In enterprise IT, whatever goes around comes around. And the latest phase could well see the return of the much-vaunted application service provider (ASP) model.

Hosted software offerings from firms like Salesforce.com, Salesnet and NetSuite now present an additional option to the perennial IT chestnut of whether to build or buy. Subscribing to software as a service over the Internet is now a viable way of acquiring a new system or solution for businesses.

The ASP model of years ago didn"t succeed because "not many people built good ASP offerings," said Steve Beason, head of technology at Hong Kong Jockey Club. "It"s gone through what Gartner call the "trough" and we"re now hitting the "plateau", so it"s not a surprise to me that we have offerings like Salesforce.com."

The hosted model has been validated by Siebel"s own hosted offering of its traditionally packaged onsite CRM suite. Having spent much time in the past chastising and debunking the hosted model, Siebel now acknowledges that service-based CRM may suit some businesses.

Finding the path

The common perception is that hosted software offerings only suit smaller enterprises seeking standardized systems with low entry and maintenance costs. The argument in the past against hosted offerings has been a lack of customization and integration capabilities. That has been disproved with large enterprises like Bank of China, Hutchison (Australia), Nokia and Dow Jones signing up for services with Salesforce.com.

Software-as-a-service is most applicable when an organization does not have the time, money, or resources to buy, build, implement, maintain, and support software applications. "In other words, the conventional software selling model is dead, or at least dying," said Doug Farber, Salesforce.com"s vice president of marketing for Asia Pacific.

Whether this is a third way or not, the point is that hosted software is clearly here to stay, and set to develop further. The question is how CIOs evaluate whether such a service fits the requirements of the business.

Beason at HKJC does not think that subscribing to a service is a third way as such. "It"s still make-or-buy, but if you decide to buy, then do you buy a system or a service?" he said. "The first thing you do is ask: is there a process that looks at this problem and is applied consistently every time the situation arises?"

Process, process, process

The set of processes for the build-or-buy decision must be identical for every instance or business opportunity that arises, stressed Beason. At HKJC, there"s an internal IT committee that evaluates every business request for an IT service or system. The process determines the strategic value and potential savings of the proposed project, as well as factors like business transformation versus drive for competitive advantage.

Scores are given to all these factors and weighted according to priorities set during the process-for example, if cost cutting is a priority then it"s weighted more heavily.

The scores are then plotted on a value-versus-risk matrix to determine which options can be applied. According to Beason, a high-value/low-risk project could be considered for a serviced offering, as long as it is not a core-enabler for the business, he added.

The point is that for service offerings, firms are less likely to outsource or utilize a hosted service when the function is core to the business or a key value generator.

"It"s unlikely that we would outsource a pure betting system," said Beason, "but we would never build an ERP system." The HKJC IT chief said that anything mission-critical, or a business driver, is unlikely to be outsourced. Typical of the approach of HKJC is how it utilizes a third party to host and manage its company information-type Web sites, but manages all the transaction and betting-related sites. "I will build a call center for 3000 staff to take bets, but I will buy a call center for administration of account management, ticket trouble reporting-because while that"s important it"s not my driver," added Beason.

"An ASP model is hard to apply in areas that are core, or where there is sensitive information and data," agreed Greg Au Yeung, vice president, head of Information Technology investor services, Asia, State Street Bank.

In the past anything that has been deemed strategic has been built in-house but the trend to outsource and buy more systems has grown, said Au Yeung. He noted that as certain technologies become more commodity-like-i.e. no longer requiring in-house expertise to build or develop-then the bank would consider buying them. "But the integration component is key and often not easy with off-the-shelf products," he said. "We"ve found [that] some products in the past can be a real pain to integrate with our architecture."

While Au Yeung admits that banks may not be attracted to hosted software-due to the customized nature of banking systems-he acknowledges the ASP trend is clear and feasible. As a provider of settlements and back-end operations services, he expects his customers to become more interested in on-demand services.

Another consideration when looking at on-demand services over time is the short term and long term costs of buying or leasing a system. IT organizations should evaluate offerings over the long term and compare the "trickling" investment over time to the one-time cost of buying and implementing a system.

