The Changing Landscape of Information Access

Helping Businesses Make Wise Choices

Every business using technology should recognize that the rules regarding information security are changing.

Conceptually, cloud computing creates new challenges for information security professionals, because sensitive information may no longer reside on dedicated hardware. Where physical security was once a primary element of data access, virtualized services and remote accessibility have redirected the discussion to more ethereal areas.

How can enterprises protect their most sensitive data in the rapidly-evolving world of shared computing resources? Vulnerabilities have been found in the cloud and software-as-a-service models, raising the question of cloud computing's impact on security and the steps that will be required to protect data in cloud environments. Particularly when it comes to integration of services and data sharing amongst cloud solution providers, who, exactly, is in control?

While the concepts of centralized processing, shared computing resources, and subscription-based services are not at all new, many of the technologies being applied today are new. When we consider the fact that new vulnerabilities are still being discovered in older software and systems, why would we assume that new cloud computing tools and services would be immune?

Cloud computing and software-as-a-service technology models often shelter the user from the realities of the systems (hardware, software, networking, etc.) that comprise the service. Before investing your business in a fully cloud-based solution, make certain that you fully understand your risks and how they might be mitigated.

As Sun Tzu wrote in the Art of War,  " If you know the enemy and know yourself, you need not fear the result of a hundred battles. If you know yourself but not the enemy, for every victory gained you will also suffer a defeat. If you know neither the enemy nor yourself, you will succumb in every battle."

Make Sense?

J

Implementing Intuit Statement Writer on a Secure Network

The Intuit Statement Writer is a custom reporting and financial statement tool for use with QuickBooks Premier Accountant and Microsoft Excel. The solution has a few peculiarities that must be addressed in order to make it function properly (or at all!) in a networked or hosted environment.

The issues center primarily around the fact that the application was designed for use on a standalone PC, and doesn’t take into consideration the potential for redirected or restricted data folders. Further, the method of integration with Microsoft Excel requires specific support from the Excel application, so care must be taken in selecting the version of Excel (or Microsoft Office) to be used.

In computing environments where the QuickBooks and Office applications are installed directly on each PC, and where data is stored locally on the PC, most of these issues become irrelevant. When the applications are utilized within a strictly controlled domain, however, a variety of issues may arise. If the applications are to be utilized in a terminal server environment, then many issues will certainly come into play.

The Intuit Statement Writer solution requires QuickBooks Premier Accountant v2010, and Microsoft Office 2003 or greater. The version of Office or Excel used must be at least version 2003, and it must be either the full standalone version of Excel, or Excel as part of MS Office Standard, Professional, or Enterprise. Excel as part of MS Office Small Business, Basic, or Student/Teacher editions is not compatible. All editions of Excel 2007 are compatible.

By default, the Intuit Statement Writer (ISW) stores its files on the local PC where the application is installed. The application utilizes the local “My Documents” folder as the location for ISW files. In an environment where the My Documents folder is redirected to a network folder or share, the program fails to install or run properly. The specific error messages encountered may vary, but are essentially indicating the same issue: you are attempting to use an unsupported file folder location.

Intuit Statement Writer (ISW) requires full trusts and permissions to the My Documents folder, which is automatically granted when the folder is local to the PC. When My Documents folder is pointed to a shared network drive, the trusts and permissions are no longer granted and the error message will appear. According to Intuit, “Intuit Statement Writer files and appearance files (.gsm and .gss) can be stored on a server or network drive, but it is not possible to open and work with the files while they are located on the server without modifying security policies on the machine. Because we don't recommend this, the files must be local when working with them." It is necessary to copy the ISW file you wish to work with to your local drive, and, when finished working with the file, copy it back to the server.

In addition to having difficulties using server or network drives, ISW also will not function as a multi-user application, due to the architecture and reliance upon the MyDocuments folder. While ISW may be used without issue while QuickBooks is in multi-user mode, only one user at any time is able to work with the Intuit Statement Writer files.

Relating to the policy and permissions issue, there is a Microsoft Support article which describes a potential resolution (http://msdn.microsoft.com/en-us/library/9w6bd8f1.aspx How to: Grant Permissions to Documents and Workbooks in Shared Locations (2003 System)) This article addresses this issue and provides information on modifying security policies around the Office Document Membership Condition on the computer(s) where ISW will run.

Two methods are provided: using Visual Studio command line tools, or using the Microsoft .NET Framework configuration tool.

In an effort to simplify making these changes on your systems, Intuit has provided a batch file which can be run on the system where ISW is installed, and where the My Documents folder is redirected for the user.

Obtain the batch file here: https://www.quickbase.com/db/bewwfafti?a=GenNewRecord

This batch file (actually 2 batch files) grant full trust to the ISW dll files, checks to see if and where the My Documents folder is redirected, and attempts to grant full trust to the specific network location of the My Documents folder through the Microsoft .NET Framework 2.0 assemblies. Care must be taken any time .NET security policies or configurations are adjusted, especially when working within a secure domain. The .NET Framework Configuration tool (Mscorcfg.msc) enables users and administrators to modify security policies for the machine policy level, the user policy level, and the enterprise policy level.

