. For example, if you build a homegrown system in the Oracle e-business suite, it will be nearly impossible to upgrade to new technology. And a homegrown or customized solution will need dedicated resources to maintain or require you to outsource to an expensive vendor, which may take 30% - 40% of your IT budget, and you are bound by that cost. This leaves little for innovative projects like automating application security or improving your supply chain. These maintenance costs translate to lost strategic opportunities for your business.

Buying a SaaS solution means you'll have fewer upfront costs, and the cost of the solution will be spread out over the time you use it. Buying software has a predictable cost of ownership because license, maintenance, and support fees are set up front. 

More Features at a better price

When you buy a solution, your subscription pays for your software and its development, planning, building, and testing costs distributed to many customers. The average software license cost is under $50 per user per month, far less than the average Software Developer’s rate. However, with the licensing fees, you also receive additional features, functionality, industry knowledge, and expertise than a home-grown solution. 

If you build a solution, your functionality is not adaptable and will not meet tomorrow's requirements. And when the requirements change, you will be at a dead end. You will not have the benefit of a company that has already heard about new requirements and is already designing and building them. If you buy, there is no need to figure out problems on your own. All enhancements are covered in the cost of your subscription. Each year SafePaaS releases over 100 new enhancements. That's the work of 1,000s of development hours saved, and your business stays current versus building a legacy product that will die off.

Another benefit of using SafePaaS is our repository of use cases built on best practices. But what does that mean? When you buy SafePaaS, you purchase our foresight. Based on hundreds on engagements around the world, we know what's around the corner that you haven't seen yet. We have anticipated your concerns and created reports, risk scorecards, and workflows to guide you through the process. We have also anticipated your auditors' needs with workflows that automatically document any remediation action. All remediation actions are stored in SafePaaS, allowing you to run a report listing those details for your auditors.

For example, a common reaction we have encountered upon running the initial SoD report is the urge to remediate the violations immediately. SafePaaS has addressed that reaction by providing a scorecard report that allows you to consider your real risk, not a remediation list. We give you a risk-based approach that lets you look at the largest risks, which area(s) of the business they occur, and what risk you should remediate first. You won't get from software that you built to report results. This insight comes from the experience of working with hundreds of customers, and this is what “built on best practices” means to SafePaaS.