Discipline is key, said Beason. "Have a disciplined process and focused group that looks at this all the time-to scope it: size it, cost it and schedule it," he stressed.

Why only CRM?

So far the hosted software model seems to have been championed only in the CRM space. Few other cases have emerged in other applications.

Au Yeung thinks that CRM may be a more straightforward area to deliver as a service. Sales and contact information and trend analysis may be easier to get hold of and develop for, he stated. "There"s less integration [for CRM] than say for ERP."

Farber at Salesforce.com thinks that CRM, for whatever reason, is not considered "mission-critical" and companies are more apt to have it hosted outside their walls. "Also, CRM is an important function that has been done so badly in the past that organizations are willing to try new approaches to get it right," he said.

Farber and Beason expect other hosted applications to appear sooner rather than later. Once CRM becomes firmly established as a viable "software as a service" offering, other segments will follow, predicted Farber. "Some prime ones are HR, professional services automation, expense tracking and then probably ERP and SCM," he said.

The views on lack of hosted offerings for ERP and SCM so far have hinged on the closeness to the finance department which is inherently conservative, observed Farber. "Sales and marketing are more adventurous and willing to try new things."

Points to consider

One area for consideration when evaluating a hosted offering is the readiness of the infrastructure. While traditional enterprise software utilizes powerful PCs, hosted services require reliable networks and high bandwidth availability to provide the necessary Web access. This inevitably leads enterprises to a more "thin client" and browser-based environment. Firms will also need to think about how much back-end integration may be required with the hosted software, while the systems and processes of the provider must also be evaluated (see sidebar, "Questions to ask your ASP," below).

As many enterprises use "fat" Windows-based clients, the potential for more hosted Web-based applications poses the question of fat versus thin client computing. "Fat clients are dead unless you are a designer-everything will be browser-based sooner rather than later," said Farber. "It makes no sense to have these bloated boxes on our desks that do nothing but collect viruses, bugs and antiquated software."

Microsoft itself acknowledges the shift toward hosted on-demand software. "The CRM and ERP markets have taken a swing toward completely packaged online services that address vertical and horizontal needs," said Adam Anger, director, business and marketing organization for Microsoft Hong Kong.

While hosted applications are a clear trend, Anger pointed to a number of issues that enterprises should consider when evaluating any hosted offering. "On-demand services must meet the basic criterion of lower costs from initial deployment to full production without sacrificing features," he added.

Total cost of ownership is another key factor-with hosted offerings expected to provide lower investment and maintenance costs. Anger recommended that synergy should be apparent between the existing IT infrastructure and the on-demand service. "Finally, on-demand solutions must be ironclad in security, as they could expose critical business data to unscrupulous eyes," Anger said.

Beware and be aware

Beason also cautioned that businesses becoming more Web-dependent will bring risks that IT and business managers must consider. "We"ve already had huge DOS attacks and failures," he said. "But something I worry about more [regarding the Web-based applications model] is that I foresee some catastrophic failures on the Internet, with all the security issues that are present and the bandwidth constraints."

Beason stressed he is by no means against hosted software offerings but when evaluating such proposals, all the risks must be identified. "I want my business users to be ready and aware so when we do things, we do them with our eyes open."

He firmly believes that whether applications are built, bought or outsourced from a provider, the IT organization must maintain its role of managing the application. "It is IT"s responsibility to ensure that the business is happy with all IT services regardless of how they are provided," declared Beason. "Right now that"s not true of all IT departments."

According to Ringo Chiu, CIO at the Securities and Futures Commission, "no matter which option you choose, intensive engagement from the IT team cannot be avoided, as the "ownership" of the solution cannot be outsourced."

He added that however software vendors package their products, whether to buy or lease on-demand, enterprises cannot get away from proper TCO evaluation. "There is no silver bullet on decisions to build or buy or lease," said Chiu.

He correctly points out that similar business requirements in different organizations may result in very different decisions. Ultimately, whatever the decision-build, buy or subscribe-companies must do the "dirty work" (as Beason put it) before they can make a considered holistic decision.