From Microsoft: "Prior to the .NET Framework, most Windows applications had free access to all of the local computer resources, including the registry, file system, event logs, environment variables or available printers. Due to the limitations of role-based security, administrators were conditioned to accept that nothing was off limits to a running application as long as the user (or the user context under which the application is running) was authorized to use the resource.With the proliferation of distributed component-centric systems, it's not uncommon for applications to download and execute components from Internet/intranet sites or network shares. The possible negative consequences of such applications are obvious. Malicious code, whether by design or not, could be loaded from an external entity and wreak havoc on a local computer or the network on which it resides. There is also the threat of security breaches that could jeopardize the privacy of sensitive data."

Because the Intuit Statement Writer utilizes features of Microsoft Excel, it relies heavily on the behavior of the Office applications and document permissions on the computer and network. These permissions are often controlled by establishing security profiles or policies via the .NET framework. If the location of a Microsoft Office 2003 document is not secure (for example, a SharePoint site or file share that users—possibly including malicious users—can write to), or if you are not sure who has permission to upload content, you can grant permissions only to documents and workbooks in the location, rather than to all content. You do this by using the Office Document Membership Condition, and modifying the security policy to check for this condition on the computers on which your solution will run.

When you use the Office Document Membership Condition, only Office documents are trusted; assemblies and executables are not granted permissions to be run from the share.This permission or trust is often assigned to a “code group”. Code groups can provide information on how the system determines the allowed permissions. The allowed permission set for the policy level is the permission set associated with the code group that has this attribute.

When all policy levels are considered, the runtime never grants the code more permissions than those associated with the Exclusive code group. Within a given policy level, code can be a member of no more than one code group that has the Exclusive attribute. This may be problematic for some administrators who wish to implement the Intuit “fix”, which creates a policy group and then establishes that group with the Exclusive attribute. Network administrators with pre-existing security policies may well find that the Intuit fix will not work as delivered, due to the fact that Exclusive policy groups may already exist to govern the permissions of Office or other documents.

Intuit KB Article: http://support.quickbooks.intuit.com/support/Pages/KnowledgeBaseArticle/1011230

1. After the zip file is downloaded, you will need to extract it to the desktop...

2. After the file as been unzipped, open up the ISWFix1 folder and double-click on the ISWFix1.bat file.

3. These steps will need to be performed for each computer or user account that needs access to ISW.

4. Terminal Services/Citrix: Ensure the ISWprefs.ini file is set to not delete itself when the user logs out.

http://msdn.microsoft.com/en-us/library/2bc0cxhc(VS.71).aspx#cpconnetframeworkadministrationtoolmscorcfgmscanchor4

Microsoft .NET Framework configuration tool

Turning to IT When Times are Tough

-->

Turning to IT When Times are Tough

When budgets get tight and the economic outlook is bleak, business owners and executives tend to turn to information technology departments and projects as a potential area for cost cutting. The reason for this is that many businesses view IT purely as a cost center, making it a prime target when driving to reduce operating costs. A recent survey by McKinsey & Company, however, indicates that the current trend is a bit different.

The new research indicates that many non-IT executives "seemed to have a developed a healthier appreciation for their information technology functions" according to Joe McKendrick in a recent ZD Net article on the subject. McKendrick mentions that business executives generally seem pleased with the way the information technology is helping organizations get through these difficult economic times, "navigating the rough seas" as he puts it.

"The survey also suggests that organizations that took the most advantage of information technology going into the recent downturn may have come out the strongest" observes McKendrick.

The McKinsey & Co Study, authored by Roger Roberts and Johnson Sikes, reported that the recent economic downturn actually increased awareness of the role information technology can play in improving business processes and reducing costs. As for the quality of services delivered? The study revealed that non-IT executives largely believe their IT functions responded effectively to the economic crisis. A majority said current performance in providing basic IT services is very or extremely effective. In contrast, IT executives had a dimmer view of their performance, with only a minority being satisfied with service delivery levels.

There have always been questions about the alignment of information technology to the business need, and IT is often perceived as being out of touch with the business. In this new research, McKinsey & Co indicate that IT executives are very aware of the issues of keeping up with the business and are finding innovative ways of addressing them.

Joanie

Salvaging Business Intelligence

"Software-as-a-Service is becoming more and more accepted as a deployment option for enterprise systems. But if the application is truly mission-critical, be sure you have an escape plan in advance" says Frank Scavo of the Enterprise Software Spectator.In his recent article "SaaS: plan to get out before you get in" Scavo discusses the issue of vendor lock-in involving the use of software-as-a-service (SaaS) for mission-critical applications. He points out that "If you thought vendor lock-in was a problem with traditional on-premise ERP software, think about the issue when it comes to SaaS. Under a perpetual license agreement for on-premise software, you always have the option of going off maintenance but continuing to run the software, and perhaps maintaining it yourself.But with SaaS, there is no such thing as going off maintenance. If you stop paying, access to your mission-critical system gets cut off."

