Wednesday, October 21, 2009

It’s the Aftermarket Service, Stupid! (Part I)

Regardless of the economic environment (and sentiments), I always think of the opportunity within the aftermarket service and support as a profitable, high-margin and customer-captive business, and yet, still underserved. General Electric (GE) would be the proverbial example of a company that has focused on aftermarket opportunities, going so far as to call itself a “services” company as opposed to a “products” company.

GE indeed, starting with Jack Welch’s long chief executive officer (CEO) tenure, has been widely reported to have significantly increased both its total revenue and profitability by focusing on services opportunities in addition to developing world-class products.

The manufacturing corporate giant has certainly proven the value of serving the product aftermarket, which has recently been purported in a quantifiable manner by many pundits as a high margin business. For instance, AMR Research reported recently that businesses earn 45 percent of gross profits from the aftermarket, yet it is only 24 percent of their revenues, while a recent article in Harvard Business Review claims that we all spend US$1 trillion every year on assets we already own.

A related software category term was mentioned in TEC’s 2003 article titled Service Lifecycle Management - Tapping into the Value of the Product Aftermarket. Namely, Service Lifecycle Management (SLM) is a business initiative focused on servicing a company’s products, and the customers that bought them, after the product has been sold. Simply put, SLM focuses on making more money from the product after the initial sale. But it is more than that — it is also a way to become a strategic part of the customer’s business after the sale is completed.

In another Harvard Business Review article titled Winning in the Aftermarket from May 2006, MCA Solutions’ co-founders, Dr. Morris Cohen and Dr. Vipul Agrawal, shared their insights on opportunities to increase corporate profitability through better management of the service business. The “Six Steps for Managing Service Networks” outlined therein explain how all service-oriented companies (not to be confused with “service-oriented architecture [SOA]”!) can take advantage of these opportunities.

Industry leaders like Cisco Systems have reportedly been leveraging MCA’s Service Planning and Optimization (SPO™) suite [evaluate this product] to do just that, and have benefited from reduced service parts inventory, improved service levels and greater profit.

Servigistics, one of the leaders in the nascent SLM software category, refers to it as “strategic service management”, which entails service parts planning & optimization, service labor planning & scheduling and service parts pricing. The focus of today’s blog post is the realm of service parts planning & optimization.

TEC’s 2006 article titled Enterprises May Be Overlooking Profits from After-sales Service concurs with this particular opportunity. Namely, if service parts (including their availability and pricing) and service personnel management are well managed, manufacturers can significantly improve their profits from service operations. This will in turn lead to significant overall profit margins.

This brings us again to MCA Solutions, a privately held company headquartered in Philadelphia, Pennsylvania, the United States (US). Besides Servigistics, MCA Solutions has become a “usual suspect” in most big-ticket service parts planning and optimization evaluations.

The above-mentioned MCA’s award-winning SPO software suite has helped a number of aerospace and defense (A&D), high-tech and capital equipment companies of all sizes transform their service supply chains into bottom-line business drivers, by reducing (excess and obsolete) inventory, lowering support costs and improving service levels to maximize customer satisfaction. These, in turn, often result with higher revenue and increased equipment availability.

Outside the service parts planning & optimization market, the “MCA” name can be confused for a record label, museum of contemporary art, and whatnot, but the company’s brand recognition in its target market needs not much bolstering. Virtually anyone dealing with service parts planning and optimization knows that MCA stands for Morris Cohen & Associates.

Dr. Morris Cohen is the Matsushita (Panasonic) professor of manufacturing and logistics at the Wharton School of the University of Pennsylvania, and co-director of Wharton’s Fishman-Davidson Center for Operations Management. Dr. Cohen has spent three decades researching, planning, and designing advanced value chain systems and working with customers such as IBM, Cisco, Applied Materials, Intel, General Motors, and the United States (US) Navy.

In 1999, he co-founded MCA Solutions to bring the intellectual capital of service value chain optimization from the classroom into the technology marketplace (i.e., the real world). Another MCA co-founder, Dr. Agrawal, was a student of Dr. Cohen’s at Wharton before becoming assistant professor in the operations management department at the Stern School of Business at New York University. Today, Dr. Cohen serves as chairman of MCA’s board, while Dr. Agrawal is MCA’s executive vice president of products.

The mere concept of inventory optimization sounds quite simple: one has to balance the risk of stockouts (i.e., missed sales opportunities translated into poor customer service) with the (often hefty) investment (and tied up capital and cash) in inventory (safety stocks). This becomes sort of a “damned if you do, damned if you don’t” situation.

But the situation becomes much more complicated when one has to take into consideration multi-echelon distribution channels that entail hundreds or thousands of possible part locations worldwide, and even hundred thousand parts/stock-keeping units (SKU’s). The multi-echelon term refers to the supply chain hierarchy that spreads from the top upstream inventory point (e.g., a central distribution center [DC]) downstream several layers to the farthest node in the service chain (e.g., a regional warehouse or even a field service van).

It is thus a small wonder that MCA (and virtually every other optimization peer vendor) stems from the academia and its software’s concept is based on rocket science-like planning & optimization algorithms. In 2001, MCA released the first commercially available software for multi-echelon inventory planning for service parts.

As I have learned thus far from talking to the likes of MCA and Servigistics, these vendors remain quite cautious (if not outright secretive) about mentioning client’s names (especially if the client is involved in the product co-development) and about discussing their planning algorithms at a deeper level (not that many ordinary folks would understand these either, but, hey, the competition might listen in!).

Indeed, the planning and optimization models that these vendors tout can really be too overwhelming and hard to comprehend for ordinary mortals. For instance, in a single location with typical service parts, there can be deployed a few different methods of inventory planning, such as:

* Each part location is planned separately;
* With a so-called demand accommodation approach (mastered by Servigistics), which determines what parts to stock, then calculates demand satisfaction levels, to finally segment parts and locations into these different fulfillment (customer service) levels; and
* Overall optimization (arguably mastered by both MCA and Servigistics), as to achieve an overall desired service level across selected parts and locations.

Reportedly, the optimization approach can result in inventory about 30-40 percent lower than individual part location and 20 to 30 percent lower than the demand accommodation approach with much less planning and labor.

Warning: each prospective customer should check well which of these models would be the most appropriate for their business and ask the vendors to simulate real-life scenarios to them with germane data. Another warning: even then the recommended results from these packages might initially seem counterintuitive, with the rationale being difficult to explain. Nonetheless, MCA’s very first customer (I suspect it is Cisco) still successfully uses MCA SPO to manage a multi-billion dollar service parts inventory base, with 250,000 active parts across over a thousand service parts locations over several echelons.

Moreover, in some industries like aerospace & defense (A&D), stockouts are often prohibitively costly (i.e., planes are grounded due to missing critical parts), while, on the other hand, a mission-critical spare part can cost an arm-and-a-leg. There, the whopping investment in safety stocks has to be balanced rather against the risk of the part failure.

To that end, in 2003, MCA partnered with a well-known aerospace company to develop the first commercial software for planning based on service parts availability. Availability-based planning means that the system looks at the availability of all of the critical parts to support a piece of a complex equipment (installation), as opposed to independently planning for fulfillment rates of individual parts and locations.

With the same customer, MCA introduced software that managed multi-indentured and multi-echelon spare parts forecasting and planning, which was needed to support stringent “performance-based logistics (PBL)” programs that have been mandated by the US Department of Defense (DoD).

In 2004, MCA introduced risk-based tactical planning which takes a probabilistic approach to forecasting and applies it to the management and prioritization of service (work) orders. By prioritizing based on the risk of stockouts (i.e., the part’s criticality vs. its cost and the lead time to replenish it), the system ensures that supply is used optimally to meet spare parts service objectives, thus increasing service performance while making the planner more productive, too.

For more details on these principles see TEC’s earlier article titled Lucrative but ‘Risky’ Aftermarket Business—Service and Replacement Parts SCM. Also, TEC, with a courtesy of ChainLink Research, has featured Dr. Cohen’s article along similar lines entitled Service Supply Chain Strategies to Increase Corporate Profitability.

It’s the Aftermarket Service, Stupid! (Part II)

A related 2007 milestone at MCA included a significant expansion with both new and existing customers in core markets, including aviation and defense (A&D), high-tech, and semiconductor manufacturing. Specific wins included the first joint effort with SAP for a large commercial aircraft manufacturer, expanded work with the US Navy to include planning for the entire naval aviation fleet, and successful deployments at new medical and capital equipment customers.

In addition to working with the largest corporate customers, MCA also cited growing revenue in the mid-market. With its SPO OnDemand Software as a Service (SaaS) offering, MCA hopes to bring to smaller service organizations the same capability that service leaders in the Fortune 500 are seeing value from, but with a much lower upfront software and information technology (IT) infrastructure investment.

These benefits are attributed to lower monthly costs and faster implementations. The vendor will be expanding this offering in 2008 to make it even more appetizing and faster to deploy. The most recent win with the OnDemand SPO solution at Unisys Corporation might be a sign of succeeding with on-demand model at larger corporations as well as appealing to the mid-market.

Quintessential SAP Partnership

SAP now officially recognizes MCA’s Service Inventory Optimization (SIO) packaged composite application (PCA or “xApp” in SAP’s lingo) as an exclusive SAP-endorsed business solution (EBS) in the service parts planning space. In general, an SAP xApp is open to any third-party application that that qualifies technically, and hundreds of those are planned for certification and launch in 2008.

This compliance should make implementation in SAP environments fairly seamless, and, in MCA’s case, offer the market one of the most sophisticated integrated service parts planning and optimization solutions available.

In mid 2007, MCA completed solution qualification for SAP EBS and now the two companies boast several joint customers. I should point out here the importance of achieving the coveted EBS denomination, since there are currently only about a dozen or so such solutions. In other words, MCA SIO is an SAP xApp certified solution, with seamless process and data integration between the involved applications supported by both companies.

For those that are more technically inclined, SIO leverages many of the SAP NetWeaver platform’s components, such as Web Application Server (WAS) and Exchange Integration (XI)/Process Integration (PI). The product utilizes SAP’s enterprise services (or web services, again in SAP’s lingo) for integration between the SIO results (e.g., safety stock recommendations) and SAP’s Service Parts Planning (SPP) module part of the SAP SCM suite [evaluate this product]).

Moreover, SIO runs in SAP Enterprise Portal and leverages the MCA Strategy functionality (soon to be explained), with forecasting and multi-echelon optimization capabilities.

After having completed a stringent solution qualification process in SAP’s test facilities, SIO is nowadays tested and supported by both MCA and SAP. To illustrate the depth of an EBS-like partnership, let us see the evolutionary path that MCA has gone through over the years regarding its alliance with SAP (in the hope that a close relationship with SAP will prove to be very lucrative).

MCA indeed has a long history with SAP, and it has achieved certification at every level and for every major SAP platform. Namely, in 2005, MCA achieved “SAP Certified R/3 Integration” and “Certified for NetWeaver” open enrolment statuses. In 2006, MCA added “Powered by NetWeaver” to its sales collateral, although a few hundred other independent software vendors (ISV’s) can tout the same.

Still, 2007 might have been crucial for the SAP and MCA alliance. For one, due to the above-mentioned EBS status, which denotes the deepest partnership level, MCA also received the SAP Pinnacle Award for “Outstanding Software Solution Innovator”. Prospective customers should benefit from the tight integration of the broad planning process, and guaranteed support of the interfaces from both vendors through product upgrades. With the SAP EBS program, SAP’s existing and prospective customers can access support for partner solutions through the SAP Solution Manager repository.

Catering to All SAP’s Walks of Life

As a result, MCA has a spare parts planning solution configuration devised to return value and preserve information technology (IT) investment no matter where the client is in the SAP technology lifecycle. MCA’s SAP integration framework (coming from all the above-mentioned certifications) supports SAP’s proprietary IDoc’s and Business Applications Programming Interfaces (BAPI’s), and NetWeaver XI/PI enterprise services, which provide integration configuration flexibility and technology choices.

To that end, customers who don’t have the infrastructure to implement the entire joint NetWeaver-based SIO-SPP footprint may have other options, such as to integrate with SAP R/3 and other legacy enterprise resource planning (ERP) systems leveraging MCA SPO open API-based integration.

MCA SIO currently uses several SAP enterprise services, while the forthcoming release will incorporate around 20 services (which means even tighter integration with more SAP modules). The joint solution is integrated with SAP SPP, which ensures tight integration between the strategic and tactical plans, as SAP SPP is in turn tightly integrated with SAP ERP [evaluate this product] and transactional processes like collaboration, order fullfilment, purchasing, warehousing, etc.

Furthermore, in each of the potential configuration options (for virtually every SAP environment), MCA Strategy’s forecasting and inventory optimization is a core component. Its output is the target stock levels (min/max), reorder points (ROP) and reorder quantities (ROQ). MCA’s web site has the elaborate descriptions and nuances of all its products, which also include MCA Tactics and MCA Service Business Design (SBD).

MCA Tactics, whose scope is covered by SAP SPP in the joint SIO-SPP solution (confused yet?), is about generation of recommended orders (purchase orders, repair orders, allocation & transship orders, etc.) to ensure the user orders the right things to meet the service levels defined in the startegic plan. MCA SBD does what-if scenarios planning for various network situations - e.g. network design impacts, impacts of different service level agreements (SLA’s), impact of tradeoffs between part reliability and inventory stocking levels, etc.

Finally, MCA Solutions is a member of SAP’s Industry Value Networks (IVN’s) for High-Tech and A&D. All of the above integrations have been undertaken with the idea of facilitating the customer’s entry point flexibility and early “self-funding” return on investment (ROI), while preserving the current IT investment and lower total cost of ownership (TCO).

