The suppleness of SaaS, how to audit and enhance flexibility in financial Software as a Service products
Dominique Mirandolle · Utrecht University Repository (Utrecht University) · 2012
The environment of enterprises, including customer demand, is changing at a fast pace. In order to operate efficiently, an enterprise has to be able to adjust its business processes accordingly, including any IT solution that supports these processes. This thesis deals with the concept of Software as a Service (SaaS), a software solution that can enable a company to adapt quickly to environment changes in a flexible manner. In order to assure internally or externally to customers whether a SaaS product is actually flexible, vendors can choose to be certified through an IT audit. However, no IT audit framework specifically for SaaS or cloud computing solutions has been designed up to now (apart from few slightly adapted versions of existing frameworks). This research delivers parts of a framework solely for SaaS solutions with a focus on flexibility – a term that is first of all defined in this work. The goal of this thesis is to provide a set of IT controls that can be applied in an IT audit for vendors of financial Software as a Service products for Small and Medium Enterprises. By executing this IT audit the flexibility can be assessed and enhanced by following up the IT controls. In SaaS solutions specifically it is worthwhile to study the Software Ecosystem (Jansen, 2009), since business continuity depends on a variety of different actors (such as an infrastructure provider or web service supplier). For this reason, we chose to approach the creation of the IT audit framework from a Software Ecosystem perspective. However, before we were able to use this perspective additional research in this field had to be carried out. Interviews were conducted at ten case companies, for each of which the Software Ecosystem was modeled. Based on this, a classification of actors and collaboration structures that occur in financial SaaS Ecosystems is presented. As shortly mentioned above, additional research had to be carried out on our focus area of flexibility. Therefore, literature was studied and five SaaS customers were interviewed on how they perceive flexibility. These interviews focused on identifying the attributes out of which flexibility exists and the importance of each attribute. After defining flexibility and collaboration structures in SaaS Ecosystems, it has become clear which elements in SaaS Ecosystems are responsible for which attributes of flexibility. Out of these mappings, we constructed guidelines and IT controls that match a specific IT audit framework for SaaS solutions. By making this last step the results and best practices discovered during our research are translated to a number of practically applicable IT controls for auditing and enhancing the flexibility of financial SaaS solutions.