"Therefore, I think it is important for buyers to think about what will happen if and when they decide to migrate from their SaaS provider. Specifically, there are two things I believe that buyers should ensure are in their license agreements:

First, if the SaaS provider offers an on-premise version (e.g. Oracle On-Demand), ensure that there are terms and conditions that allow you to transition to an on-premise version. This covers cases where you want to continue to use the software but are no longer satisfied with the hosting arrangement.

Second, if the SaaS providers does not offer an on-premise deployment option (e.g. Salesforce.com), be sure the provider gives you the ability to extract all master file and transactional data to an open format (e.g. XML). The ability should be repeatable--not a one-time right--so that you can develop migration programs to facilitate conversion to a new SaaS or on-premise solution. "

Small Businesses should be particularly concerned about whether or not the solution will fit the needs of the business for an extended period of time and through a variety of business conditions. The small business should also determine if there is a way to continue use of the solution (or transition from the solution) if the solution or the provider stop meeting the needs of the business. Small business owners are particularly at risk, because the SaaS solutions oriented towards small business users often don't have the on-premises options that some of their enterprise counterparts offer. And small businesses are the ones who are most likely to need to transition to another solution as the business grows. Further, the small business user often lacks the technical knowledge to manage the conversion effectively, and doesn't typically employ skilled in-house IT personnel to handle it for them. The result: consulting dollars get spent, just to retain the data the business already has.

The issue is that you are either a customer or you are not, meaning that companies can't keep their old SaaS solutions around just for historic data unless they wish to continue the subscription with the SaaS application. This is of particular concern with finance and accounting applications, as they are the core of the business intelligence, and the source for tax data, compliance, etc. Keeping the financial data for long term access is a requirement for most businesses.

Any small business - actually any business - electing to adopt SaaS-based solutions should give great care and consideration to how the business information might be protected and utilized in the event of a transition away from the online service. "In general, a lack of standards hampers the portability of data and applications between systems", says James Staten, an analyst at Forrester Research. He indicates that, while the popular hype implies that moving to the cloud doesn't require any heavy lifting, that's not true in some forms of cloud computing. "Particularly with software and platform as a service, vendors use unique and proprietary interfaces, application programming interfaces (API) and databases. Users and 3rd parties must program to those specifications in order to take advantage of the system. If they grow dissatisfied with the service, or if the vendor goes under, data and/or applications would need to be reformatted in order to switch providers or move it back in-house, which could be complex and costly."

Application hosting services may be a means to deliver the benefits of managed online application services to the business without also delivering the risks involved with SaaS application adoption. By providing access to business applications in a managed, secured environment, users gain the benefits of easy access and simplified IT management without also facing difficulties when discontinuing the service. Hosted applications offer the ability to return to an on-premises operating model, delivering the flexibility and the scalability the business needs without the concerns of loss of valuable business intelligence.

Migrating Business To The Web

Every business has similar, fundamental business problems to solve. In most cases, the business applies technology (computers and software) to facilitate the solution. The fundamentals that each and every business must address include: keeping score, accounting for their business operations; producing information, for internal and for external use; and communicating, with co-workers, team members, clients, and vendors.

Once you get beyond those fundamentals, however, every business has something unique to address in terms of how they actually operate. Supporting the operational aspects of the business - managing people, resources, information, processes, etc. - is the next step in enabling the business.

Within each business there are different kinds of processes to facilitate, creating the demand for software developers to build systems to address specific processes or to deliver specific functionality to the many and varied businesses in the world. Even within an industry domain or realm, there are likely numerous solutions available for any given business problem. For most organizations, selecting the right applications for the business often requires that those applications integrate, or work together in some manner.

But here's the issue: not everyone programmer develops software the same way or using the same tools. What ends up happening is that each software product has its own "footprint", and behaves differently. Some packages are written well and offer flexibility in how they are implemented; and some not. Disparity in application design and operating platform requirements can significantly increase the complexity of not only integrating the solutions, but managing the software and platforms to keep those integrations running. For these (and other) reasons, application integration (or data integration) is not always easily accomplished in a small business.

At an ever-increasing level, users are also now demanding remote and mobile capability from their software. The market has generally accepted the value of remote/mobile access, and businesses need to offer their workers the flexibility to work from a variety of locations (at the office, from a remote office, from home). Now the enterprise has to figure out a way to fit that square peg (the software they currently use) into a round hole (mobility!) It really starts to matter if the software products in use are all designed to run differently. Can the organization's selected applications be oriented towards remote or mobile access? Generally, the answer is "YES" (but with caveats).

The Application Service Provider model, or hosted application model, was developed to provide remote access capability to applications that traditionally don't work in that capacity. Additionally, the ASP model was designed to improve application management and administration for the subscriber, reducing or eliminating the complexities of handling multiple integrated solutions. Allowing a business to "migrate" to the web gives that business new capability and, potentially, a new working model that could easily include remote offices and mobile users. Migrating with the existing in-use applications allows the business to benefit from the new working model, but avoids the difficulties of transitioning to and learning new software.