Certainly, SAP customers can utilize MCA’a knowledge of SAP integration and lower their IT support costs, since in the spare parts planning and optimization space, MCA is currently the only vendor with this range of certifications and this deep a partnership with SAP.

We should not forget here about Bob Salvucci, MCA’s president and chief executive officer (CEO), either. Prior to MCA, Mr. Salvucci had joined SAP America in the early 1990s, with responsibility for building the relationships with large SAP system integrators (SI’s) and technology partners. From there, he moved into various sales management roles, and later became the president of SAP Public Services, prior to joining MCA a few years back. He and some subsequent MCA hires of ex-SAP staffers should have a deep understanding about how to successfully navigate through the complexities of working within SAP.

Is There a Life Outside SAP’s Sanctuary?

However, while piggybacking on SAP remains critical, MCA cannot afford to “keep all its eggs in one basket” (in part given that the joint selling with SAP has yet to straighten some kinks out). Currently, MCA has about 60 employees and an install base of over 20 large discrete manufacturing enterprises, with all of them deploying MCA’s software across multiple sites.

Over half of MCA customers are SAP customers, while the rest have Oracle E-Business Suite [evaluate this product] and some legacy or mid-market ERP products. ERP integration is often cited as very important to prospective customers, while some existing MCA customers have requested that MCA develop a similar relationship with their ERP providers.

In fact, the recent three-party engagement at the US Air Force (USAF), with Oracle, IFS Applications [evaluate this product] and Xelus/Click Commerce (a competitor of MCA and Servigistics) may speak volumes about the co-opetitive nature of the market. While the SAP EBS-like relationship with other ERP vendors may not happen at MCA for various competitive reasons, the non-SAP base will continue to be important to MCA as it represents about one third of the pipeline.

It is thus no wonder that MCA has lately expanded the Oracle Partner Network (OPN) membership (at least to also send a “subtle” warning signal to SAP to get its ducks in a row for joint sale efforts). It remains to be seen how deep the partnership with Oracle can be in light of its capabilities via the recently acquired Demantra product.

Other Key Success Factors

MCA’s growth of late was driven by its focus on its core strengths: to become the solution of choice for aftermarket service parts planning, and to continue to drive innovation and better solutions. This implies working with and integrating with leading ERP vendors, and with other best-of-breed vendors, primarily those in the SAP’ ISV ecosystem. Most important of those would be Vendavo in service parts pricing, Questra in intelligent device management, and ClickSoftware in field service scheduling.

Still, the strength of MCA’s exclusive SAP relationship was a key factor not only in deals that the two vendors conducted together with their joint solution, but in any SAP environment. There were several SAP customers who went with MCA’s stand-alone solution but liked the partnership with SAP and the potential to evolve to the joint solution as they widen their SAP footprint.

Both SAP and MCA tout that the pairing has already resulted in shorter sales cycles and some early wins. The two vendors have done two deals together lately, whereby the first one, Varian, is not using the joint SIO solution, but may in the future. But they very recently closed their first joint deal at Bombardier Aerospace, which will be implementing the joint solution (MCA’s SIO and SAP’s SPP) later this year.

Another success factor has been MCA’s dominance in the A&D sector in the upper-end of the market. This included both expanding their footprint within existing accounts and adding new ones. In addition, there has been an increasing prevalence of performance-based logistics (PBL) know-how requirements by customers, and MCA’s capability there was demonstrated with some of the largest players like Boeing, Lockheed, and Rockwell Collins.

MCA expects to win in the complex A&D SPO contest almost all the time (it only lost one prospect to Servigistics last year), and will compete well in the high-tech and industrial equipment sectors (especially within SAP accounts). The comany has had several recent wins including replacing two different competitors’ solutions.

One Vendor's Dedicated Governance, Risk Management, and Compliance Unit

SAP, a leading enterprise resource planning (ERP) vendor, has recognized the need for enterprise systems that will help companies meet the increasing number of challenges inherent with corporate compliance and other risks. Recently, the vendor has launched its latest product suite, which places compliance at its core. For more information, please see part one of this series How a Leading Vendor Embraces Governance, Risk Management, and Compliance.

Soon after the Virsa acquisition, SAP announced the creation of a new governance, risk management, and compliance (GRC) business unit to empower its customers with more comprehensive GRC solutions. In doing so, the vendor is now offering a unified alternative to the fragmented GRC point solutions available in the market, with the aim of helping user companies make GRC an integral part of their businesses and information technology (IT) strategies. SAP hopes to benefit from mitigating user companies' current approach to managing GRC, which is marked by two sets of problems: 1) highly fragmented business processes and systems, which compound the cost of managing risk and compliance; and 2) little or no investment in identifying and mapping out a phased approach to comprehensive GRC management.

Underlying these issues is the inherent risk in strategically coordinating and managing a wide range of IT infrastructures that directly support the processes and systems in the GRC business environment. As a result, organizations usually end up deprived of handy and cohesive tools for controlling and addressing risk effectively. At the same time, these customers continue to allocate investments and resources to activities that do not generate revenue and value.

By leveraging the Virsa acquisition and its solid foundation for process-based compliance (and by not letting grass grow underneath its feet), SAP announced the expansion of its portfolio of GRC solutions for both large and small enterprises in September of 2006. Up to now, SAP's portfolio had been largely fragmented despite having dozens of impressive products spanning numerous GRC requirements for multiple industries. But by adding three new products to its GRC offering, SAP has embarked on a painstaking effort to deliver a unified foundation that should allow for a more comprehensive GRC solution that will provide proactive transparency across entire enterprises.

SAP GRC solutions will eventually deliver integrated applications that manage business process and IT infrastructure risks, as well as operational and corporate-level risk across entire enterprises. The current portfolio of applications addresses the specific GRC requirements of public sector organizations and companies across diverse industries, including chemicals, financial services, oil and gas, pharmaceuticals, and utilities.
The Three Pillars of a GRC Foundation

Accordingly, building on its existing GRC offerings, SAP then announced three new service-oriented architecture (SOA)-based applications designed to create a GRC foundation for virtually all types of companies, and to work together to serve as the building block for a more complete compliance solution. Built on top of this foundation will be added enterprise services that should meet the rigorous requirements of numerous industry-specific GRC mandates. SAP pledges to drive continuous innovation on top of each of the following three new GRC applications, which map to the above mentioned components of a GRC framework:

1. SAP GRC Repository will document and maintain GRC information in a single, central system of record, including corporate policies, board of director minutes, regulations, compliance and control frameworks, and key business processes. The content will in part be contributed by external GRC ecosystems, such as government agencies, industry councils, advisory services, etc. The component will also store and link risk and control libraries to multiple control frameworks and to international regulations, whereby GRC ecosystem partners are expected and encouraged to contribute their expertise to the repository. This centralization of key GRC information aims at simplifying risk management, promoting business transparency, and cutting the costs associated with GRC initiatives.

2. SAP GRC Process Control will offer a risk-based approach that should align key controls to business risks in order to promote desired employee behavior and to optimize business processes. The process control application will automatically aggregate business process risks for the entire enterprise; provide supporting evidence of compliance; and pinpoint control violations (in policies or procedures), or uncover gaps in existing controls to prioritize corrective action and prevent material weaknesses from developing and persisting. The software will integrate automated control monitoring for SAP and non-SAP applications.

3. SAP GRC Risk Management will help customers to implement collaborative risk management processes that provide thorough analyses of key business risks at multiple levels of the enterprise and across organizational entities, business processes, and IT infrastructures. To that end, SAP has designed intuitive and collaborative processes to guide professional risk managers and business owners in identifying financial, legal, and operational risks; in analyzing business opportunities in light of these risks; and in developing appropriate responses.

General availability of these foundation components was slated for the end of 2006, with all three products to be sold individually. Certainly, SAP's GRC roadmap is still in its beginning stages, and only time will prove the delivery of more tangible products as well as the success of those products with the vendor's current and prospective customers.

At this point, there is not much detail of how deeply integrated the SAP GRC portfolio is (or will be) within the SAP NetWeaver and Enterprise Service Architecture (ESA) initiative. Nor can much be said at this stage about mid- or long-term, industry-based, compliance product roadmaps and which partners they will lead to.

Given the number of non-SAP Virsa customers, the market will watch how well the GRC offering will fit into non-SAP environments. Also, while compliance expenditure is a necessary evil for many companies, it has thus far been proven to be a questionable investment from a facts-based, quantitative, payback perspective. Over the last few years, SAP has been doing payback analysis—dubbed "value engineering"—on customers looking to justify investment in SAP products. Therefore, one should expect better value propositions for SAP's upcoming GRC offerings.

Still, the new applications build on SAP's deep expertise and existing solutions for wide-reaching compliance requirements of different vertical industries, while grouping all GRC solutions under an integrated GRC framework. The competition is certainly not to be neglected, since vendors such as SAS Institute (see SAS: Striving to Sustain Leadership), Oracle, Hyperion, BusinessObjects, or Cognos have long delivered applications for the risk management of fraudulent financial behavior or anti-money-laundering activities—well before the US Sarbanes-Oxley (SOX) frenzy.
Also, since 2002, a slew of enterprise vendors have jumped on the bandwagon and are now delivering SOX or Food and Drug Administration (FDA) compliance tools, with Oracle, Microsoft, Lawson, Infor, LogicalApps, Oversight Systems, and CODA being only some of the more notable ones. Still, SAP's concerted effort deserves kudos, since even now the vendor offers a GRC solution set that covers a range of regulations in such areas as anti-terrorism, anti-money laundering, Basel II, Solvency II, data privacy, SOX compliance, and beyond, as opposed to most competitors' sporadic GRC nuggets.

Most notably, SAP has recently received both the challenge and the validation of its integrated GRC offering from Oracle and IBM. These two "giants" have lately consolidated a number of formerly fragmented applications and compliance-related processes from the recently acquired (or natively developed) modules for enterprise content management ([ECM] coming from the respective acquisitions of Stellent and Filenet), analytics, reporting and business intelligence (BI), integration and middleware, data-access control, etc.

Partners Remain Critical

Also, recognizing the importance of external collaboration for innovation, SAP is committed to establishing and nurturing a GRC ecosystem that includes recognized domain experts and thought leaders in diverse fields. These fields include, but are not limited to, audit, management, and risk consultancies; key software and technology partners; and information and content partners. In addition, professional services partners will have to support the GRC ecosystem by delivering intellectual capital and by bringing decades of proven, best-practice content and methodologies.

Most recently, SAP announced a strategic relationship in North America with Cisco Systems, the worldwide leader in networking for the Internet, to enhance the effectiveness of SAP solutions for GRC. Such enhancement involves taking advantage of the Cisco Service-Oriented Network Architecture (SONA) within the IT network infrastructure. The two leading vendors have thereby entered into a joint marketing agreement for the US and Canada that aims at addressing GRC business processes and IT control issues across the entire IT infrastructure—from the network layer all the way through the application layer. The joint effort will strive to help further enhance the effectiveness of SAP GRC solutions by making the most of the access and identity intelligence resident across Cisco's SONA. The marketing agreement encompasses collaboration in sales and marketing activities, as well as advanced service offerings.

The intelligent SONA services embedded in Cisco's networking solutions include application-oriented networking, unified communications, security, mobility, and identity services. To support SONA-based GRC software platforms, Cisco offers network architecture design, implementation, and operation services based on a life cycle approach and on the customer's specific needs.

The Cisco Lifecycle Services approach defines the critical set of activities required to help SAP GRC user enterprises successfully deploy, operate, and optimize Cisco SONA-based infrastructures. As an example, specific company controls for data confidentiality can be set to interrogate data batches sent over the network. If anyone tries to (willfully or not) disseminate sensitive data outside the enterprise, the Cisco controls can detect, intercept, and block the message, as well as notify the higher instances of the violation, and track status within the SAP GRC portfolio. Still, the partnership will require a long learning process for both vendors as well as for users.

Most current non-IT users of GRC solutions and prospects (that is, financial, internal audit, corporate risk management, etc.) will likely find Cisco's involvement less relevant for their purposes in the short term. On the other hand, when it comes to IT compliance, the partnership is not exclusive, and many other viable alternatives are available for content monitoring and filtering, identity management, security information and event management, preventive controls (such as predictive financial management), and security controls and policy management solutions. Vendors such as Sun Microsystems and Computer Associates (CA) could play important roles in these areas.

To Gain Market Share in the Mid-Market, SAP Leaves No Stone Unturned

TEC recently interviewed Patrick Hickey, Director SMB Solutions, SAP America and Steffen Fischer, Manager SMB Solutions, BU SMB, SAP Labs in order to get a closer look at SAP mid-market product and sales strategy. SAP is traditionally known as a provider of enterprise solutions for larger organizations capable of undertaking expensive and lengthy application implementations. SAP is the fourth largest software company in the world (after Microsoft, Computer Associates, and Oracle).

SAP's CRM strategy is SAP's supply chain management strategy, is SAP's ERP strategy, is SAP's global strategy. The CRM is fully integrated with SCM and ERP and is also cross-functional. SAP has since added two more product lines to its mySAP Business Suite solution directly addressing small and medium business (SMB) market needs. mySAP All-in-One, a fully integrated, industry tailored business management solution, is delivered through a network of channel partners. SAP Business One is also a fully integrated solution geared to the smaller companies and also delivered through a network of channel partners.
Like its competitors, SAP has been addressing the growing SMB market since 1996 with a lean positioning. SAP offered one ERP product line and it was up to the smaller companies to fit their needs to SAP's application. The challenge for SAP was to pre-customize packages to fit a broader spectrum of types of companies. The new product line would target businesses with complex production processes that would need an ERP application to support their businesses. The idea was cultivated in early 2002 and yielded to the creation of mySAP All-in-One.

