Industry news

PayPal has announced plans to extend the number of its employees in Asia Pacific to over 2,000 by the end of the year, with the creation of more than 100 new jobs at the company’s headquarters in Singapore.

The new vacancies will be across all seven of PayPal’s offices including, Australia, China, Hong Kong, India, Japan, Singapore and Taiwan.

The plans for growth can be seen as a direct result of the company’s 38 per cent growth since 2008, processing more than $6 billion of total payment volume within the Asia Pacific region in 2009.

Both PayPal and Singapore are excited about the company continuing and expanding its presence in Asia;

“We are excited that PayPal has chosen Singapore as the center from which to double its business in Asia. This is another example of how Singapore plans to stay at the forefront of technology and innovation,” said Mr. Leo Yip, chairman of the Singapore Economic Development Board (EDB) said.

An architectural group is waving the flag for outsourcing after announcing it has cut costs by 60 per cent since outsourcing its accountancy.

Red Box Design Group, based in Newcastle and Darlington moved its monthly accounting practice from an in-house financial director to an external chartered accountancy firm, it was reported in nebusiness.co.uk

It also managed to cut 50% of annual auditing costs thanks to the changeover.

Alan Smith OBE, managing director of Red Box Design Group told nebusiness.co.uk: “Cost control is more important than ever in this climate so to achieve 60 per cent savings on accountancy, such as cashflow, profit and loss and the balance sheet reporting, and another 50 per cent on the auditing, is pretty good going.”

Malaysia Airlines seals outsourcing deal with TATA Consultancy Services

Under the five-year agreement, Indian consultancy TATA will provide the Malaysian Airline with IT services.

In a statement, the company announced the partnership was part of its wider strategic IT outsourcing programme designed to transform the airline’s IT operations, in hope of delivering seamless internal customer experience.

“One of the key initiatives is fine-tuning our IT outsourcing strategy to deliver the required business results at lower cost,” said the airline’s chief information officer, Faridah Abdul Rahman.

Danish IT company, KMD, has signed a new four year offshore contract with Mahindra Satyam in a deal worth approximately $48 million.

The new agreement is an extension of a previous contract that was due to expire this year which involved the supply of application development, testing and application support services particularly in the area of SAP which is a growing business for the Danish IT company. Offshore work will be conducted in a development centre in Bangalore, India.

Lars Monrad-Gylling, CEO of KMD said: “We have chosen SAP as a strategic technological platform for our development work and consider it a common cornerstone to enable coherence between systems, global market standards and to offer our customers greater openness and freedom of choice.”

Virgin Atlantic, the transatlantic airline, has confirmed plans to open a new call centre this autumn creating more than 200 jobs.

The new centre will be based in Swansea, Wales, and will run in conjunction with the airline’s existing site in Crawley, West Sussex.

Julie Southern, Virgin Atlantic chief commercial and financial officer said: ‘Virgin Atlantic is pleased to be opening a new customer service centre based in Swansea, particularly at a time when few companies are announcing an expansion in job opportunities in the UK.

‘We know that Swansea has many experienced customer service staff and we look forward to being able to use their valuable experience to support Virgin Atlantic’s customers.’

The airline will start recruiting for the 200 later this month and hopes to fill them all over the next two years.

HM Revenue & Customs (HMRC), the UK’s tax authority, has signed an outsourcing agreement with Accenture to strengthen its in-house IT capability. The consultancy will develop a new IT strategy for the authority in an attempt to reduce costs.

Under the £10m agreement, Accenture will also make services available to other organisations involved in enforcing tax and customs laws, such as, the Revenue and Customs Prosecution Office, the Serious Organised Crime Agency, the UK Border Agency and the Home Office.

This deal marks an important step for HMRC in light of new powers granted to the Information Commissioner's Office allowing it to fine departments and companies in breach of data protection laws.

CIOs predict spending on staff in their datacentres will eclipse overall growth in IT expenditure this year, according to analysts IDC.