Application hosting isn't a new concept at all, it's just gaining in popularity for several key reasons:

• Broadband is plentiful. You can get high-speed internet service now just about anywhere. That wasn't the case just a few short years ago.
• Localized IT solutions are getting more complex. Bundled solutions (like a Microsoft Small Business Server) make it easier to purchase an array of technology solutions for your business, but there's nothing in the package that makes it easier to set up and manage over time.
• Remote and mobile access is critical. More businesses operate with a home-based workforce ("home sourcing"), or with multiple business locations. The Internet has made it a global economy, and remote and mobile access is what helps a distributed enterprise work as a collective or unit.
• SaaS solutions, such as online banking, have raised awareness of the possibility of secure Internet-based computing. So, as new SaaS solutions emerge, the market is beginning to recognize the value of hosting and is building trust in the model.

Once the business has adopted the new working model and has gained trust in Internet-delivered solutions, then the business is poised to take advantage of new Web-based solutions that might become available. Breaking the adoption into two parts - managed service first, Web-based or SaaS conversion second - allows the business to move forward with a minimum of disruption to systems and processes.

Joanie Mann

Responsibility Flows Downhill (just like a few other things!)

A recent article published in Computerworld discusses a court order requiring some website hosting companies to pay heavy penalties for allowing counterfeit products to be sold via sites they hosted. The article delivers a message that technology service providers - and the customers who utilize them - should listen to very carefully.

The article mentions two website hosting companies in California that were found to be hosting sites that were selling counterfeit Louis Vuitton products. The court found that the hosting companies had essentially enabled the selling of the counterfeit goods. "In awarding the damages, the jury agreed with Paris-based Louis Vuitton Malletier S.A.'s claims that the defendants knowingly allowed several Web sites they hosted to sell products that infringed Louis Vuitton's copyrights and trademarks." The website hosting companies were not found to be directly tied to the selling of the counterfeit products; it was simply determined that they were aware of their hosting customers' activities.

The result: assessed damages totaling more than $32M.

For hosting companies, this is certainly something to watch out for. For potential hosting customers, it is important to realize how your activities might impact your service provider.As an example, let's say you are working with an ASP (application service provider) who is hosting certain business applications for your company. In order for this hosting company to deliver your solution, they must have the software installed on their systems and provide access for you. Typically, an ASP will know what applications they are legally able to provide hosting for, and (most importantly) they may require that you supply proof-of-ownership for the applications to be hosted on your behalf.

There are, however, many providers in the market that will simply deliver anything - applications you may wish to have access to, but do not have valid use licensing for. There are also providers notorious for "leveraging" licensing, meaning that there may be one or more valid licenses in the system, but they are offered for use to more customers than there are actual licenses to support. In other situations, you may only have one valid license for a business application, but use that license as a basis for the provider to deliver the solution to additional users. In all of these scenarios, the service provider is at risk for not protecting the intellectual property of the software companies whose applications are being hosted.

From the Business Software Alliance website:: "Software piracy is the unauthorized copying or distribution of copyrighted software. This can be done by copying, downloading, sharing, selling, or installing multiple copies onto personal or work computers. What a lot of people don't realize or don't think about is that when you purchase software, you are actually purchasing a license to use it, not the actual software. That license is what tells you how many times you can install the software, so it's important to read it. If you make more copies of the software than the license permits, you are pirating."

 License management is an important part of any managed application and hosting service and exists to protect customers, partners, and the provider. When it all flows downhill, you don't want to be the fellow left holding the bucket.

Make Sense?
J

The Applications Businesses Need Delivered in a Better Way

You Can Take Your Ball and Go Home if You Want To.

Many businesses were once afraid of "putting their information on the Internet". But the value of some of these Internet-based services is huge in terms of convenience, and when the user is given assurances that their information is safe, it's easy to see why use has been broadly adopted. In a society where instant gratification and self service capability are the cornerstones of most consumer offerings, some of these online solutions hit exactly on the target. They enable the consumer in ways previously unimaginable.

Regardless of how beneficial the concept of the online application or service framework may be, the realities of fitting this technology into the existing business processes and accommodating the end-user is not a simple task. These issues represent the barriers to acceptance of web-based application technologies, and have become the reasons why many companies who did adopt a web-based technology model have returned to the Windows desktop platform and "standard" desktop business applications.

What many businesses don't know is that the variety of benefits available with the desktop and LAN computing model, along with the benefits inherent in centralizing the information processing, data storage and system management (as with an online service). This unusual combination of benefits is available with a managed application hosting model.

With managed application hosting services, businesses are able to take advantage of the simplicity and availability of access to systems via the Internet, without the requirement to install and maintain a bulk of software on individual computers. Businesses are able to offer their users the applications and the functionality that they have become accustomed to (and demand), yet without the burden of ongoing system, data and security management. In some cases, software applications can even be rented with the hosting service, allowing businesses to benefit from the low cost of entry for the solution.