The intricacy for such a venture lay in the comprehension of the internal motivations for each vertical sector in order to adapt the software to match each specific business model. SAP opted for a wise approach and partnered with industry specialists with a comprehensive knowledge of each sector. SAP provided them with access to the code and the partners built specialized versions on top of SAP's software.

Mid-market organizations demand solutions that are built to support business processes and SAP is definitely fulfilling such expectations by prepackaging and adapting their application to fit the specific needs of this market. Functionality alone is not sufficient to excel in the SMB market. Vendors must clearly demonstrate their understanding of the SMB culture and needs, and consequently relate their product, pricing, and distribution strategy to best match such culture.

The mid-market combines two main groups: an upper mid-market segment and a lower end segment. The growth potential of the mid-market has piqued the interest of large enterprise CRM players. Vendors like Oracle Corp., PeopleSoft Inc., SAP AG, and Siebel Systems Inc., have already gone downstream to offer CRM software for the higher end of the mid-market and for divisions of large companies. This segment was traditionally catered to by mid-market solution providers like Onyx Software Corp, and Pivotal Corp., and now they are being directly challenged by the heavyweights. The lower end relative tranquility, originally catered to by Best Software Inc, Maximizer Software Inc., and FrontRange Solutions Inc., is also being disrupted by vendors like SalesForce.com Inc and UpShot Corp., which offer hosted services at a low-cost monthly subscription. Newcomers like Microsoft Corp with MS CRM, are courting both higher and lower segments.

The SMB market is crowded. Considering the majority of companies worldwide are mid-sized organizations, it is crucial for vendors operating in this arena to partner with consultants, value added resellers (VAR), or independent software vendors (ISV) to secure a broader access to this market. The small size of the mid-market companies makes them even harder for vendors to find and sell to. The local solution provider, however, can act as an extended sales force for the vendors with which they work.

Unlike PeopleSoft, SAP seems to have adopted this reality and has partnered with strategic firms to reach scattered customers. The perfect example of such an alliance is between SAP and American Express for the sales of SAP Business One. Business One was a buyout of an Israeli Company geared to very small businesses and combining CRM with ERP. The relationship between SAP and American Express involves two major components: American Express will serve as an individual reseller of SAP Business One and is building its own national network of highly qualified channel partners. In addition, American Express is working with SAP to develop specialized versions of SAP Business One, to be offered exclusively by American Express and its channel partner network under the brand, SAP Business One -- The American Express Edition.

SAP tends to cover the whole spectrum of the market with SAP Business One, mySAP All-in-One and mySAP Business Suite.

mySAP All-in-One is an e-business solution that encompasses industry specific processes by leveraging SAP best practices. It is pre-packaged in order to reduce implementation time and cost.

For many years Siebel was considered as the leader in providing the most comprehensive CRM package to the market. Today the gap is shrinking and both SAP and Siebel are reaching functional parity, causing users to consider other factors in their selection process. SAP even outscores Siebel in important features such as order management and content management that factor high in a sales force automation (SFA) environment.

As vendors reach functional parity across CRM applications, the SMB users pay more attention to other decisive factors such as integration costs, usability, architecture, and Total Cost of Ownership (TCO). SAP offers mySAP All-in-One as an integrated ERP/CRM solution. The combined solution reduces the integration complexity and TCO when, and only when, the integration is with SAP's own applications.

SAP is tapping a large installed customer base, knowing that that is where its solution will best sell. Patrick Hickey claims that nearly 58% of SAP installations worldwide are in companies with less than $500 M (USD) in revenue (SAP's definition of the SMB marketplace), which represents more than 20,000 potential installations. SAP has strategically selected to secure support from its network of SMB channel partners. These channel partners constitute the vertical expertise needed to customize and implement the mySAP All-in-One application. SAP has a network of eighteen SMB channel partners dedicated to developing, selling, and supporting SAP products across North America. In partnership with its Channel Partners, SAP supplies the end-to-end integration, unlimited scalability, and most pertinent business processes that small and medium-sized businesses require. Partners like the Plaut Sigma would offer CP-Food, Cosmetics, management consulting, and computer reseller solutions. Where as Itelligence covers Automotive, complex manufacturing and wood related companies.

SAP presents its offering in a three-layer horizontal packaging. The first layer supported by SAP represents the technical packaging. Then SAP, together with its horizontal partners, provides the sales and delivery packaging elements. The last layer is the services bundling supported by the horizontal and channel partners. SAP pre-configures the industry specific solution within the desired horizontal (i.e. CRM) module relying on their existing best practices knowledge base and the principles of rapid, low cost implementations.

SAP Best Practices for CRM includes:

  • Prepackaged delivery capability to reduce implementation time and cost
  • Training and documentation to accelerate knowledge transfer
  • Helping companies see the value of CRM
  • Pre-configured best practices for the scenarios that SMBs demand
  • Integration, flexibility, and configurability of mySAP
  • Installation guidelines let you choose the scenarios you want to implement
  • A solution that will grow with the company
  • Industry-specific capability through Best Practices and mySAP All-in-One
  • Dedicated channel supporting SMB customers through sales, delivery, and support
  • SMB BU and Smart Business Solutions; SAP's commitment to the mid-market.

Sunday, October 4, 2009

The Best ACT! Is Still to Come

Anyone involved in sales during the eighties would surely remember ACT! as the crucial contact management tool. The competition was fuzzy until the dawn of customer relationship management (CRM) when vendors appeared offering new packaged applications that included contact management, marketing automation, sales force automation, and call center management. Now, more than a decade later, the odds dictated that ACT! should have been overshadowed and its market share divided up among the new packaged applications. However, a few acquisitions later ACT! has still managed to maintain its raison d'tre, retaining over two million users in North America alone.

Looking to further consolidate its leadership in the lower-end CRM marketplace, ACT! is once again undergoing a face-lift in presenting new features and functions that respond to the latest market trends. This innovative initiative by Best Software, the American subsidiary of the UK-based Sage, Group plc, is due to take place in late August 2004, with the solutions now available in two versions: ACT! 2005 and ACT! 2005 Premium for Workgroups.

Management at ACT! sees an opportunity to increase the lifetime value of its loyal customers in two ways. By providing a broader assortment of functionality, customers' requirements will be fulfilled over a longer period of time. In addition, by intentionally reducing the market gap that currently exists between ACT! and its sister products, transitioning from ACT to Best's other CRM solutions will be an organic process. This is a valuable opportunity to leverage Best's existing customer base and marketing potential.

As Joe Bergera, senior vice president and general manager at ACT! explained, traditional market segmentation strongly positions ACT! in the 14 user category, representing 40 percent of the company's customer base. Interestingly enough, research shows that the software is currently very well received in sales departments of larger organizations housing more than 500 employees. As Beth Kohler, senior product manager at ACT! explained, it appears as though sales representatives are using the solution as their own private contact information organizer and then reprocessing the data into other co-existing CRM solutions like Salesforce.com, Siebel, or SAP. Clearly, the inexpensive contact management software for small businesses is playing a transitional role for sales representatives in bigger organizations. A logical deduction is then that either sales populations have difficulties in working with upscale and complex CRM tools, or that ACT! has done an excellent job of making the sales population fervently loyal to their product.

How and how well will Best seize this opportunity in leveraging its existing customer base and marketing potential? Since Sage/Best acquired ACT! in 2001 and presented ACT! version 6 to the marketplace, the company has taken slightly over three years to introduce ACT!2005 representing version 7, with over fifty new features and many usability enhancements. This new version reflects a more long term strategic positioning.

As far as the product goes, ACT! 2005 provides several additional functionalities to satisfy requirements from a sales force automation (SFA) application including better opportunity management, enhanced activities and calendars. In order to clearly target the larger workgroups ACT! 2005 had to improve data accessibility and security. Some improvements are intended to empower sales management with better visibility and reporting tools that can export organized data with ease.

More importantly, there are new technical improvements that reflect more current and Internet-based technologies. While ACT! 2005 supports 110 users, an additional version intended for larger sales teams and workgroups, ACT! 2005 Premium for Workgroups is targeted for 550 users. Both new versions boast an MS SQL database allowing improved scalability and make use of a complete .NET platform providing a more reliable code base ready for total Internet accessibility. The development of a web client version is, however, only due at the beginning of next year. Opportunity management improvements include features such as new templates that follow sales stages accurately, along with a completely new quote generation functionality that together move ACT! out of the arena of solely contact management and into the world of sales force automation.


Keep Your IT Projects Focused with TEC’s Evaluation Centers

But putting your requirements first isn’t always easy. Software selection is a juggling act, and your requirements aren’t the only ball you need to keep in the air. You’ve also got to analyze reams of data from vendors (some of it fact, some of it marketing hype) to find out if their products actually meet your requirements. And you need to make sure that you’re analyzing those data the right way—using the right tools and a proven methodology.

That’s where TEC’s Evaluation Centers come in—helping you stay focused on your requirements without dropping anything else.

So What Is an Evaluation Center?

Our Evaluation Centers are dedicated, online environments for software selection. Each Center contains everything you need to compare a particular type of enterprise software solution, and include:

A structured method for defining and prioritizing your requirements: The Evaluation Center interface lets you work from a model of industry standard features and functions where you can identify the features and functions you need and set priorities to define their relative importance. Structuring your requirements this way makes it easy to see how well vendors support them. But more on that in a moment.

Detailed vendor information: We ask vendors in dozens of industries to respond to detailed requests for information (RFIs) so we know how well their solutions support thousands of industry-standard features and functions. Once it is vetted by our analysts, this information ends up in our knowledge bases (KBs), along with articles, white papers, and other relevant data.

Every Evaluation Center gives you access to one or more KBs, so you have up-to-date information about hundreds of vendor solutions at your disposal—information that would be, at best, difficult and time-consuming to gather on your own.

A built-in decision support engine: Powering TEC’s Evaluation Centers is ebestmatch™, our online decision support engine. ebestmatch compares your requirements to the capabilities of vendor solutions in order to first identify a short list of solutions and, later, to identify the “best-fit” solution.

ebestmatch has a number of unique characteristics that make it ideal for software selection. For example, ebestmatch can supplement traditional weighted-average-based analysis with the BestMatch Factor—a patented computation that analyzes not only how well a solution matches your requirements, but also how closely it hews to your priorities.

With ebestmatch, it is also possible to do a “value analysis” that tells you which solution offers the closest match to your requirements for the price, and shows you how other vendors would have to adjust their pricing to stay competitive.
How Does This Help Keep Your Selection Projects Focused?

I said at the beginning that properly defining your functional and technical requirements is a critical part of your software selection project. After all, the goal is to find the best software for your business, and your needs have to come first.

Using a TEC Evaluation Center removes much of the overhead of a traditional selection project, leaving you with more time to pay attention to what you need—and whether the vendors can deliver it.

For one thing, in an Evaluation Center, you model and prioritize your requirements using the exact structure found in TEC’s RFIs—the same RFIs that vendors respond to. So you can see exactly where a vendor does and doesn’t support your requirements, and make apples-to-apples comparisons of competing vendors. That makes the comparison process a whole lot faster.

For another thing, because the Evaluation Centers already contain vendor RFI responses, you don’t need to spend time collecting and validating RFIs to develop your initial short list of vendors. And while you will eventually need to send RFIs to the vendors who make the short list, you can load their responses into the Evaluation Center and do the same kind of quick, unbiased evaluation and comparison you did to arrive at a short list in the first place.

And for yet another thing, TEC’s Evaluation Centers have analysis tools built right in, so you don’t need to spend time building and troubleshooting complicated spreadsheets (if you’ve been through a selection project before, you’ll immediately recognize what a time-saver this is). ebestmatch handles the underlying computations and displays the results in the Evaluation Center interface, using clear, easy-to-understand graphs, charts, and reports. You can see how the vendors perform at any level—from broad functional areas to individual features and functions.

Oh, and just so you know: every Evaluation Center is set up to guide you through the selection process according to TEC’s proven selection methodology, so you can be sure you’re going about things the right way.

Audit Considerations for Enterprise Software Implementations Part 2: Applying Controls and Audit Emphasis

Recent scandals in the corporate world have created a refreshed awareness of the audit function. One example is the Sarbanes-Oxley Act of 2002 (SOX), which is an attempt to strengthen the integrity of financial reporting. While some may argue that the Act does not go far enough, it is a positive, aggressive start.

While this reemphasis may be good news for current and ongoing systems, the process of developing an audit awareness and the need for substantial controls should be established as software is being implemented. If you are the project manager or the project sponsor, possibly the company's CEO or CFO, it is in your best interest to create a financially healthy environment from the start of the implementation project. The expectation is that this good inbreeding will continue with the software into production and throughout its entire life cycle. Considering the extensive scope of enterprise software such as enterprise resource planning (ERP), supply chain management (SCM), and warehouse management systems (WMS) software, the need for adequate and substantial controls is even more apparent.

The prevailing guideline for internal controls is the Committee of Sponsoring Organizations (COSO) of the National Commission on Fraudulent Financial Reporting (Treadway Commission). COSO has provided a standard definition of internal controls to assist organizations in achieving financial, operational, and compliance objectives of SOX. As illustrated by the model below, the COSO framework can, and should, be applied to project activities. The following sections provide examples of how internal controls and procedures can be instituted while the project is underway and carried forward in production. Hopefully, as the project manager and working in concert with the audit function, you can think of others that may be pertinent and cost-effective to your organization. If that is not enough, perhaps the threat of SOX and the attached penalties may be enough to jolt you and your organization into action.