Despite the recession, large European organisations still expect staff spending to increase by ten per cent over the next year.

A core reason for the staff expenditure is that 25 per cent of organisations are still managing their servers and storage manually.

Giorgio Nebuloni, Research Analyst in IDC's Systems and Infrastructure group said: "CIOs are grappling with the consequences of virtualisation. While the benefits are clear, the impact on management is proving to be a challenge, new models for management will be needed to ensure that virtualisation continues to contribute positively to the datacentre."

Telco customer service levels are by far the worst in the UK, with just 30 per cent of consumers happy with the way complaints are resolved, research has indicated.

The survey undertaken by the Daily Mail’s Money Mail also found that 42 per cent of those questioned were unhappy with the service they received from their internet or phone providers over the last 12 months, it was reported on MyCustomer.com.

This figure compared with 46 per cent of banking customers and 49 per cent of shoppers who were satisfied with the way in which their problems were handled.

MoneyMail claimed that such issues were endemic across the industry, with small players being no better than large ones in customer service terms. As a result, it demanded "firm action by regulators" to fix the situation.

Is outsourcing the new religion? It seems there is no sector that the outsourcing industry will not touch. It was revealed this week that French nuns have been told that their holy bread may be replaced by cheaper Polish host. Apparently authorities are contemplating buying the cheaper wafers which are made by a secular workforce based in Poland.

However, the Lourdes church has since announced it would continue to buy wafers made in France – but only after negotiating a price reduction.

Not only has the Church given outsourcing its blessing this week but it seems public sector outsourcing has been given the thumbs up too. Capita boss, Paul Pindar, has joined a growing group of high-profile sourcing professionals calling for an increase in public sector outsourcing.

His comments were made following figures from the CBI last week that £130bn could be cut from public spending through increased outsourcing. It’s a no-brainer if you ask me.

Infosys Technologies also joined the pro-outsourcing band wagon this week. Not surprising but it’s interesting to hear that the Indian outsourcing provider is seeing its outsourcing deals pick up as major countries leave the economic downturn behind.

Currently, the company’s revenue distribution is 60 per cent from North America, 25 per cent from Europe and the balance from other parts of the world.

It’s not all been good news though. Research from the Daily Mail has indicated that telco customer service levels are in need of some serious improvement, with only 30 per cent of customers satisfied with the service they have received.

Looks like there is still work to be done in the sector to increase the number of happy customers.

Introduction – knowledge is power

For many years now, IT risk management has been taken extremely seriously by the ‘Big Four’ accountancy firms. These audit giants employ teams of dedicated IT risk management professionals who specialise in general systems risk management, as well as risks surrounding IT security in the specific financial systems that their audit clients run.

Auditing large enterprises employing complex ERP systems such as SAP often requires a more risk-based approach, which means understanding those risks which threaten the achievement of an organisation’s business objectives. Determining what those risks are at the application security level, and the necessary mitigating controls which should be in place, requires system-specific knowledge. Despite this dependency on specialist knowledge, gaining confidence over the integrity and security of data in a client’s core financial systems can save significant effort and cost in terms of reducing the level of substantive audit testing required. Therefore, taking a risk-based systems auditing approach is smart auditing.

Small and medium enterprises – welcome on board

As recently as 10 years ago, the suggestion that a county council would be running SAP R/3 would have been ridiculed. SAP systems were expensive to implement and support and were almost exclusively the domain of the blue chip corporation. It was rare to see a client outside of the FTSE 250 using SAP in the UK.

By the turn of the millennium SAP had saturated the blue chip market and turned their attentions to SMEs, releasing SAP Business One and steering their marketing machine in the direction of the middle market. Several years on SAP is commonplace in mid-tier companies and has become an integral part of their systems landscape. Consequently, this presents both the mid-tier accountancy firms that perform their external audits, as well as the internal audit departments of these SAP organisations, with a unique set of challenges.

