Reducing RMIS Costs with Application Service Providers
January 2001
Need to replace an outdated RMIS but management
can't or won't justify the capital outlay? There is a solution: Application
Service Providers (ASPs). Learn how ASPs can save hardware, network, infrastructure,
database, application, and training costs while providing a state-of-the-art
RMIS.
by Anita Schoenfeld
Tillinghast—Towers Perrin
Today's risk managers realize the value of a state-of-the-art risk management
information system (RMIS). They see the flexibility the new systems offer with
Internet-based reporting capabilities and relational databases. However, many
are saddled with an outdated RMIS because they cannot find the internal funding
for new hardware and software, or the internal technology support. Management
does not always see the value in these systems, particularly if replacing them
requires significant capital funding.
There is a solution, however, where you can get the system you want, on the
newest hardware, while only paying for "what you use." Think of it in terms
of a car lease. There is some upfront money to "seal the deal," but then you
only pay for the use of the system on an on-demand basis. You do not even have
to pay for the RMIS user licenses. Sound too good to be true? Well, let me introduce
you to the world of Application Service Providers (ASPs).
What Is an ASP?
An ASP offers access to your selected applications—and the infrastructure
and hardware to support it—on a subscription basis. Essentially, the ASP pays
for the application licenses for you. It then sets the application up at a remote
site on its own hardware, and offers access to the application via the Internet
or through a Wide Area Network (WAN) attached to your company's Local Area Network
(LAN), on a pay-as-you-use basis.
Other services an ASP can provide include the following.
- System integration with existing legacy systems or new applications
that must interface with the new RMIS and internal networks
- Maintenance and support, including disaster recovery, backup, batch
routines, and update management
- Help desk and telephonic support
- User access and application training
- Database security, firewalls, and remote access.
ASP contracts usually define the minimum standards for the hardware supporting
the application, guaranteed service levels, and response time. Fees are typically
based on an estimated monthly charge, negotiated at contract inception, and
adjusted at pre-set intervals or at the end of the contract term. The fees are
composed of several costs, such as usage (e.g., number of hours or requests
for access), license fees (including user and site licenses), services provided,
requests for help-desk assistance, database size, backup routines, upgrade frequency,
batch processing requests, data conversion frequency, etc.
What Applications Will ASPs Support?
ASPs will support whatever applications can run on a computer (both mainframe
and client server). Systems typically supported include Enterprise Resource
Planning (ERP) systems (such as SAP or PeopleSoft), RMISs, sales, production
and distribution applications, human resource applications, HMO billing and
utilization review software, college class registration and billing, and on
and on. Essentially, ASPs offer companies the opportunity to stay current with
technology and be nimble in the marketplace—in whatever line of business they
happen to be in—without significant outlay for software user licenses, hardware,
and infrastructure improvements.
How Does an ASP Save Money?
Today's RMIS is expensive. If you consider the cost in dollars and internal
staff time needed to implement a system internally (not including the time initially
spent conducting a needs assessment, identifying potential RMIS partners, and
selecting the system), the cost of the vendor or outside consultant's support
during implementation, and the site and user licenses, there is a significant
cash outlay upfront. An ASP could eliminate some or all of the initial cash
outlay for the following.
- Database, application, middleware, and interfaced applications site
and user license fees
- Some implementation fees
- Hardware, network, and infrastructure improvement costs (such as telephony
and environment)
- Some training costs
The payment arrangement with the ASP would spread these costs over the term
of the agreement. This approach reduces initial funding requirements and potentially
offers monthly charges equal to or only somewhat higher than currently experienced
monthly costs with an existing RMIS (for custom report programming, yearly license
fees, monthly data conversions, etc.).
Management does not need to fund an initial capital outlay of $250,000 to
$1 million or more. Instead, the new RMIS becomes nothing more than a monthly
cash expense, similar to one that is already incurred. Dependability is improved
too. ASPs provide 24/7 support with service level agreements guaranteeing "uptime"
in excess of 99 percent. Most companies cannot guarantee that level of service
from internal technology departments.
The real value proposition is that risk managers and their departments are
left to tend to their own business: risk identification, mitigation, and financing
rather than focusing on technology issues.
Could an ASP Support an Existing RMIS?