When implementing enterprise software, piloting of this software is one of, if not the most critical event in the project's life cycle. Piloting or conference room pilot (CRP) is the process by which you put the software through its paces in a pseudo production setting to verify that it can support the standard business practices and routines of the company. If done well, the pilot will uncover issues before they become problems, instill confidence in the users that the software is ready for prime time, and make the "go live" uneventful and a cause for celebration.

What role can the audit function play in this segment of the project? A traditional and necessary function of an auditor is the development and execution of comprehensive sets of test conditions and work programs. These conditions serve to test the software under an as "close to" normal operating environment as possible to ensure that the intended results are achieved. This testing function comes into play during two specific piloting processes: module piloting and integrated piloting.

First and shortly after the enterprise software is installed, verification is needed that specific modules perform as expected and can satisfy the business practices of the company. Can orders be taken and invoiced correctly? Is inventory being relieved at the proper points in the process? Are production costs being accumulated accurately? The same types of tests must be developed for the other modules of the enterprise software. The auditor's participation in the development of the test conditions can ensure that the financial and operationally significant aspects of the company are serviced and software executes successfully. While it may be impractical for the auditor to develop business conditions for each module, the audit function should provide overall guidance as to the generally accepted principles of controls, a statement of objectives of auditing through and around computer systems, and participation in a review of testing results and resolution of issues.

The second phase of piloting, which occurs near the end of implementation and after testing of the individual modules is completed, is the verification that the enterprise software is ready for prime time, live production processing. In this second phase of piloting, typically referred to as the integrated pilot or compliance testing, the auditor can and should play an even more dominant role. Not only can auditors develop test scripts, the actual conductance of this acceptance pilot could be placed under their complete control. In this role, auditors provide the independence needed for this critical quality assurance event, relieving the project manager and sponsor of this responsibility. An additional benefit of the auditor's involvement in this pilot is that the test scripts, in full or partial format, can be used in subsequent mid- and end-of-year audit testing. The auditor's familiarity with the enterprise software will continue to pay benefits in many years to come.

A major consideration in an enterprise software implementation is migrating existing data into the new software. Particularly with legacy data, where data structures and models can be significantly different, the matter of data conversion can be tricky and complicated. How this data is to be converted is a separate discussion, which can be found in the earlier published TEC article, Data Conversion in an ERP Environment. Here, we are more concerned with assurances that the resulting data is complete, accurate, and timely. How can the audit function assist in achieving these objectives?

Before embarking on this task, it is important that the data be cleansed and pruned. For example, if you were to convert inaccurate inventory records into the database of the new enterprise software, poor practices and the lack of data integrity will be continued. Orders would be taken with insufficient, unavailable inventory. Pickers could continue to pull inventory from locations of their choosing to complete picklists. The auditor, possibly as part of his normal responsibilities, can help in this regard. Continuing with our inventory example, the timely completion of a physical inventory can help the project with data cleansing and complete an audit requirement as well.

In regard to data pruning, the auditor can assist in determining the legal and tax implications of deleting (or not converting) data. Not only can such pruning reduce the processing clock time of conversion runs but it can also reduce problems downstream. By reviewing the significant issues and findings from historical audits, an auditor can help the company avoid being placed in potentially compromising situations of not having the data to answer questions. At a bare minimum and in case of doubts, the auditor should advise as to what legacy data needs to be archived.

Whether done manually or electronically, the old data must be mapped to the new data. The auditor's familiarity with old and legacy data can be invaluable in two ways. First, while there may not be a receiving field for existing data, an auditor will know when such data is still needed for the company's operations. At this point, an unused field must be selected to store valuable data. The auditor can ensure that, through testing, there will be no fallout from these decisions downstream or in other modules. Secondly, an auditor can determine which existing data maps most appropriately to new data structures. For example, verification that the product ID in the context of your current systems has the same meaning and use as the product number in the new software. The auditor's historical perspective of the systems being replaced and the knowledge of the successor software gained during the piloting processes can be put to good use and, again, avoid potential problems downstream.

While to a lesser degree when performed manually, run-to-run controls to verify the accuracy and completeness of data conversion routines can save time and effort. Automatic run-to-run controls can compare before and after record counts, financial sums, and hash totals or subtotals of key fields. The auditor can identify the critical fields on which these controls should be based. Are you more concerned with quantity on hand or reorder quantity? Are you more concerned with the customer's ID or zip code? Are you more concerned with the product's invoiced price or standard cost?

The most reasonable choice to the above questions is the first choice. There may be legitimate arguments on both sides as to which choice holds the most importance. For example, you could argue that, if the standard cost of a product is wrong, your revenue will be misstated, having a direct impact on the price charged your customers. However, if the invoiced price is wrong, you will look foolish to your customers and, if it is lower than the true price, you may not be able to correct the error on the just delivered invoices. Besides, there are variance reports that can help identify costing issues. Understand that it is not feasible to develop controls on every field or you may have a routine that does little else than add numbers. An auditor can help you navigate through these turbulent waters and suggest which totals give you the most control bang for your processing buck. Additionally, this valuable assistant can identify mitigating circumstances, like variance reports, that can achieve similar results and control objectives.

Finally, since data may have to be converted several times during the course of an implementation project, effective use of run-to-run controls can avoid the laborious task of data verification after the completion of each data conversion process. Particularly for the conversion before "go live," you can ill afford the time to perform this analysis.



Audit Considerations for Enterprise Software Implementations Part 1: Project Planning and Management

Recent scandals in the corporate world have created a refreshed awareness of the audit function. A direct by-product of these scandals is the Sarbanes-Oxley Act of 2002 (SOX), which gives legal and financial muscle to the assurance of the integrity, reliability, and accuracy of financial reporting and corporate disclosures. In fact, based on a recent survey of CFO's and IT executives, 71 percent of the respondents believe that Section 404 of the Act, which requires business process audits and documentation to support internal controls certification, is the most critical part of SOX. While some may argue that the Act does not go far enough, it is surely a positive, aggressive start.

While this reemphasis may be good news for current and ongoing systems, the process of developing an audit awareness and the need for substantial controls can and should be established as software is being implemented. If you are the project manager or the project sponsor, possibly the company's CEO or CFO, it is in your best interest to create a financially healthy environment from the start of the implementation project. The expectation is that this good inbreeding will continue with the software into production and throughout its entire lifecycle. Considering the extensive scope of enterprise software such as enterprise resource planning (ERP), supply chain management (SCM), and warehouse management systems (WMS) software, the need for adequate and substantial controls is even more apparent.

This two-part article looks at four key segments of an enterprise software implementation, with timely emphasis on SOX, and suggests audit procedures, controls, and processes that should be typified, observed, tested, and reported upon. These segments include:

* Project Planning and Management
* Documentation and Reporting
* Software Piloting
* Data Conversion

Clearly, there may be others and, hopefully, this discussion can encourage or scare you into identifying these other areas that may be pertinent and cost-effective to your organization.

Before the full impact of SOX can be absorbed into an organization as a basic component or guiding principle of a project's life cycle, considerable prep work is needed. Getting everyone acquainted with the requirements of the Act and making sure that projects are in compliance is no simple task. Be advised, it will not happen overnight. Consequently, an education and training process must be completed so that everyone is in agreement and on the same sheet of music. This mission should be undertaken as you would for any project but with special emphasis placed on securing a high profile executive to serve as the sponsor. Given the fact that they are most affected by SOX, a CEO or CFO are natural choices and should be easy to convince to participate.

The key elements of project planning and management that come under intense scrutiny include:

* Project charter and overall workplan
* Project plan
* Regular and documented status reporting format
* Issue resolution protocol
* Deliverable monitoring against plan
* Continual communications plan

You are probably saying this is not new stuff; we're doing it today. While the sections of SOX are still in a state of flux, particularly Section 404, the specifications for these elements will not be open to discussion but rather will be rigidly dictated and compliance strictly enforced. Consequently, more than casual attention must be given to these matters and must be available for future review.

Projects will be evaluated based on their impact on a company's bottom line. Specifically, large projects, particularly those associated with enterprise-wide systems, are responsible for consuming materially significant funds that can affect financial statements. Accordingly, the internal and external costs associated with a project can represent a significant expenditure and corresponding expense. The level of expenditure can determine whether software acquisition and implementation projects are capitalized between the balance sheet and income statement. Furthermore, the allocation method must be defensible. Typically, a company will rely on the project manager and the corresponding procedures and controls to support the position taken.

With the arrival of SOX, as project manager, you should be taking certain actions in preparation. Become familiar with the Act itself and see if your industry has additional requirements. An education process for the organization has been addressed above. The AICPA provides a nice and concise overview of the Act. Start looking at Sarbanes-Oxley tool sets. Typically, these are not intended to replace project management tools but rather act as repositories, providing a means to capture required data. Typically, your external auditors can help in this regard. As will be discussed below, start involving the audit function in the project management process as a way to install a control discipline and mindset at the start of a system's life cycle.

Probably those of you working in an overseas company and not subject to the Act may heave a sigh of relief. Good control practices, however, are not restricted by national boundaries or languages. These practices just make good sense and do not need legislation or the attachment of criminal penalties to be implemented. Steal the concepts from the SOX and start your own program to improve internal control practices.

As a project manager, you should encourage the involvement of the audit function from the outset. While specific and typical areas of involvement will be addressed in Part II of this article, as part of the planning and management process, coordination with the audit function can ensure that control objectives and guidelines are understood. In this way, team members will be able to assist in the identification of control weaknesses or gaps. Bear in mind, however, that the ultimate decision as to the materiality of a control weakness rests on the shoulders of the audit function.

Finally, a key aspect of project management is keeping management informed. Ensure that the steering committee, including the executive sponsor, is aware of the project's progress against plan, decision points, and significant changes in scope. Their approval will help keep you in SOX compliance. This is also an opportune time to discuss control objectives and their positive affect on and through the enterprise software. Companies are also starting to look more closely at the project management office (PMO) in an effort to provide more efficiencies but, more importantly, tighter control and monitoring of IT projects. But don't expect a quick fix, easy metrics, or an immediate payback.

The documentation required for compliance with SOX is rigorous. Consequently, a critical aspect of SOX compliance and an internal controls framework is developing a repository of documented controls. As indicated above, there are tool sets available to facilitate this activity. However, the implementation team, with the software's functionality fresh in mind, can start the compilation process and fill the repository. As the project team becomes familiar with the software, control aspects will come to light. For this reason, it is important the audit function defines internal controls, both hard and soft, so that the team knows what to be on the watch for. Confirmation of the controls can be completed in the testing and piloting phases.

Samples of documentation that could be used to satisfy the SOX requirements and, more importantly, can be accumulated during the acquisition and implementation of software are:

* Policy and procedure manual
* Job descriptions and desk procedures
* Systems documentation and workflows
* Report layouts and samples
* Edit criteria and error resolution procedures
* Ongoing reconciliation procedures

Many of these samples can be easily obtained from the vendor or vendor special interest groups where other companies may have already paved the way.

Some might argue that compliance with SOX will only add to the length of the overall project. First, to counter that argument, companies bound by SOX may have little choice. Secondly, it is easier to gather the information gradually as a work-in-progress rather than afterwards when interests have been transferred to other projects. Finally, below is the tradition timeline of an implementation project with the interjection of an audit presence. It would not appear that the extension of the overall project length is minor and could be considerably offset if the audit function serves an active member of the team.





Thou Shalt Comply (and More), or Else: Looking at Sarbanes-Oxley

Most enterprises have to compete globally and thus adhere to largely nonnegotiable legal and regulatory requirements in almost every region or vertical sector they are targeting. Thus, regulatory compliance and the management of a multiplicity of prospective risks have lately pervaded the minds of most executives and upper managers.

Indeed, no single chief executive officer (CEO) would—with a sound mind—like to be apprehended for embezzlement and placed in handcuffs in front of sensation-hungry TV cameras. Neither is any manager eager to face the severe consequences (penalties, lawsuits, brand erosion, tainted reputation, etc.) of a major product recall that is brought to the public's attention because of some extremely unlucky consumer's death or serious illness. Some such recent occurrences include the recall of a major sport utility vehicle's (SUV's) track tires; contamination due to a dangerous chemical leak, causing fatalities; and an E. coli outbreak caused by a contaminated food product. Further, no company is willing to have its imported goods kept at the ports indefinitely, let alone pay severe penalties for (knowingly or not) trading with rogue countries and blacklisted parties, or for having dangerous goods or contraband in its shipments.

Sure, regulated environments have been around a long time, as exemplified by the existence of the US's Robinson-Patman Anti-Price Discrimination Act of 1936 and Hart-Scott-Rodino Antitrust Improvements Act of 1976. More recently, in 1991, US President Bush signed into law the Telephone Consumer Protection Act of 1991 (TCPA), which amended Title II of the Communications Act of 1934. Also known as the "Do Not Call" program, the United States Congress enacted this law to reduce the nuisance and invasion of privacy to the public caused by telemarketing and prerecorded calls.

However, a number of recent events that have negatively affected consumers and damaged public trust has led to the awareness of and the insistence on corporate social responsibility and accountability. Possibly the greatest attention so far has been given to ensuring compliance to the US Sarbanes-Oxley Act (SOX). Namely, the now proverbial Enron, Tyco, and MCI/Worldcom scandals of a few years ago, in which these companies were proven to have falsified their financial statements, have cost billions of dollars and devastated public trust in financial markets (see Claudia Delto's 2005 article Checking It Twice—Basel II, Sarbanes-Oxley Act, International Financial Reporting Standards).