Auditing ERP systems – it’s a tough job but someone’s got to do it

Auditing an ERP system is not an easy task. IT risk management teams at the ‘Big Four’ accountancy firms specialise in ERP systems security, and they invest much time and effort in developing and maintaining audit work programmes for each variety of these systems. Keeping this knowledge base up to date and in touch with the fast pace of change in ERP technology is an expensive business. ERP systems such as SAP incorporate complex security configuration and whilst basic in-built audit tools are provided there is no substitute for a solid understanding of the underlying authorisation (security) concept.

Whilst both mid-tier external auditors and organisations' internal audit departments encounter SAP more and more frequently nowadays, it is difficult to maintain and retain an internal team with the necessary expertise to audit an SAP system with the thoroughness and know-how required to really drive out meaningful audit points. Often general systems auditors will attempt to audit an SAP system but will overlook all but the most obvious security flaws. This means there is a real danger that significant risk exposures will go undetected due to this deficiency in system-specific knowledge.

Outsourcing solutions – closing the knowledge gap

An emerging alternative for external and internal audit departments is to outsource IT systems audit to a third party specialist.

For the medium sized / smaller audit firm the advantages of outsourcing IT systems audit are often quite compelling:

- Systems specialists will perform an IT systems audit rather than 'IT generalists'.

- You will gain access to proven methodologies, maintained and updated by the provider.

- Tools will be licensed and maintained by the provider, reducing licensing, training and support costs.

- The risk of missing significant audit points due to limited system-specific knowledge is reduced.

- There may be an opportunity for cross-selling follow-on work, revenue from which can be shared with the provider.

- Staffing costs are reduced, as there is no need to keep expensive in-house specialist skills.

However, there are also a number of things to be considered before choosing the outsourcing route.

1. Understand organisational competencies…

Auditing an SAP system requires specialist technical knowledge. Without a good understanding of the underlying authorisation concept it is very easy to overlook security loopholes or segregation of duties conflicts. Missing audit points like this could expose the firm.

2. Work with a trusted provider…

An audit relationship is one of trust. Clients expect many things from their auditor but the most important of these is integrity. Consequently, any outsourcing of IT systems audit must be based on a similar level of trust with the provider.

It is important to think carefully about the available options and select the provider carefully. Find a suitable partner and work hard at building the relationship to ensure the trust with clients is not broken. Consider trialling the outsourcing provider chosen with a small project where the relationship can be developed without risking an important and established client. This will provide the opportunity to outline rules of engagement and build trust in a low-risk environment.

3. Establish the rules of engagement…

Establishing the rules of engagement with the provider is essential in any outsourcing arrangement, but it is particularly important when it comes to outsourcing systems auditing. To succeed, it must be agreed in advance with the provider how they will represent themselves and the company for whom they are performing the audit with the end client.

- Whose business cards will they use?

- Will they provide their own hardware or use the firm’s laptops?

- Will they require access to the networks?

- If a SoD review is to be undertaken will they provide software and licenses for this or will the organisation license software for them to use?

- Who will be the initial point of contact for the client during the engagement – the outsourced auditor, or the audit firm?

- Should the provider follow the organisation's sample testing guidelines or utilise its own?

4. Agree a position for follow-on work…

An IT systems audit will more than likely identify points for remediation. Often clients will request assistance with this. This can lead to lucrative follow-on work for SAP Security implementation specialists. It is important to establish the ground rules for follow-on work prior to engagement.

- Should the outsourcing provider be allowed to accept follow–on work from the client?

- Will an additional consultancy role compromise the provider’s position of acting internal/external auditor depending upon the nature of work and individual resources proposed?

- Should any follow-on work be channelled through the firm or should the provider deal with the client directly?

Conclusion

In conclusion, there are many challenges presented to the internal/external audit department considering outsourcing IT systems audit. However, if managed well, outsourcing of IT systems audit presents an opportunity to deliver a considerably improved client service at a significantly reduced cost.