Best of all, the ability to transition from an Internet-based working model back to a local technology model exists with a traditional application hosting model - a capability that simply doesn't exist with most web application frameworks. With the web application service, you are either a customer or you're not. And if you're not, you have no access to the application or the business logic which can make sense of your stored data.

With an application hosting service, using standard desktop and network applications, you can always "take your ball and go home" if you choose to.

QuickBooks Pro and Premier as Software-as-a-Service

Running business applications online was once considered a fad, but has now become a mainstream approach to implementing technology. Businesses large and small are finding that turning technology investments into a predictable expense allows them to focus on their business operations and not the IT budget. For some, the ability to bring remote locations or mobile team members closer to the systems that support the business is the biggest benefit. For others, the security of having business continuity and disaster recovery built into the system is the key. Regardless of the motivating factors, business owners are finding that online application services can make a positive impact to their bottom line.

The market has clearly identified online technologies and application services as something beneficial. This is demonstrated by the rapid adoption and growth of business solutions that leverage the Internet as network. Further, online applications and services are being used as a way to augment systems that were once exclusively LAN or PC based. An example of this is the extension of Intuit's QuickBooks products to incorporate online payroll services and online payment processing solutions.

With the move to online application services being one of the biggest shifts in technology seen in years, it only makes sense that the applications that have become "standards" in business shift to an online model, as well. The opportunity is great, but the responsibility is greater.

visit CooperMann.com

Many software companies are facing a number of problems with respect to the unauthorized hosting of their desktop applications. Because of the technology employed for desktop application hosting is very costly, many service providers feel compelled to "leverage" application licensing and other system features to increase their value proposition and in order to compete. Customers who utilize these unauthorized application services are putting their businesses at potential risk. This risk may come in the form of substandard services resulting in lost or corrupted data; risk may come in the form of unauthorized access to confidential business or personal information due to poor system security; risk may come in the form of exposure due to the unauthorized use of software licenses.

While the market has clearly demonstrated the value and benefit of application hosting services, the lack of protections, consistency and support make it a venture fraught with peril for many. The volume of "grey market" activity and instances of license piracy have undoubtedly increased dramatically, as the cost of service delivery is high and the margins for the service provider are narrow. Manipulating the cost of service by leveraging the application licensing is sometimes the only way some service providers can create profitability in their offerings. But with the prior lack of oversight in terms of service pricing, licensing, quality assurance, or service orientation, it had become the "wild west" for service providers, and the perceived value of the service declined while the number of and variety of deliveries increased.

The answer to the problem, or at least as it exists around the Intuit QuickBooks products, is in the ability for Intuit-Authorized QuickBooks hosting providers to offer subscription access to QuickBooks Pro and Premier licenses when they are hosted. Customers no longer need worry about purchasing their QuickBooks software before engaging with the hosting company, and can avoid the annual cost of upgrading their application software. With the QuickBooks license delivered under a subscription program, customers are able to work with the most current version of the software, and know that their systems are protected and their data is secure. Intuit-authorized QuickBooks Hosting providers can supply, manage, and maintain hosted QuickBooks implementations for businesses of virtually any size and type - all with an Intuit-supported license.

QuickBooks And The Cloud

There has been a lot of buzz recently about Cloud Computing. I think we all understand that the "Cloud" is that little picture you always see representing the Internet, and that's what the term refers to: the computing platform isn't in your office, it's "out there", across the Internet. Just think of the Internet as a really long cable that connects your keyboard and monitor to the system that is really running the software.

When companies like Intuit talk about Cloud Computing and QuickBooks, it's a little bit confusing, given that the largest part of their QuickBooks market is based on locally-installed desktop software. And, with the volume of 3rd party developers with widgets, gadgets, plugins, extensions, and integrations with desktop QuickBooks, the momentum of the desktop solution seems unstoppable. But there has been a catch to the old model of plugging into QuickBooks, and it's catching on really well.

The creation of the IPP (Intuit Partner Platform) and changes to software integration platforms for QuickBooks has introduced an entirely new range of capabilities for QuickBooks developers. Finally, persistent connections to Web-based and other applications may be crafted for both QuickBooks desktop, allowing the locally-installed QuickBooks to "speak" over the network to other applications or platform services. This development opens up an entirely new model for extending QuickBooks functionality - extending to a Web application framework.

Businesses are now able to take broad advantage of Web-based application services and the features they can deliver without compromise to their choice of accounting and financial management system. Extending access to operational, sales, service, and other users within the enterprise has become a simple and seamless operation. For example, a business that needs to extend QuickBooks Enterprise system to accommodate multiple inventory or warehouse locations can do so easily by simply plugging in a web-based warehouse management solution like AORapid Inventory.  This solution, actually developed and delivered by AccuCode, is a SaaS (software as a service) application which not only provides functionality for multiple warehouse management, but is designed as an anytime, anywhere application to allow those multiple locations to access the system when they need to.