These companies have especially hurt several million small investors by nearly wiping out the investors' pension plans. Much of the abuse that occurred at that time simply came down to either the failure to remember or a deliberate disregard for basic ethics and common sense. The US government reacted in July of 2002 by instating a law that defines how corporate reporting must be performed—the law that was deemed instrumental to restoring investor confidence by providing transparency in corporate financial reporting. Even more recent (albeit much less grave), the disclosure of financial results restatements and of shady executives' backdated compensations at some renowned corporations (Apple, for example) might be showing us that one can never be too careful and work merely on an honor system.

Even before these scandals ever took place, the raft of missed earnings announcements that had for some time occupied headlines in the business press during the 1990s exhibited one common thread—time and again, chief financial officers (CFOs) would moan that they had failed to meet expectations due to a "lack of visibility." These executives would frequently blame major events that they could not have predicted as the cause of poor quarterly performance. Either a key customer cancelled a major order unexpectedly; major product lines were becoming obsolete (and non-marketable); or suppliers were ramping up prices due to a shortage of raw materials.

Increasingly, however, CFOs are being called upon to give more accurate estimates of their earnings potential, and if the company fails to meet these estimates, then they should at least be able to give a detailed explanation as to why.

SOX sets new standards with regards to responsibility, accountability, transparency, and correct behavior in companies. The act also sets requirements for the effectiveness of internal monitoring of companies' financial reporting (see Checking It Twice).The US Securities and Exchange Commission (SEC), established by the Securities Exchange Act of 1934, is responsible for the law and for corporate compliance with it. SOX applies to both US and multinational companies that are listed on the US stock exchanges, such as NASDAQ, while foreign companies that are listed on US stock exchanges are subject to SOX for all fiscal years that ended after July 15, 2006 (see Checking It Twice).To be more accurate, it is applicable to all companies whose securities are registered and that are required to file reports under 15(d) of the Securities Exchange Act.

The motivation behind SOX was to restore investors' trust in the reliability of financial data that companies publish about themselves, and to mitigate the risk of false financial statements. The act also set up a supervisory committee for auditing companies (see Checking It Twice). Specifically, each affected company has to establish fully independent audit committees (that are responsible for oversight of the auditor); must wait at least one year before hiring an audit management team member to be a CEO, CFO, or the equivalent; cannot extend loans to directors or corporate officers; has to make annual internal control reports; must disclose information about material changes on a real-time basis (initially in two business days, but now in four); and must establish "whistle-blower" (informant) protection for employees (who are typically subordinates).

Moreover, as the act creates severe criminal penalties (fines or imprisonment up to twenty-five years) for defrauding shareholders, a publicly traded company's top managers have been made personally accountable for their company's actions, especially for the accuracy of their companies' financial statements and the effectiveness of their internal auditing. Indeed, CFOs and CEOs of publicly traded companies are nowadays very much aware of SOX and its impact on their firms, since even an honest but disengaged or naïve executive may face a career-ending and disgraceful fate. Also, the whistle-blower protections and prosecutions of lower-level managers too will make subordinates unlikely to remain silent or cover up any wrongdoings.

CEOs and CFOs have to certify financial reports quarterly, since Section 302 of SOX requires certification to the accuracy and fairness of the financial statements, and to the adequacy of the internal control framework around the financial statements. Officers, directors, and others are hereby prohibited from fraudulently misleading their auditors, while executives have to disgorge (give back) bonuses and profits after restatements due to misconduct. This point, however, can still cause conflicts with regulations in other countries. In Germany, for example, executive board members are currently not held personally responsible by law for their companies. While solutions to such conflicts are still yet to be found , some regional SOX variants have emerged, such as Japan's version of the law—"J-SOX" (see Checking It Twice).

Oversight Board Established

SOX implementations within public companies have been overseen by the Public Company Accounting Oversight Board (PCAOB), which consists of five full-time members that are appointed and overseen by SEC. Two of those five members must be or must have been certified public accountants (CPAs), while the remaining three must not be and cannot have been CPAs (so as to bring alternative perspectives). The board, which is funded by public companies via mandatory fees (while accounting firms that audit companies must register and pay fees too), is responsible for overseeing and investigating the audits and auditors of public companies, and has the authority to sanction both enterprises and individuals for violations. PCAOB is authorized to regularly inspect the operations of registered accounting firms, and also has international authority over foreign accounting firms that prepare or furnish audit reports involving US registrants.

The tricky thing is that while the PCAOB standard does not require a single form of report documentation per se, each company must still report and provide reasonable support that includes, according to Resources Global Professionals (the operating subsidiary of Resources Connection, Inc. [NASDAQ: RECN], a multinational professional services firm that helps business leaders execute internal initiatives), the following elements:

1. Design of controls over relevant financial statement assertions
2. Information about how significant transactions are initiated, recorded, processed, and reported
3. Sufficient information to identify where material misstatements due to error or fraud could occur
4. Identification of controls designed to prevent or detect fraud, including who performs them and the relegated segregation of duties (SODs)
5. Controls over period-end financial reporting processes
6. Controls over safeguarding of assets
7. Results of management's testing and evaluation

Process Manufacturing: Industry Specific Requirements Part Three: Textiles

Traditionally, manufacturing is categorized by two methods: process and discrete. Many differences exist, but most can be grouped into two areas: those derived from material issues and those derived from production issues.

Process materials are different than discrete materials. Process materials are powder, liquids or gases; they must be confined; and they are more difficult to accurately measure. Process materials are close to their natural sources (farms, mines, etc.) and therefore, are of inconsistent quality. Inconsistent quality means extensive quality procedures, segregation (lot control), restriction of use (this lot is okay for one customer but not another), and usually the inclusion quality attributes as part of their inventory definition. Process materials vary with time. They get better; they get worse; and they change their identity.

Production issues give us the simplest definition of process manufacturing. Specifically, once you produce your finished product, you cannot distill it back to its basic ingredients. Have you ever attempted to return orange juice back to its original water, sugar, sodium, and, of course, oranges or extract the pigments out of paint? Conversely, you can disassemble a car back to its tires, spark plugs, carburetor, and engine block. There are similar components in process and discrete manufacturing: ingredients versus parts; formulas versus bill of materials; several units of measure (i.e. pounds, ounces, and liters) versus EA (each).

There are, however, subtle differences. Process manufacturing is scalable. For example, if the formula calls for a 1,000 pounds of oranges but you only have 500 pounds, you can still make orange juice, just not as much. If you only have three tires, you are going to have wait for the fourth tire before the car can start rolling off the production line. In process, you tend make product in bulk or batches as in a vat of coke or a 500-gallon tank of solvent and then pack it off to fulfill customer orders. On the other hand, in discrete manufacturing you would expect to see one computer at a time coming down the production line.

For a quick refresher on process manufacturing, peruse the articles, Process Manufacturing: A Primer or What Makes Process Process.

The remainder of this article focuses on process manufacturing. However, to say process manufacturing functions are the same in all industries is tantamount to saying that a Ferrari and a Ford truck are simply means of getting from point A to point B. Just as you would not use a Ferrari to haul lumber, aspects of process manufacturing cannot be applied equally and with the same importance to all industries. This article looks at the unique requirements of process manufacturing in three industries: food and beverage, chemical, and a hybrid industry, textiles. One way or another, these requirements must be satisfied. If a software vendor can provide this satisfaction, your organization's anxiety level concerning the implementation of enterprise-wide systems can be significantly reduced.

If you are not in these industries, you can stop reading No, wait! Perhaps understanding how a particular requirement or aspect of process manufacturing relates to one of these industries may give you better understanding or insight on how it can be applied in your company. Whew! Thought that I had lost you! Glad you're back.

Editor's Note: For the purpose of this article, process and continuous-flow manufacturing are treated as synonymous. Continuous-flow manufacturing is the eradication of product stagnation in and between processes. Once a product has entered the manufacturing process, it moves on without having to be stored. Special considerations, such as one-piece-at-a-time production and multi-process handling for establishing a continuous-flow operation, will not be addressed in this article.

The textiles industry, which includes upholstery and carpeting, is a hybrid of process manufacturing. It is process insomuch that you cannot break a piece of upholstery or carpeting down to its basic, reusable components such as tow (a rope-like band of filaments), or flock (the finely minced filament that makes up the cloth of upholstery and carpeting). It resembles discrete manufacturing insofar as some of its ingredients are comparable to parts. Textile ingredients that resemble parts include the substrate and basis material that makes up the cheesecloth or mesh backing for the fabric, and core, the solid cylindrical tube upon which fabric can be wound.

The textile industry shares the catch weight concept with the food and beverage industry, but that is where the similarity ends. Of course, you need the total weight of the order to calculate the shipping charges. The invoiced price is calculated based on the actual weight of the fabric. The reason for this will become apparent later. Even though a roll of fabric can be up to 500 yards in length, what's the problem? Just get a bigger scale. However, the problem is that dispersed amongst the good yards of fabric can be imperfect yards due to discoloration, pattern runs, or color blotches. As you might imagine, customers will not want to pay for imperfect yards they cannot use. Since the width is usually an industry standard of sixty inches, we only need to capture the length of the fabric or linear yards. Accordingly, the first requirement of the enterprise-wide software is to record the actual useable linear yards. Let's assume that the software can accommodate the catch weight and this field can be used to record the actual useable linear yards. Problem solved? Not so fast, Sherlock.

We still need to convert the actual usable yards into a weight. This is simple arithmetic: multiply the number of linear yards by the weight of a linear yard (remember the width is a constant sixty inches). Case closed? Not so fast, Mycroft (Sherlock's literary brother). In textile, there is a term and a concept called denier. This is referred to as the tex system outside of the United States. Technically, denier is the weight-per-length measure of any linear material. Officially, it is the number of unit weights of 0.05 grams per 450-meter length. In layman's terms, it measures the thickness of the fabric. The logic flows something like this.

The higher the denier, the larger the fibers and the thicker the fabric.

* The thicker the fabric, the heavier the fabric.

* The heavier the fabric, the higher the weight.

* The higher the weight, the higher the cost of the product.

To be able to accurately calculate the weight of a roll of fabric, you need to know the specific weight per linear yard of the product being shipped and, because the denier varies by product, the software must capture the linear yard weight for each product. Typically, this would be recorded in the product database. To calculate the true catch weight, the software would have to retrieve the specific linear yard weight of the product and multiply this by the useable liner yards and then multiply this result by the cost per linear yard per weight. Algebraically, the invoiced price is represented by the following expression:


To support the textile industry, enterprise-wide software must have the capability of recording useable linear yards such as catch weight, which, together with the cost factor, is expected to be standard functionality. In addition, the software must be able to record the product specific weight by linear yard and perform the extension expressed above, which is non-standard functionality. There is not much "wiggle room" if the non-standard functionality cannot be accommodated since it is an accepted way of doing business in textiles. Accordingly, assurance must be made in advance of signing the contract that this requirement is known and understood by the software vendor and it can be satisfied.


A concern and ongoing production problem in the textile industry is the matter of second quality fabric. A second quality piece of fabric or second for short is off QC specification in terms of color, consistency, pattern design, or any combination of all three. However, due to the process manufacturing attributes of this hybrid industry, seconds cannot be returned to their original ingredients. We will discuss how seconds are dealt with in the next paragraph. Let's consider one real example of how difficult it can be to work in textiles and how seconds can be created. One method of creating a pattern on a piece of fabric is to permeate sections of the fabric with a chemical solution, where you do not want the pattern to appear. Unfortunately, this can turn the entire production run of the fabric black. It is not until the final washing cycle that the pattern is apparent and verified to be good or not. This process is definitely not for A-type personalities. Other problems can create seconds during the production run.

A critical need in the textile industry is the as-soon-as-possible notification as to when production yields will be less than forecasted. In doing so, the pipeline can be refilled so customer orders can still be met by the date promised. This type of notification and reporting is typically found in manufacturing execution systems (MES). It would be beneficial if these attributes of an MES application were incorporated in an enterprise-wide application. If not, a heavy, and most likely, impractical recording burden will be placed on the production line personnel. Reliance on this manual recording is not suggested.

Ordering of seconds is handled in an entirely different manner than the ordering of first quality goods. For example, a prospective buyer of seconds would be interested in fabric in all shades of green. Unless your product nomenclature is designed to include this attribute and the software supports it, locating seconds will be extremely difficult. The problem is that this is not normally how you define first quality goods. Consequently, the software must be flexible to support both ordering approaches without making warehouse personnel perform transfers and reclassifications.

QC specifications play a rather unique role in the textile industry. Typically, the key QC test is based on visual inspection in terms of shade and coloring. This is important because customers will underestimate their order of fabric or create too much waste, requiring a re-order. It is essential that the re-order of the fabric be as close as possible in shade and color as the original order. Think about it. You have just completed upholstering the couch and run out of fabric for the matching chair. As a furniture-buying consumer, would you purchase a matching couch and chair where the color was even degree off?



Process Manufacturing: Industry Specific Requirements Part Two: Chemical

Traditionally, manufacturing is categorized by two methods: process and discrete. Many differences exist, but most can be grouped into two areas: those derived from material issues and those derived from production issues.

Process materials are different than discrete materials. Process materials are powder, liquids or gases; they must be confined, and they are more difficult to accurately measure. Process materials are close to their natural sources (farms, mines, etc.) and, therefore, are of inconsistent quality. Inconsistent quality means extensive quality procedures, segregation (lot control), restriction of use (for example, this lot is okay for one customer but not another), and usually the inclusion of quality attributes as part of their inventory definition. Process materials vary with time. They get better, they get worse, and they change their identity.