In an ASP-hosted environment, your RMIS and the database would be residenced
on the ASP's hardware at their location. Depending on the access approach selected,
the risk manager and all remote users would access the application at the ASP's
location via the Internet or the WAN. Data would be viewed, analyses conducted,
and reports run in the same manner as if the application was residenced within
your company's technology department. Remote users would have the same type
of access as the risk management department, subject to those types of authority
restrictions typically in place within your organization.
Monthly data conversions from third-party administrators and insurers would
be handled by the ASP, as would security and firewall protection. Batch files
are created, and the reports selected for delayed printing would be run during
the night, along with data backup, disaster recovery routines, and other system
maintenance.
Updates are also handled by the ASP. The system vendor supplies the update
to the ASP. The ASP pays for the license fees, updates the application, and
bills you monthly on the same basis as payment is being made for use of the
existing application the ASP is maintaining.
What Are the Downsides?
Well, there are always some. ASPs are a new industry. Some providers are
old established companies; others are not. The stability of these companies
is reflected in the technology stocks on NASDAQ. However, there are many well-known
companies providing ASP services as well, such as IBM and Citrix.
When a company uses one ASP for all applications, integration between mission-critical
applications (such as posting payments to accounts payable or to the general
ledger) is simple. However, if a company has multiple ASPs or only some applications
in a hosted environment, the backend integration of these applications—allowing
them to communicate—becomes very complicated.
Another issue is that internal technology departments may view surrendering
control of the application to an ASP as a vote of no confidence. In addition,
there is always some risk in losing control of the application and your data
when a third party has sole access.
The relationship between your ASP and the system vendor can also be tenuous,
resulting in finger pointing when problems occur.
How Do You Choose the Right ASP?
In this age, there's no such thing as airtight guarantees. However, there
are some questions to ask that will help you conduct and maintain some risk
control. These include the following.
- Is the ASP familiar with your industry? Because different industries have diverse needs, most ASPs try to specialize
in certain industries. The ASP should be familiar with your industry AND
with the type of application you want them to host.
- Does the ASP offer the services you need? Will the ASP run batch reports and e-mail them to you? Are they capable
of doing user training? Define your needs upfront (particularly service
levels and response time), be sure the ASP has the capabilities to respond
to your needs, and then define the expected service levels in the contract.
- Does my company represent a small or large part
of the ASP's revenue? This is always a risk with a very large or
well-established ASP. Being a small fish in a big pond can be difficult.
However, spelling out your service needs and then documenting them in a
contract can provide a solution for this potential problem.
- What skill sets and levels of experience does
the ASP's staff have with the selected RMIS and its intended hardware platform? The optimum is that the ASP is currently hosting the selected RMIS for other
clients, and you can call references. However, that may not be the case.
Certainly, the ASP needs to have experience with client server environments
and not just mainframes if the selected RMIS is a client server application.
- What types of security will the ASP provide for
your database and for remote access? Use your technology department
to visit the ASP site and confirm the appropriateness of security controls
and firewalls. If your data is confidential, be sure to have the ASP, and
the staff responsible for the application and database's maintenance, sign
confidentiality and nondisclosure agreements.
- What constitutes the ASP's disaster plans, and
what "hot-sites" do they use? The ASP's disaster plans are only as
good as its support locations. You need to know the following before you
contract:
- How often will your database be backed up?
- Are two backup tapes created? If so, are the tapes sent to different
locations?
- Are the planned hot-sites are far enough away from the ASP's location
(in case of natural disasters)
- What are the capabilities of the hot site? Will they also offer
full service to your company?
- What time frame is considered before full replacement of services
at the new site will be in place?
Conclusion
Offering management a method to obtain newer, faster technology without significant
capital outlay can be a powerful tool to eliminate the resistance that risk
managers typically experience when trying to implement a new RMIS. With some
initial investigation of the ASP companies available to support your chosen
RMIS, a new RMIS could be in your future.
Opinions expressed in Expert Commentary articles are those of the author and are
not necessarily held by the author’s employer or IRMI. This article does not purport
to provide legal, accounting, or other professional advice or opinion. If such advice
is needed, consult with your attorney, accountant, or other qualified adviser.