By creating the means for businesses to use the Web to extend their QuickBooks software, Intuit has extended the useful life of the QuickBooks product. Functionality is no longer limited to what can be built and installed on the PC - the application is now able to be extended in numerous ways and on numerous platforms. Businesses are able to take advantage of the best software fit for their organizational operations - including leveraging the anytime, anywhere benefits of a Web-based application service - and still are able to utilize their QuickBooks.

Consider how beneficial it would be to businesses who elect to take advantage of the Web for them to be able to run their QuickBooks (feature-rich desktop QuickBooks) in an anytime, anywhere sort of environment, as well. From an Intuit-Authorized Commercial Host for QuickBooks businesses can obtain hosting services for QuickBooks Pro, Premier, and Enterprise - allowing organizations to have their QuickBooks financial applications managed, protected, secured, and made available to users all the time and from any location. The hosting service can also support integrations and extensions for QuickBooks - for both desktop and Web-based applications and services. And, with the commercial provider’s ability to provide authorized subscription licensing for both QuickBooks and Microsoft Office, a business can have a complete, outsourced IT solution and pay only monthly service fees to get it. No upfront expense of purchasing software. No installation or system management to worry about. The QuickBooks financials, as well as the solutions it connects to, are connected in the cloud.

Make Sense?

J

Managing Client Relationships in a Down Economy

There is no question that the current economy is putting the squeeze on many professional practices. While most accountants aren't in danger of going bankrupt, there is heightened anxiety throughout the industry as professionals grapple with flat or falling revenues and rising costs. You, too, are probably feeling the effects of the economic downturn, as your clients also look for ways to cut costs.

During tough economic times, a familiar pattern occurs in small business. As production drops, profits drop even faster. Even a slight drop in income sets off alarm bells in the minds of many owners. To stave off a serious decline in revenues, the small business owner will often feel compelled to offer services to customers that might previously have been referred out to "specialists", or to substantially discount products or services in order to obtain business. Additionally, the business owner will certainly seek to cut business overhead.

This last point has a direct impact on the livelihood of the professional accountant, bookkeeper or business consultant. When businesses tighten their belts, they may not necessarily do it in a logical manner. They may procrastinate by stalling on purchases or putting projects on hold indefinitely. They may buy smaller quantities of supplies, even if this means ordering much more frequently. And they may cut back on their reliance on accounting or consulting professionals.

visit CooperMann.com

These types of client behaviors can be very frustrating for a professional practice. If several of your "normal" clients cut back on their service from you, your income will be affected. The real question is what can you do to help protect your business and your client relationships?

Be Genuinely Empathetic. Your clients are interested in themselves and their business, not in you. You need to get their attention, and in order to do this, you need to know their pains, pleasures, and fears. These are the emotions that make people buy, not "needs" or "wants". Pain, pleasure, and fear are strong, passionate forces that supersede any economic climate. Ask questions in a way that will extract these feelings, enabling you to be truly empathetic. Relationships are what are important, not the price, and relationships are long-term. When you help your clients build their businesses, they will help you build yours.

Be a source of positive information. You might be the only positive person the client meets with this week. When the economy weakens and business slows down, the "commiseraters" begin to work overtime, and misery loves the company. Imagine a room full of gloomy doomsayers, sitting around a conference table talking about the latest negative economic news, and feeling worse for the experience. Compare that to the consultant who throws their client a lifeline of hope and optimism. Who would you rather work with?

Be watchful for situations that represent opportunity for you. Pay special attention to the following elements that put a client account "in play".

• Change in control, such as a change in ownership of the client's business
• Change in current provider performance
• Loss of favor in a provider
• Change in decision maker
• Change in cost/value to client

These are fairly universal, but occur more frequently in a down economy. While these types of activities may mean more opportunity for your business, they also underline the importance of keeping current clients satisfied and feeling they are receiving value from you.

Help your client recognize when it's smart to spend money. Too often, software and business consultants succumb to the pressures of a tough economy and actively look for ways to help clients "get by" with what they have. This may seem like a way to conserve capital, but the result is often that the client spends more in services, repairs, and lost productivity than the initial investment would have been. Just as it made sense to buy a new economy car to save on gas bills, it often makes sense to invest in software and services in order to obtain better and more predictable results for the cost.

original publication date: Friday July 24, 2009

The working model for demanding clients is On Demand

Imagine being able to access your clients' accounting data when you need to. It wouldn't matter if it was early in the morning, in the middle of the day, or at night. And it wouldn't matter where you were - at the office, at home, or on the road. That would be pretty nice, wouldn't it?

From Wikipedia: "On-Demand refers to a service or feature which addresses the user's need for instant gratification and immediacy of use. In most cases the value proposition for an on-demand service is wrapped up in the fact that the user or consumer of the service avoids a significant up-front financial investment and instead participates in a "pay as you go" plan - a model which makes on-demand services frequently more affordable for users.

Today's technology solutions allow you to have this type of flexibility and "instant gratification", while delivering the reliability, security and performance your business and your clients' businesses demand. By using technology to improve how you, your team members, and your clients work together, you can introduce new efficiencies into your existing business model. By using technology to your strategic advantage, you can change the way you do business and build new and more value into your services.