Production issues give us the simplest definition of process manufacturing. Specifically, once you produce your finished product, you cannot distill it back to its basic ingredients. Have you ever attempted to return orange juice back to its original water, sugar, sodium, and, of course, oranges or extract the pigments out of paint? However, you can disassemble a car back to its tires, spark plugs, carburetor, and engine block. There are similar components in process and discrete manufacturing: ingredients versus parts; formulas versus bill of materials; several units of measure (i.e., pounds, ounces, and liters) versus EA (each).

There are, however, subtle differences. Process manufacturing is scalable. For example, if the formula calls for a 1,000 pounds of oranges but you only have 500 pounds, you can still make orange juice, just not as much. If you only have three tires, you are going to have wait for the fourth tire before the car can start rolling off the production line. In process, you tend make product in bulk or batches as in a vat of coke or a 500-gallon tanks of solvent and then pack it off to fulfill customer orders. On the other hand, in discrete manufacturing you would expect to see one computer at a time coming down the production line.

For a quick refresher on process manufacturing, peruse the articles, Process Manufacturing: A Primer or What Makes Process Process.

The remainder of this article focuses on process manufacturing. However, to say process manufacturing functions are the same in all industries is tantamount to saying that a Ferrari and a Ford truck are simply means of getting from point A to point B. Just as you would not use a Ferrari to haul lumber, aspects of process manufacturing cannot be applied equally and with the same importance to all industries. This article looks at the unique requirements of process manufacturing in three industries: food and beverage, chemical, and a hybrid industry, textiles. One way or another, these requirements must be satisfied. If a software vendor can provide this satisfaction, your organization's anxiety level concerning the implementation of enterprise-wide systems can be significantly reduced.

If you are not in these industries, you can stop reading � No, wait! Perhaps understanding how a particular requirement or aspect of process manufacturing relates to one of these industries may give you better understanding or insight on how it can be applied in your company. Whew! Thought that I had lost you! Glad you're back.

Editor's Note: For the purpose of this article, process and continuous-flow manufacturing are treated as synonymous. Continuous-flow manufacturing is the eradication of product stagnation in and between processes. Once a product has entered the manufacturing process, it moves on without having to be stored. Special considerations, such as one-piece-at-a-time production and multi-process handling for establishing a continuous-flow operation, will not be addressed in this article.

A new wrinkle that has been added to process manufacturing by the chemical industry is the introduction of hazardous material. As you would expect, the use of hazardous materials is closely regulated and must be reported. This creates two conditions that can be greatly simplified by software. First, when creating a new formula or modifying an existing one, the formula must be analyzed for the presence of hazardous materials. This check requires a continuously updated and current list of regulated materials that are considered hazardous. Also required is the percentage of these materials relative to the other ingredients.

Secondly, the reporting of hazardous materials must comply with a specific format, namely material safety data sheets (MSDS). These sheets will usually accompany the customer's bill of lading (BOL) and, therefore, must be integrated with the billing process. While copies of MSDS can be kept on file and manually matched with the BOL, most companies will not want to risk non-compliance and would rather seek an automated remedy. Likewise, companies who like to "live on the edge" will rely on manual procedures to determine when a formula and product requires an updated MSDS. More prudent companies, however, will seek to have update notification incorporated in their enterprise-wide software and automatically generated new MSDS when needed.

The programming of hazardous material compliance is not trivial when you consider that it involves list processing and matching, percent of total analysis, scheduling, and formatting. While there are bolt-on solutions because of the required tight integration, it is hard to argue against an enterprise-wide software solution that includes this functionality straight out of the box. Depending on how important formula analysis and MSDS reporting are to your organization, the inclusion of this functionality in a vendor's software offering could be a deal breaker or, at the very least, a tie breaker.

In many chemical companies, but particularly in specialty chemical companies, every order represents a new product. For example, tweak an existing formula or replace this chemical ingredient with that chemical ingredient. This places three demands on the functioning of the software. First, since the resulting chemical is being produced for the first time, a quote would normally be required. As a consequent, the software needs to have the ability to easily convert prospective quotes into firm orders and trigger an event in the production schedule.

Secondly, since new formulas will be needed, the maintenance and management of formulas need to be streamlined and responsive to customer inquiries, possibly while the customer is still on the phone. Templating would be a useful tool in this regard. You start with an existing formula as a template for the new formula and make ingredient changes as warranted. Finally, to compliment the templating concept, and because many chemical properties are interchangeable, a suggested ingredient substitution would facilitate the production process. Automated or suggestive ingredient substitution could allow your company to fulfill customer orders that otherwise have to be abandoned or, at best, delayed.

Producing chemicals typically involves all of the three common states of ingredients, namely solids, liquids, and gases. From a formula and mixing perspective, this necessitates a very robust unit of measure (UOM) conversion engine. Whether the formula requires conversion of US measurements to metric or imperial measurements, liquids to solids, or gases to liquids, such conversions should be transparent to the production of the finished goods. Furthermore, depending on the unique requirements of your company, software that allows the entry of free form conversion tables can be extremely useful.

Process Manufacturing: Industry Specific Requirements Part One: Introduction

Traditionally, manufacturing is categorized by two methods: process and discrete. Many differences exist, but most can be grouped into two areas: those derived from material issues and those derived from production issues.

Process materials are different than discrete materials. Process materials are powder, liquids or gases; they must be confined; and they are more difficult to accurately measure. Process materials are close to their natural sources (farms, mines, etc.) and therefore, are of inconsistent quality. Inconsistent quality means extensive quality procedures, segregation (lot control), restriction of use (this lot is okay for one customer but not another), and usually the inclusion quality attributes as part of their inventory definition. Process materials vary with time. They get better, they get worse, and they change their identity.

Production issues give us the simplest definition of process manufacturing. Specifically, once you produce your finished product, you cannot distill it back to its basic ingredients. Have you ever attempted to return orange juice back to its original water, sugar, sodium, and, of course, oranges or extract the pigments out of paint? Conversely, you can disassemble a car back to its tires, spark plugs, carburetor, and engine block. There are similar components in process and discrete manufacturing such as ingredients versus parts; formulas versus bill of materials; several units of measure (i.e., pounds, ounces, and liters) versus EA (each).

There are, however, subtle differences. Process manufacturing is scalable. For example, if the formula calls for a 1,000 pounds of oranges but you only have 500 pounds, you can still make orange juice; just not as much. If you only have three tires, you are going to have wait for the fourth tire before the car can start rolling off the production line. In process, you tend make product in bulk or batches as in a vat of coke or a 500-gallon tanks of solvent and then pack it off to fulfill customer orders. On the other hand, in discrete manufacturing you would expect to see one computer at a time coming down the production line.

For a quick refresher on process manufacturing, peruse the articles, Process Manufacturing: A Primer or What Makes Process Process.

The remainder of this article focuses on process manufacturing. However, to say process manufacturing functions are the same in all industries is tantamount to saying that a Ferrari and a Ford truck are simply means of getting from point A to point B. Just as you would not use a Ferrari to haul lumber, aspects of process manufacturing cannot be applied equally and with the same importance to all industries. This article looks at the unique requirements of process manufacturing in three industries: food and beverage, chemical, and a hybrid industry, textiles. One way or another, these requirements must be satisfied. If a software vendor can provide this satisfaction, your organization's anxiety level concerning the implementation of enterprise-wide systems can be significantly reduced.

If you are not in these industries, you can stop reading. No, wait! Perhaps, by understanding how a particular requirement or aspect of process manufacturing relates to one of these industries you may get a better understanding or insight on how it can be applied in your company. Whew! Thought that I had lost you! Glad you're back.

As you might expect, any industry that affects the health and welfare of the human race is bound to have special needs and requirements. With the incidents of Mad Cow Disease and the sudden and seemingly continuous preoccupation with the Atkins Diet, the most insignificant requirement for the food and beverage (F&B) industry is in the area of quality control (QC). While your customers may have their own special quality requirements, first and foremost, conformance must be established and verified with external agencies, such as (in the US) the Food and Drug Administration (FDA) and Bureau of Alcohol, Tobacco and Firearms (ATF) or your product will never reach the market. Consequently, integration with these external sources and frequent changes would be a critical element of the QC function. As you go further back into the supply chain process, the QC function must extend and usually starts with the supplier. Regardless, as the producer of a finished product, the responsibility for quality is joint and several which gives little allowance as to where the defect occurred in the supply chain. Look for software that seamlessly integrates with external agencies regulating your particular segment of the F&B industry.

Of special note is the US Bio-terrorism Act of 2002. This act places a series of new requirements on F&B companies. Most, including the authors, think that compliance with the Bio-terrorism Act is not possible without computerization of both the production process and the supply chain.

Once the regulated and external requirements are satisfied, there are customer and ingredients-related QC specifications that must be addressed. If your company is producing a finished product that is an ingredient into your customer's product, additional QC compliance is typically required. This could be for nutritional or ethnic considerations. Consequently, the setup of the QC function within the software must be flexible and adaptable.

The accurate statement of the QC specifications for the ingredients can also come into play. Going back to the orange juice example, the acidity of the oranges determines the amount of other ingredients (sugar, water, etc.) that may have to be adjusted to counteract the pH level. The pH level, recorded in the QC process, will therefore impact the product's specifications but, equally important, effect the "on the fly," one-time formula modification. Other QC-related requirements, that should be self-explanatory, include

* Nutritional reporting and labeling
* Taste QC specifications
* Color consistency QC specifications
* Shelf life longevity and reporting

Having worked in the food processing industry, the most terrifying words that you can hear on a Friday afternoon are, "This hamburger or soda tastes funny!" Your weekend, and possibly your livelihood, could be ruined and until you can dispel or confirm the damaging insinuation, an F&B organization is living in anticipatory paralysis. The fear stems from the negative financial impact on the company's image and customer base. Consequently, product recallability is an essential.

The Bio-terrorism Act of 2002 spells out detailed requirements which are often referred to as "one up and one down" tracking. This act also calls for the appropriate records within four hours from the receipt of a request from the FDA. Furthermore, recallability implies isolating and locating the defective product to an absolute minimum with dead-on certainty. To achieve this objective, "bullet proof" lot and sublot tracking is needed. This is easier said than done and can be an extremely time consuming process. However, certain attributes of lot/sublot tracking in the software can expedite the recording and tracking functions and help to eliminate damaging fallout.

First, there is lot to sublot inheritance. This means that characteristics of a lot are transferred automatically to the sublots contained within the lot. In so doing, the characteristics of bulk quantities of meat or oranges, for example, used to make hamburger patties or juice, respectively, are retained or inherited by the boxes and crates of the finished product. As a result, the recording of sublots places less hardship on the production line personnel and is less prone to recording mistakes or errors of omission.

Secondly, lot tracking should follow the product through any re-work processes. Even with undergoing a re-working process, the original lot and sublot characteristics should not be lost unless the re-work makes these characteristics meaningless.

Finally, lot and sublot tracking must be able to remain intact until the product arrives at the customer's location. This is the only way a complete recall can be accomplished and the questionable product returned to the manufacturers. Software gaps, preventing any one of these three requirements from being satisfied, brings the entire recall process into question and would require significant custom coding or administrative procedures to be filled.

There are several additional operational issues that any self-respecting F&B software should be able to address. In addition to accommodating picking strategies such as LIFO (last in first out), FIFO (first in, first out), and FEFO (first expire, first out) the software must account for the perishability of the ingredients as well as the finished product. Consequently, taking into account the expiration date is key when determining picking priorities.. Some customers also demand strict rotation where the supplier can never ship product that is older than the last shipment.

For some manufacturers, private labels represent a significant segment of a F&B production run. Using the private label concept, large supermarkets utilize the value of name recognition to provide products under their own label like Safeway, Albertson's, Royal Ahold, and Tesco. Because of the large quantities required by these customers, manufacturers usually cannot wait until the order is on hand to start up the production line. Alternately, if the raw ingredient is only available in season (vegetables in August for example), the entire year's demand must be processed in a limited time period. Accordingly, a food processor will create unlabelled products. Labeling will only be completed after the sales order is received and confirmed.

Because of their extended shelf life, cooked, canned goods lend themselves well to this type of production. Sealed aluminum cans remain on an inventory shelf for up to twelve months while waiting for labeling. Hence, the terms, "brite stock" or "shiny stock" were created to refer to this type of stock. To be able to accommodate requirements lot and sublot tracking must extend and be maintained within the brite stock. Also, the manufacturing process must be able to be separated into two stand alone, independent processing runs. One would be for the production run to make the brite stock and a second, a packaging run to label and ship the product.

Catch weight or random weight is a common, and non-negotiable requirement for some food categories, particularly with meats. While meat and poultry products may be advertised for $50 a box, tin, or drum, the invoiced price is based on the actual, not estimated or expected weight of the product. Accordingly, not only does the software have to track the total weight, including packaging weight, to calculate shipping charges, it must also track the catch weight for pricing. While the concept may be simple to comprehend, its application may not that easy. However, this is an industry practice that cannot be ignored in some categories; it is the way business is done.

Some food companies are in the "disassemble" business. These companies grow or acquire one raw material and make many products from this single raw material. For example, a chicken processor may buy live chickens to make many different parts. An apple processor buys many different grades and sizes of apples, sorts them, and processes them into many different products. In contrast, discrete companies buy many different parts to make one end item and the bill of material was designed for this purpose. In process manufacturing, when one raw material is made into many end-items, a formula or recipe (process's equivalent to the discrete bill of material) is being asked to do something for which it was not designed. Consequently, a formula must have the flexibility and tensile strength to be changed rapidly and still conform the existing resources and routings on the plant floor. For example, it may be a "game time" decision on how to process a batch of apples to maximize the product yield. The software must be able to accommodate these changes through formula and routing modifications and still stay within the constraints of the plant floor. Of course, we want to maintain the integrity of the original formula and routing.

