by Kevin Coleman, Director, TPI

As Facilities Management Outsourcing (FMO) arrives in manufacturing companies, a vigorous debate arises over where to draw the line of demarcation in manufacturing plants. This line refers to the separation between management and maintenance of the building itself — including the building’s electrical, plumbing and HVAC systems — and management and maintenance of the systems linked to plant operations. Because it is often impossible to completely segregate the two, this is a critical issue to think through when considering FMO for manufacturing sites.

By Steve Follin, Director, TPI Cloud Services

Discussions around cloud security tend to be framed in terms of lonely ships sailing into uncharted waters: “You don’t know what you’re getting into,” we’re routinely warned.

Actually, we do.

The fact is, the fundamental security challenges confronting a company seeking to source IT infrastructure services in the cloud are essentially the same as those faced in traditional outsourcing.  Various potential risks – data center vulnerability, network intrusion, unauthorized system access, data privacy, natural disasters, etc. – must be assessed and addressed to provide an acceptable level of security for data centers, operating systems, storage environments, and networks. 

What’s different in a cloud setting?  It’s that the infrastructure “layers” involved may be more decentralized, are most likely shared with other customers, and have more complex IT operational processes, whereby processing may be moved among the provider’s data centers to load-balance. 

Due diligence therefore comprises focusing on exactly the same traditional security concerns, asking the same “first round” questions about each infrastructure layer, and following up with more questions as complexities emerge. Ultimately, what’s needed to solve the mystery of cloud security is to “peel back the onion” – to systematically evaluate the security of each infrastructure layer, and to then assess additional risks inherent in the provider’s cloud architecture and operational environment. 

Consider, for example, a virtual private cloud (VPC), where some, but not all, infrastructure components are dedicated to each customer.  In other words, CPUs and storage may be dedicated, while server racks and physical network segments are shared.  From a high-level perspective, assessing security may seem daunting as the environment is “new” and complex. But by systematically addressing the security concerns at each layer of the infrastructure “onion,” and then at the overarching cloud level, a viable approach readily emerges.

The first and foremost assessment question for a VPC is: What’s dedicated and what’s shared?  While this has to be understood at a very deep technical level in order to perform a security assessment, providers have this information readily available.  If the provider’s cloud solution has dedicated storage and servers, then the “first round” of due diligence is to use the customer’s “conventional” security criteria to assess the dedicated servers and storage security.  Specifically, the servers’ virtual and operating systems’ security is assessed as it would be in a traditional hosted server environment.

As for public clouds, in a VPC the shared infrastructure components and cloud operating processes create security risks above and beyond those in a traditional hosted server environment.  If server racks are shared, their architecture’s compliance with the customer’s security policies must be evaluated.  If the provider’s processes include moving data between data centers to balance loads, compliance with the client’s data privacy and security requirements must be addressed.

As a client, the key to evaluating cloud security is understanding the cloud implementation details and “peeling back the onion.” This approach leads to a series of tractable security assessments that can be addressed using conventional evaluation processes.  While the issues involved are complex, the complexity can be systematically addressed – layer by layer.

by Julie Fernandez, Director - CHRO Services, TPI

Part one of this series focused on recent developments in payroll administration in North America. Now we turn our attention to the global payroll market.

In 2010 and 2011, global payroll outsourcing opportunities continued to draw the attention of large, mid-size, and small clients alike. Last year, TPI released a filtering tool that evaluates a client’s global payroll needs with an articulated country-by-country strategy for rationalized outsourcing of payroll administration. We have since seen a very favorable response from global leaders in HR, procurement and shared services and are frequently engaged to help clients articulate their global payroll strategy and help build a business case for change.

Heritage payroll providers are taking the lead in multi-country payroll outsourcing, with ADP and NorthgateArinso having the broadest reach. These providers are investing significant resources in developing global payroll templates while expanding their offerings to include pre-configured templates featuring more sophisticated country-level payroll rules for countries with the payroll scale to deploy multi-client services. These global payroll platforms are generally designed for the most commonly served markets, including Western Europe, the U.S., Mexico, Brazil, and some Asia Pacific countries, including Australia, China, India, Japan, Hong Kong, Singapore and Thailand. 

HRO providers take a different approach. Rather than developing a broad global template and reusable country configurations, they are focused on leveraging clients’ custom ERP by extending their payroll modules to the largest countries where payroll scale can generate savings or efficiencies to the client. Typically only a portion of a client’s population is concentrated in geographies that can implement such global ERP payroll solutions cost effectively. As a result, HRO providers usually punt in-country payroll services to third party solutions that they may agree to manage.

In recent years, the global payroll market has seen the emergence and growth of more service providers focused on the “tail end” of global client populations – the 20% of employees who are scattered across 80% of the globe. Some refer to these providers as “payroll aggregators” because the term is a fitting description of the primary value proposition. 

There are payroll providers whose approach and technology are specifically designed to normalize data for consolidated interfaces and coordinate with in-country third party vendors. Patersons, SafeGuard World International, Celergo and others with a regional focus will directly serve clients who seek bundled payroll outsourcing for multiple countries. Providers like these have also become important partners for HRO and SaaS providers seeking to round out services and geographic coverage. Heritage providers are working to imbed such a model within their larger global offerings — ADP with StreamLine, Ceridian with exclusive in-country providers and NorthgateArinso with its BDO and agoHRa relationships.

The global payroll outsourcing industry, as a whole, is facing a critical challenge. We must ensure that global payroll outsourcing can create a track record of success. Clients continue to need assistance in defining the scope that is “right-sized” for each country before wildly pursuing a whole world’s worth of payroll. And finally, knowledge of the market to target the appropriate providers and articulate actionable business cases will help to create an awareness of the value in strategic sourcing of payroll across the globe.