If you haven't yet involved your practice with online and Internet-based application services, you should move now to find out how they can streamline your existing processes, or even transform your practice into a firm which is ready to offer the type of "on demand" services and solutions business owners are looking for. The market has created the demand. Will you be ready to meet it?

Online Collaboration with QuickBooks Pro

The trend for small business accounting is outsourcing - sending the work to a professional who has the time and the knowledge to properly account for the business activities. The only problem with this approach is that the business owner frequently loses touch with this key business information while it is in the hands of the accountant or bookkeeper. Anyone who has delivered the monthly work to their professional, only to receive it back some time during the following month, understands what it means to be out of touch with the business numbers.

The better way is collaboration in real-time. Through the use of Internet technologies and online applications, the professional and the business owner are able to work together on the numbers, ensuring that the data is accurate, complete, and recorded in a timely manner. With online access to QuickBooks Pro, for example, the accountant and the small business owner can work closer in "keeping score" on the business. The close working relationship afforded with the online application service allows the professional to increase efficiency and effectiveness in processing the client information. And more efficiency often means more time - time to review the information, consult with the owner, and help keep the business on target and moving towards their goal.

You are the trusted advisor

The accounting professional has always been seen as a business advisor - a trusted partner that understands the conditions that impact business performance. This advisor not only reports on the business performance, but may make recommendations or judgments on certain situations or processes that are key to the business model. Leveraging your direct participation in your clients' financial systems can be a very successful component of practice building - mining out other opportunities that may exist in current client engagements.

In some cases, your clients will want to process their own bookkeeping in-house. Rather than taking a hands- off approach to these clients, engage them by providing training or consulting services to support their in-house bookkeeping.

If your firm provides real-time guidance and reviews, the quality of the financial information is far better and requires less work to adjust and report. Ultimately, saving your client time and money will reward your practice with more opportunity to engage the client in other efforts.

Protecting Yourself Against Data Theft

by Michael Ehart, CISSP, etc.

There has been a rash of reporting of data theft lately that has a very strange effect of causing many to become complacent about their data protection measures because, after all, their system is working.

The problem is that there is no way to know if your data is bulletproof. You can only be certain when it is not, and you have evidence that your security has been breached. The vast majority of data theft is undetectable and unprosecutable, because unlike physical theft the stolen data is still there. If someone sneaks into a museum in the dead of night, dressed in spandex and night goggles and makes off with a Bottecelli, in the morning there is a big square of unfaded wall, an empty nail, a light dusting of tracked-through laser-detection talcum powder and no painting. The problem with stolen data is that most of the time there is no way to know that your system has been breached, or if it has been, that anything is missing because nothing is actually missing.

So what do you do to keep your data secure? The threats come in three flavors, and there are steps that you can take to protect yourself from each one.

1. The Barbarians at the Gates. There are people out there who don't like you. There are people out there who don't care about you, but want what you have. And there are people out there who don't care about you, or what you have, but want inside just because they can. These are the folks that firewalls were invented to thwart, and I assume that you have covered this loophole. Firewalls, encryption, strong passwords, and some sort of Intrusion Detection System (IDS) cover you there. If you don't understand or like this stuff hire someone who does. A competent IT security consultant can set up most small practices in a few hours of system hardening. Do make sure that the contract includes some basic training for your users concerning the changes and best practices.

2. The Enemy Within. Far more likely to cause you grief is the viper cherished in your bosom. No one knows for sure, but I would guess that the retail model applies here--- 90% internal theft. After all, who else holds the keys to your kingdom? Training, monitoring, set usage policies and careful terminal check-out procedures can help, but you never know. If you have 20 employees and they all seem perfectly content, either you are the shining example all other bosses should aspire to or at least 5% of your workforce is adept at hiding their dissatisfaction. I know which one seems most likely to me.

3. Stupid is as Stupid Does. And Stupid seems to be doing more than his fair share lately. Data theft is the classic crime of opportunity. "It was just laying there, so I took it." Or "The web site was unsecured" or "The safe was left open" or -one that I recently was asked about- "I left the box of records in the back seat, and someone borrowed my car." I love consulting, but dang, please make it harder for me, will ya? No more post-it notes with passwords conveniently stuck to the monitor, or so cleverly stuck under the keyboard. No more backup tapes on a shelf behind your desk, or stacked on top of the server. No more shared passwords for the entire office. Once again, if you don't know about this stuff contract someone who does. It is so very much cheaper and less stressful to spend a few bucks and a few hours hardening your system and providing a few hours of common sense training for your crew than it is to learn about your data disclosure from the guy with good hair and too many teeth holding the mike and standing sideways in your lobby so his cameraman can get a good shot.

 Visit Michael Ehart's HIPAA blog Comply With Me

Power to the People

Having the information you need when you need it is critical to making the right decisions for your business. The unofficial motto of the information age is "Information equals power", but information trapped inside your computer equals nothing. The key is to not only capture and retain data, but to turn that data into useful information and then make it available to those who need it. This can be more challenging than it sounds, especially when it comes to providing access for remote team members, co-workers or clients.