Other aspects of the F&B industry that you must be aware of are:

* Flexible packaging alternatives (i.e. consider the different ways you can purchase soda).

* Re-pack functionality (i.e. don't have soda in 1 liter bottles but can re-pack 55-gallon drums).

* Bulk storage using tanks and silos and the need to maintain, record, and track temperature and spoilage attributes.

* Special needs of fresh, chilled, and frozen ingredients and products.

* Container management for beverages.



The Challenges of Defining and Managing Governance, Risk Management, and Compliance

* Organizational fragmentation caused by disconnected, department-driven GRC activities customarily results in inconsistent policies, difficulty in predicting risk, a lack of enterprise transparency, and duplication of effort. As enterprises increase collaboration with trading partners, the consequences of having no central body coordinating GRC activities enterprise-wide intensify because most legislation holds them accountable for good governance and compliance within their own organization, as well as across the extended enterprise (supply chain).

* Most businesses lack GRC information integrity because their departments use different metrics, standards, software, and methodologies for analyzing risk and compliance information. This system fragmentation makes it difficult to aggregate data; gain a complete view of enterprise-wide risks; effectively monitor these risks and compliance; and adjust business processes to meet changing requirements, market trends, and regulatory mandates.

* Policies and risks are generally defined and measured at the local geographic level, without proper consideration for their impact on the global, multinational, national, or regional mandates with which an organization must also comply. Decision makers are often unaware of the interdependencies between mandates and the risks of noncompliance in specific regions and markets, whereby one region's risk might be another one's opportunity.

* Internal GRC discipline fragmentation is also an issue, since at the corporate level, as well as the departmental or regional levels, there is general uncertainty around the meaning and scope of the disciplines of GRC. Most important, the management team may not recognize that these disciplines are inextricably linked and interdependent, and as a result, must function interdependently instead of as part of an integrated strategy.

To be successful, companies have to align their corporate strategies with more effective oversight and institutionalized policy setting, risk management, and business process control. The only way to accomplish this goal is through an overall approach to GRC that unifies the above fragmented areas. Only then can a company hope to capture new information about emerging threats and opportunities, and exploit them for competitive advantage.

According to AMR Research, approximately two-thirds of compliance cost is attributable to people. This is because fragmented GRC efforts tend to result in "people-powered GRC" (or inefficient, manual processes that are duplicated across departments). Of even greater significance might be the lost opportunities that result from a tactical, fragmented approach to managing GRC. Without a comprehensive and cohesive GRC strategy, companies are deprived of a means to effectively navigate today's highly regulated (and ever-changing) business environments, as well as of a critical driver of revenue and competitive advantage.

Therefore, a multiplicity of government regulations, growing pressure from financial markets, and increasing demands from stakeholders have renewed the focus on GRC. Some forward-thinking organizations no longer see GRC as discrete, project-based activities managed as separate functions. Rather, they are adopting an overarching GRC strategy that guides people, standardizes processes, and unifies technology to embed GRC at every organizational level. That is to say, in the face of shifting industry conditions, compliance mandates, and governance requirements, companies need to take a broader, more structured approach to managing GRC to proactively identify and forecast inefficiencies and errors, adopt a risk-based approach toward embedding controls in business processes, and continuously monitor operations to optimize and guide future policy (see SAP Solutions for Governance, Risk, and Compliance).

To manage information technology (IT) and business risks at all levels of the organization, GRC's integrated solutions must be capable of monitoring business processes and IT controls automatically. Not only should an integrated approach offer top executives an actionable dashboard showing a more complete and more accurate risk profile of the company, but it should also detect high-risk events, and prioritize risk responses and corrective or, even better, preventive action.

This is the final part of a series on how various industries address compliance issues. For more information, please see previous parts of this series: Thou Shalt Comply (and More, or Else): Looking at Sarbanes-Oxley, Important Sarbanes-Oxley Act Mandates and What They Mean for Supply Chain Management, Sarbanes-Oxley Act May Be Just the Tip of a Compliance Iceberg, Automotive Industry and Food, Safety, and Drug Regulations, "Evergreen"—Environmental Regulations for High-tech and Electronics, Chemical, and Oil and Gas Industries, and Global Trade and the Role of Governance, Risk Management, and Compliance Software.

GRC Defined, Starting with the Central Repository

Delving deeper into the individual GRC components, governance entails the oversight role, with the idea of setting strategic objectives the company wants to pursue, and then managing these. To that end, governance typically relies on a repository to centrally manage all GRC content, guide governance strategies, and improve business performance.

Such a repository should centrally document and store records to streamline and manage GRC content, including control frameworks; corporate policies and procedures; regulations; industry mandates; business process flows; risk libraries; control libraries; test plans; evidence for compliance; etc (see SAP Solutions for Governance, Risk, and Compliance). In other words, the central repository should enable consistent, effective, and efficient coverage of regulatory content (that is, frameworks, laws, internal company policies, etc.) by providing visibility into related requirements. Companies can then cross-reference their organizational policies and procedures with regulatory requirements to ensure compliance.

The key to a central repository is in centralizing and managing GRC content from multiple sources, and in its ability to model business processes and document associated objectives, risks, and control activities. Also important is the library of configurable business rules, business process controls, and IT controls to ensure proper segregation-of-duties (SOD), business process controls, and environmental and global trade compliance.

By harnessing a well-populated GRC repository, companies should benefit from enterprise-wide visibility into all GRC activities. This visibility should allow companies to analyze risk, make more informed decisions, and take a risk-based approach to satisfying multiple company initiatives and regulatory mandates (see SAP Solutions for Governance, Risk, and Compliance).

In addition, users should be able to link these risks and controls to multiple security and control frameworks, such as the Committee of Sponsoring Organizations (COSO), the IT Infrastructure Library (ITIL), or the Control Objectives for Information and Related Technologies (COBIT), and to US mandates like the Sarbanes-Oxley Act (SOX) and the Food and Drug Administration (FDA) regulations. The repository often also enables adherence to official product classification schemas such as the US Harmonized Tariff Schedule (HTS) and the Export Control Classification Number (ECCN), which is issued by the Bureau of Industry and Security (BIS) for shipments that require an export license.

To illustrate the transformative power of a central GRC repository, consider all the necessary SOD needs defined within all pertinent compliance solutions. These SODs would then include access and authorization control applications that are integrated with the GRC repository application. This way, all of an organization's policies, initiatives, and regulations that require proper SODs (or, alternatively, that need appropriate definition and assignment of compensating controls) would be automatically documented within the GRC repository, complete with links to the appropriate access controls for automated monitoring. By doing so, the enterprises should be able to take advantage of opportunities that they might not have noticed before to improve efficiency and transparency, optimize risk-and-return portfolios, and increase business predictability by rationalizing controls and risk responses across the enterprise.

… Which (Ideally) Manages All Conceivable Risks

Risk management applications provide frameworks for identification of risk; analysis of potential impacts and appropriate responses; and the monitoring of mitigating actions and reporting—all in a structured manner. When implemented holistically, more effective risk management practices should be able to improve decision making and create significant value throughout the enterprise.

But too often, actual risk management practices are reactive, theoretical tasks performed in departmental silos, and these practices overlook critical interactions between risks. At the same time, because risk management is often regarded as a theoretical exercise with no practical methodology, organizations are not equipped to recognize critical risks; to analyze risk-reward trade-offs; and to respond appropriately based on quantitative cost and benefit analysis metrics. The idea is thus to deploy appropriate risk management applications, and implement proactive, collaborative processes throughout the entire enterprise. Such applications will enable companies to balance new business opportunities with financial, legal, and operational risks.

A full-fledged risk management application suite should provide a best-practice framework for enterprise risk identification, collaborative risk analysis, risk-response management, and continuous risk monitoring and reporting. Such an application suite should help users to effectively anticipate and respond to changing business conditions. The applications should also ideally include executive-level, personalized dashboards, scorecards, and reports that provide users with visibility into key risk metrics and policy compliance (see SAP Solutions for Governance, Risk, and Compliance: SAP GRC Risk Management).

The aim is for users to be able to monitor the overall risk portfolio, including cohesive, global profiles of operational and entity-level risks ("heat maps"), and then to analyze risk in terms of severity and impact on a monetary and qualitative basis (see SAP Solutions for Governance, Risk, and Compliance: SAP GRC Risk Management). Furthermore, users should be able to balance the costs of risk avoidance against new business opportunities. They should also be able to alert management when high-impact and high-probability risks exceed company-specific thresholds, and to prioritize corrective action using role-based dashboards and alerts.

… To Ensure Compliance at the End of the Day

Last but not least, compliance entails the actual, tactical actions to mitigate risk. In other words, compliance is the execution of these objectives based on established risk tolerance for the company. Namely, as mentioned previously, some regulations are not mandatory, but recommended. For instance, the FDA regulations for drug manufacturers are not fixed targets. Thus, compliance is a key objective for any regulated drug manufacturing company, but the requirements to meet compliance are subjective based upon product, production processes, and (perhaps most important) every company's tolerance for risk. Regulatory risk is the risk of being found out of compliance, and if a company accepts very limited risk, its cost of compliance will logically be high. Conversely, with more risk allowed, compliance cost is reduced, but the potential cost of noncompliance increases.

The core of compliance revolves around proper access and authorization controls, since such applications aim at reducing control risk in enterprise applications by enforcing proper SODs. The applications then manage enterprise roles and the compliant provisioning of users, and grant audited emergency access for super-users. One should allow super-users privileged but controlled access so they can quickly address emergency requirements or help mitigate situations where SODs cannot be accomplished.

As indicated earlier, two critical pieces of the GRC puzzle are proper separation of tasks and access control over key information assets, which are the most effective safeguards against fraud—and prerequisites for sound corporate oversight. These are also the most arduous controls to deploy and sustain, given the thousands of users, roles, and processes that require access and authorization evaluation for violations, testing, and remediation.

The immense task of managing user and role access can only be accomplished when business-process owners (who can determine appropriate access in business terms) and IT experts (who can define the underlying technical objects that make up business functions) work together in an environment that bridges business processes, IT capabilities, and the plethora of enterprise applications used in the organization. That is to say, a company needs a bridge that links business language with IT capabilities. To achieve this link, a comprehensive set of access control applications is needed that will enable all corporate compliance stakeholders (including business managers, auditors, and IT security managers) to collaboratively manage proper SOD enforcement.

Global Trade and the Role of Governance, Risk Management, and Compliance Software

To conduct business globally, logically companies need to comply with local laws, satisfy trade security measures, meet documentation requirements, understand complicated tariffs, and coordinate various parties. Handling these tasks manually increases the risk of failure, which can be costly when trading across borders. In fact, according to a United Nations (UN) study, the inefficient administration of customs processes accounts for 7 percent of the cost of international trade, or more precisely—$420 billion (USD) annually.

The fast-paced nature of international trade means there cannot be any delays in moving product from point to point. Due to the greater threat of terrorism and other factors, governments have tightened rules on the import and export of certain goods across borders. A number of these governments have created lists of parties restricted from engaging in international trade (see Infor Accelerates Import/Export Of Goods Through International Supply Chain In Accordance With Government Recommendations).

Again, a well-attuned global trade management (GTM) application suite is often needed so that companies can master the manifold challenges of international trade. Such an application could enable companies to automate and streamline complex import and export processes; ensure regulatory compliance; expedite customs clearance; mitigate the financial risk of global transactions; and take full advantage of international trade agreements.

In fact, these tools (preferably unicode-enabled) should help user enterprises manage and standardize trade compliance processes throughout the entire organization. The software should automatically screen business partners against official sanctioned party lists, check for embargo restrictions, and manage export and import licenses. Further, GTM applications should expedite customs processes by facilitating interactions between the user enterprise and customs agencies, driving more efficient movement of goods and information across international borders. Last but not least, the software should also let users tap into the opportunities available through trade agreements, such as the North American Free Trade Agreement (NAFTA) and those of the European Union (EU). In addition, the software should automate and streamline all aspects of restitution management to ensure more efficient export refund processing, and to lessen the risk of forfeiting securities.

Potential benefits of harnessing GTM tools include a better design of business controls and more effective operations by focusing skilled resources on activities that require expertise and judgment. Also, companies could reduce cost and increase assurance by shifting from point-in-time testing to continuous controls monitoring, thereby evaluating and prioritizing response to highest impact control violation risk. Again, as with handling environment, health, and safety (EH&S), a composite application is typically needed to help enterprises establish a single, corporate-wide standard for trade processes across disparate enterprise systems. Such would be SAP's Global Trade Services (SAP GTS) composite application (see GTM Solutions—Always Watch Out for SAP), which has been allowing user enterprises to

* ensure regulatory trade compliance (thus avoiding costly fines and penalties, and helping to ensure national security);
* expedite customs clearance and reduce delays at national borders (thereby reducing cycle times and enabling faster deliver to customers);
* automate customs warehousing procedures (thereby deferring or eliminating duty payments);
* accelerate and optimize product classification (thus increasing efficiency and minimizing import duties);
* mitigate the financial risk of global transactions (by ensuring that all parties concerned meet their contractual obligations); and
* take advantage of international trade agreements (that is, not merely surviving, but rather thriving in today's fiercely contested global markets).


Traditional enterprise resource planning (ERP) vendors have lately tuned into the need for GTM, as seen in QAD's recent acquisition of Precision Software and Oracle's acquisition of G-Log. Further, in late 2006, Infor began providing importers, exporters, and manufacturers a more secure supply chain with the availability of Infor Restricted Party Screening. This solution enables companies to quickly and accurately identify parties subject to government regulations, thereby speeding up the delivery of international goods through US borders. The product is a real-time, Web-based supply chain solution that automatically updates the daily changes to the government party lists; notifies the user of possible supplier issues; provides a complete audit and history of shipment screening; and enables the batch screening of customer lists, employees, suppliers, and vendors (see Infor Accelerates Import/Export Of Goods Through International Supply Chain In Accordance With Government Recommendations).

