In response to the crowd of Jeremiahs warning against cloud computing, some parties are urging optimism. Cloud-computing specialist Glenn Elliott challenges APRA’s assumption about the riskiness of the cloud. Elliott, who is managing director of Myriad Minds, says APRA’s letter is “vague, fearinducing and just not very helpful”. “APRA emphasises the need for proper risk and governance processes for cloud-computing initiatives, but why specifically for cloud? “The implicit assumption is that cloud computing is inherently riskier than traditional onpremise solutions. I challenge that assumption.” Another bullish voice comes from Graham Sammells, CEO of The IQ Business Group. Like it or loathe it, Sammells says, the cloud is here to stay. “The impact of Cooper is a drive to efficiency which will lead to an increase in the momentum of cloud-based solutions,” he says. “For example,” he says, “Microsoft is investing 70 per cent of its research budget in the cloud.” APRA’s Sim says that, although the use of cloud computing is not yet widespread in the financial services industry, several trustees and superannuation fund administrators are considering, or already using, selected cloud computing based services. Examples of such services include mail (and instant messaging), scheduling (calendar), collaboration (including workflow) applications and CRM solutions.

Innocuous use APRA’s Sim delivers a blunt warning about such seemingly harmless uses. “While these applications may seem innocuous, the reality is that they may form an integral part of core business processes, including both approval and decision-making, and can be material and critical to ongoing operations of the trustee and the superannuation fund”. Sim goes on to note that “regulated institutions do not always recognise the significance of cloud computing initiatives and fail to acknowledge the outsourcing and/or offshoring elements in them. As a consequence, the initiatives are not being subjected to the usual rigour of existing outsourcing and risk management frameworks, and the board and senior management are not fully informed and engaged”. The prudential authority then goes on to ask trustees to consult with APRA “before entering into any offshoring agreement, either directly or via a service provider, involving a material business activity”. APRA defines ‘material’ as circumstances where arrangements have the potential, if disrupted, to have a significant impact on the trustee and superannuation fund’s operations or its ability to manage risks effectively. Sim says “assessments of cloud computing proposals typically lack sufficient consideration of these factors”, and as part of its regular onsite review processes, it will continue to examine outsourcing or offshoring arrangements of trustees and superannuation funds.