Unless your business has a competency in technology management, the wise choice may be to outsource the solution to your most challenging technical problems. With application hosting services, for example, you can use the software and systems that your business is already familiar with, and you simply access those systems in a different way. The ASP (application service provider, or host) takes care of the systems, the applications, and the network. Users are able to access their applications from any Internet-connected PC, and are assured that their programs and their data are secure, backed up, and available when they need them.

Accounting for Small Business Goes Online

The real trigger for the SMB offshore outsourcing model was the introduction of accounting and business applications which were used by small businesses, but introduced in an Internet-based or online sort of technology model. Applications such as NetSuite (was NetLedger, then Oracle Small Business), Intacct, and QuickBooks Online Edition were introduced to facilitate a closer and simpler working relationship between businesses and their team members, as well as their accountants. These web-based applications, however, offer differences in functionality and operation that many users were and still are not willing to adopt.

The creation of application hosting services for small business - namely, service which allows Intuit QuickBooks Pro to be affordably offered as an Internet-accessed application - became the magic bullet. The QuickBooks product line all but owns the small business market. Once the application was able to be utilized in an ASP technology model, the entirety of the SMB market became a potential food source for outsourced bookkeeping and business data processing companies.

Early stages of marketing the online accounting model involved professional accountants selling bookkeeping services to small business, but offering a greater level of performance and cost-efficiency than the business could experience alone. The online technology model facilitates a closer and real-time working relationship between the accountant and the client, and results in better and higher quality information for the client. By using the online application model, accounting professionals are able to increase staff levels at reduced operating costs by allowing operators to work from home or other locations. Further, the elimination or reduction of time spent traveling to client sites, manipulating client data sets, and other similar activities helps to reduce the cost of delivering bookkeeping and accounting services to the client.

The Impact in India

India was one of the first countries to visibly enter the smb outsourcing market en masse. Large numbers of business people and accounting professionals from the US paid visits to groups in India, discussing the market opportunity and potential around smb outsourcing, and to enlist processors and head count to prepare for the deluge of inbound work from US businesses. In many cases, the participants in India were required to pay heavily for the privilege of participation spending thousands (hundreds of thousands, in some cases) of dollars in training and education, building infrastructure, buying software and services only to find that the return on investment was not going to come any time soon if at all. The US accounting market was not yet ready to ship its work offshore in wholesale. And, in reality, the outsourcers weren't ready for the business anyway.

Road shows, seminars, presentations, free offers, email and fax mail and junk mail of all flavors - all have been employed to attempt to convey the value of offshore outsourcing to the business market and to accounting professionals. This marketing was, in many cases, the use of funds from the investments made by the offshore entities. Those promoting the opportunity in India were garnering funds from participants there (while promising that work would be coming in immediately), and then returning to the US only to spend the money on trying to get the business that was already promised. Needless to say, this did tremendous harm to many of the offshore start-ups, and ran some of them out of business before they ever had an opportunity to perform. Certainly, some of these businesses were simply ill-prepared and were not ready for operation, but there were many which were, and some of these positioned themselves with partners that took advantage without delivering anything of value in return.

There were other models employed, as well. Postings on open job boards, offering e-Accounting work for a fee, and with a promise of huge returns, are prevalent. The representation is that, if the offshore processor would pay into the model, then the work would be forthcoming. Many paid into the model; few received any real revenue-earning work.

Value Delivered

Many of today's outsource organizations have learned that they must provide the expertise and tools to the practice, assisting with process and workflow development, and creating assurances that the work will be handled in a timely and efficient manner. While the model is still being fully-explored, the experiences of the past few years have given these companies significant insight into the issues and potential solutions to the problems faced.

As with any new business model or technology, the �early adopters� are essentially the beta testers for the rest of the market. Models which are believed to be fully developed are found to be lacking in significant detail or insight. And many approaches are simply not realistic when applied to the larger part of the market. Having worked through a period of trial and error, many outsourcers are now finding their niche, and are delivering (very successfully and profitably) valuable services to their business and professional clients. This working model has not yet matured to the point where offshore (or domestic) outsourcing is an automatic solution for any practice, and there is no cookie-cutter model to follow to success. Accounting professionals understand the unique nature of each of their client businesses, and it is this unique aspect which represents the challenge in creating standards in processes and systems which are an absolute requirement for any successful outsourced engagement.

The question is not whether or not your client should outsource their work - the answer here is obviously yes, and that's why your client works with you. But whether or not YOU should outsource certain processes or functions remains a question. There are significant benefits to be derived, not the least of which is an improvement in workflows and controls to measure performance. The cost-of-service benefits may, for some, remain elusive. The primary reason many companies initiate outsource arrangements is based on the assumption of handling the existing work using the existing processes, but at reduced labor rates. In truth, the benefits more frequently arrive in the form of enhancements to workflow and control processes, and the development of a greater and more in-depth understanding of the work being performed on the clients' behalf.