Customers using Restricted Party Screening are able to demonstrate to governments that they maintain a secure supply chain, and are therefore eligible for such programs as Customs-Trade Partnership Against Terrorism (C-TPAT), which expedites border clearance. C-TPAT is a joint US government-business initiative to build cooperative relationships in order to strengthen supply chain and border security. As a part of this, US Customs requests that businesses ensure the integrity of their security practices and communicate their security guidelines to their partners within the supply chain (see Infor Accelerates Import/Export Of Goods Through International Supply Chain In Accordance With Government Recommendations). C-TPAT is based on the idea that achieving the highest levels of security requires cooperation between the US government and supply chain participants such as importers, carriers, brokers, warehouse operators, and manufacturers.

Infor Restricted Party Screening supports multiple lists published by the US, Canada, the United Kingdom (UK), and Japan, as well as the UN. The solution is available as a stand-alone, or it can be embedded within Infor Transportation Management. Infor Transportation Management is a solution that provides global visibility into inbound and outbound supply chains as part of the Infor Supply Chain Management suite (see Infor Accelerates Import/Export Of Goods Through International Supply Chain In Accordance With Government Recommendations), which was lately bolstered by the acquisition of SSA Global (see SSA Global Forms a Strategic Unit with an Extended-ERP Savvy).

This is a continuation of a series discussing how various industries are addressing compliance issues. For more information, please see previous parts of this series: Thou Shalt Comply (and More, or Else): Looking at Sarbanes-Oxley, Important Sarbanes-Oxley Act Mandates and What They Mean for Supply Chain Management, Sarbanes-Oxley Act May Be Just the Tip of a Compliance Iceberg, Automotive Industry and Food, Safety, and Drug Regulations, and "Evergreen"—Environmental Regulations for High-tech and Electronics, Chemical, and Oil and Gas Industries.

Global Trade—Perplexing and Scary! Now What?

Given the overwhelming, acronyms-laden regulatory alphabet soup, any business, but especially a small-to-medium business (SMB), today faces a daunting task. It is seemingly no longer enough for a company to develop a strong business plan, have a breakthrough product or service that provides a competitive edge in the marketplace, and build strong and effective distribution channels to have all of the prerequisites of success.

The complexities of today's business world have created new risks, a heap of regulations, and complex reporting requirements that can overpower a lean and focused organization, regardless of its size. But, as stated earlier, compliance should be about more than just meeting the letter of the law. Rather, it should be about ensuring transparency, mitigating risk, maintaining customer confidence, and enabling profitable growth. In fact, it should be about parlaying these must-haves into becoming a better (leaner) operation. It becomes apparent that effective overall and continuous governance, risk management, and compliance (GRC) requires a coherent ecosystem of solutions that form a platform that can be leveraged across multiple initiatives, such as to

* prioritize and balance core compliance objectives within business and budgetary constraints;
* preserve critical internal controls as the enterprise systems upgrade or add new solutions to the current information technology (IT) landscape;
* prepare the business and enterprise systems for internal and external audits;
* standardize, communicate, and enforce compliance initiatives across the entire business;
* avoid segregation of duties (SOD) conflicts (by instituting key controls within the underlying enterprise system), and to protect sensitive data with the right security and authorization techniques;
* continuously monitor, test, and document the efficacy of internal controls, and to validate and reconcile data for compliant reporting;
* tighten critical business processes and close gaps that could jeopardize compliance with the US Sarbanes-Oxley Act (SOX), Occupational Safety and Health Administration (OSHA), Food and Drug Administration (FDA), and other regulations; and
* comply with both domestic and international financial and customs regulations, such as Basel II and International Financial Reporting Standards (IFRS).

See SAP Insider Conference for Governance, Risk and Compliance (GRC) 2007.

Therefore, rather than merely complying with the mushrooming legal and regulatory requirements in a firefighting, knee-jerk, or disjointed manner from bottom up, enterprises are increasingly realizing that a holistic approach from top down is necessary. By harnessing the emerging, strategic software category of GRC, enterprises will be better able to deal with the myriad of compliance issues that are today's business reality.

A unified GRC approach should enable commercial companies and government businesses alike to establish integrated frameworks of centrally managed GRC processes and information. Such an approach should enhance businesses' abilities to identify and collaboratively analyze risks detected at multiple levels and regional locations of their organizations.

Yet, when it comes to compliance, most companies still largely respond in banal ways. However, initial alarms and knee-jerk corrective actions gradually cede to rational thinking, more coherent work plans, and eventually, remediation activities that are based on acceptable levels of business risk. For an honorable minority that operates in an atmosphere of compliance (that is, not approaching control and compliance in reaction to external regulations, but rather in the context of a disciplined approach) and corporate governance, these environments start straight with thought-out work plans, and they treat such efforts as part of everyday work.

Parlaying Regulatory Nuisance into Competitive Advantage?

This question and its answer are analogous to our own lives. While we can survive without eating healthy food or exercising, chances are we might live much longer, and without health risks and a need for medical remedies, by wholeheartedly embracing these best practices of living. The same holds true for compliance. Even if an enterprise does not necessarily have to comply with the likes of SOX, Financial Accounting Standards Board (FASB), Anti-Money-Laundering (AML) and the Bank Secrecy Act (BSA), or the Know-Your-Customer section of the USA Patriot Act initiatives, it is likely that following the practices that these laws dictate as a matter of course (rather than regarding them as nuisances) will lead to better intrinsic controls, and hence smoother and more risk-free operations.

As an example, the FDA is permitting manufacturers to benefit from emerging technologies to streamline record keeping and compliance. This technology can increase the usability of the information gathered by integrating both business processes and audit functions without compromising the quality of regulatory compliance. Thus, the opportunity to improve business practices can be significant. Potential benefits may include the following: lowered cost of data collection; increased accuracy of data; increased data analysis capabilities; reduction of regulatory errors (for example, by eliminating wrong filings); improved control over production, quality, and other processes; quicker search and retrieval of electronic records; improved information transfer between departments (for example, between operations and quality); improved information transfer between companies (for example, between an external research organization and its sponsoring enterprise); improved product recalls record, etc (see The Bio-terrorism Act of 2002 Update and Compliance Issues for the Small to Mid-sized Food Industry).

Needless to say, the improved business practices can also lower an enterprise's long-term cost of compliance. Specifically, the cost of noncompliance can be defined as the cost that would be incurred if a company were found to be out of compliance, factored by the risk of being found out of compliance. The cost of noncompliance can include additional inspections, lost production, non-sellable product, product recalls, plant shutdowns, fines, or even the incarceration of executives (see FDA Compliance For The Life Sciences).

As another example, implementing and ensuring compliance with employee safety guidelines, monitoring emissions (which are often delineated by regulatory permits), and even validating the origin and composition of chemical products are all mission-critical processes that contribute to the cost of doing business. In other words, as explained in So, What's the Big Deal with Chemicals?, a new complexity that comes from some process industries is the introduction of hazardous materials and dangerous goods that are closely regulated and must be reported, which creates two conditions that can be greatly simplified by software.

First, when creating a new formula or modifying an existing one, the formula must be analyzed for the presence of hazardous materials. This check requires a continuously updated and current list of regulated materials that are considered hazardous. Also required is the percentage of these materials relative to the other ingredients.

Second, the reporting of hazardous materials must comply with a specific format, namely material safety data sheets (MSDS). These sheets will usually accompany the customer's bill of lading (BOL), and must therefore be integrated with the billing process. While copies of MSDS can be kept on file and manually matched with the BOL, most companies will not want to risk noncompliance, and would rather seek an automated remedy.

However, companies that prefer to "live on the edge" (chance being less meticulous in their approaches to compliance) will rely on manual procedures to determine when a formula and product requires an updated MSDS. More prudent companies, on the other hand, will seek to have update notifications incorporated into their enterprise-wide software, and to have new MSDS automatically generated when needed. The programming of hazardous material compliance is not trivial when one considers that it involves list processing and matching, percent of total analysis, scheduling, and formatting.

Possibly an extreme example of companies turning regulation and GRC into opportunities (growth and hefty profits) would be the recently publicized corporate social responsibility (CSR) programs, with companies like Starbucks, Salesforce.com, Google, or Polo Ralph Lauren posting tremendous growth and profits while being impressively philanthropic. The CSR programs of these businesses have included helping coffee farmers sustain their farms and meet quality standards; environmental initiatives to reduce waste and preserve the earth's natural resources; giving free software to nonprofit organizations; building centers for cancer care and prevention; supporting volunteerism among employees; removing fur from its fashion collections; educational outreach; and monitoring of the global supply base for adherence to fair labor practices (see Sirkisoon, Hagerty, and Carter's 2006 article The 21st Century Business: Contribute to Society and Profit).

Certainly, these companies benefited from strengthened corporate brand and reputation, increased business opportunities (including investment in markets for future corporate development), and improved strategic risk management. AMR Research defines CSR as a company's obligation to make decisions based not only on the financial and economic factors of the business, but also on the social and environmental consequences of its activities. Within CSR, Aim Research segments initiatives into five categories:

1. Environmental action—programs to reduce pollution, save energy, and recycle
2. Ethical—codes of practice with respect to diversity and accountability to employees and partners
3. Philanthropic—charitable contributions to support medical, artistic, or cultural development
4. Responsible sourcing—fair labor standards and economic development
5. Social issues—educational outreach, scholarships, and volunteerism


"Evergreen"—Environmental Regulations for High-tech and Electronics, Chemical, and Oil and Gas Industries

Manufacturers in the electrical and electronics equipment industry are not spared the growing array of regulations requiring compliance. In recent years, strict environmental regulations have been implemented in the US and European Union (EU), with more soon to come from other countries such as Japan and China. The cost of compliance to manufacturers in any industry is high, but noncompliance with national and international regulations can cost enterprises a great deal more. Therefore, industry leaders must ensure they have the means to adapt their businesses to meeting these regulatory requirements, and thus avoid costly penalties and product recalls. What's more, companies can further benefit from enterprise application systems that will ensure their business processes meet with ever-changing regulatory requirements, in addition to creating trusted brands and maintaining shareholder value.

Key regulations in the high-tech industry include the following:

* Restriction of Hazardous Substances (RoHS) Directive, which applies to manufacturers of electrical and electronics equipment that do business in the EU. The regulation prohibits the sale of electronics products that contain more than 0.01 percent of cadmium, mercury, lead, hexavalent chromium, polybrominated biphenyls (PBBs), and polybrominated diphenyl ether (PBDE). Violations can result in stiff penalties, significant loss of sales, and a negative impact on brand perception in the environmentally conscious European market.

* The Waste Electrical and Electronic Equipment (WEEE) Directive, which establishes rules for the collection, treatment, recycling, and recovery of electronic waste in the EU. The directive states that electronics manufacturers and importers must manage and pay for the recycling of electrical and electronics waste. EU member countries have been required to meet WEEE recycling targets since the end of 2006. For more detailed information on WEEE, see Off-loading Some Green Compliance Burdens: Can Enterprise Applications Meet the Challenge?

RoHS and WEEE are the most pressing environmental regulations that electronics manufacturers face today. But other recently announced regulations, including Energy Using Products (EUP), Integrated Product Policy (IPP), Environmental Permitting Program (EPP), and Registration, Evaluation, and Authorization of Chemicals (REACH), might have even greater impacts on core business processes. An astute solution for high-tech environmental product compliance has to deliver the tight integration with core logistics and other processes that will be necessary to comply with these emerging regulations.

For more information on compliance issues in other industries, please see previous parts of this series: Thou Shalt Comply (and More, or Else): Looking at Sarbanes-Oxley, Important Sarbanes-Oxley Act Mandates and What They Mean for Supply Chain Management, Sarbanes-Oxley Act May Be Just the Tip of a Compliance Iceberg, and Automotive Industry and Food, Safety, and Drug Regulations.

Environment-friendly Chemicals?

The issues of environment, health and safety (EH&S) are what make the chemical industry one of the most liable of all industries. Chemical companies, therefore, have a pressing need for solutions that will streamline and automate compliance processes, as well as enable them to manage their operations more safely, effectively, and in accordance with both national and international regulations and recommendations.

The chemical industry faces particular scrutiny from a regulatory perspective, and companies are all too aware of the impacts of the European Classification and Labelling Inspections of Preparations, including Safety Data Sheets (ECLIPS); REACH; Science, Children, Awareness, Legislation and Evaluation (SCALE); and Global Harmonized System of Classification and Labelling of Chemicals (GHS). For instance, REACH is the new system for regulating chemical use in the EU, and it mandates organizations to track inventory and usage of over 12,000 chemical substances. For more information, see So What's the Big Deal with Chemicals?

The recently passed REACH legislation requires the registration or screening of the majority of substances that are already in the EU marketplace. Of key importance are substances of very high concern (SVHC): substances considered persistent, bioaccumulative, and toxic (PBT); substances considered very persistent and very bioaccumulative (vPvBs); and carcinogenic, mutagenic, and reprotoxic (CMR) substances, in addition to those of similar concern, such as endocrine disrupters.

Authorization for the use of such high concern substances will only be given when good socioeconomic reasons and risk minimization measures are in place. The European Commission estimates that these measures will cost industry between €2.8 and 5.2 billion over the next eleven years. For additional information on REACH, visit www.reachlegislation.com; a glossary reference site from the European Environment Agency (EEA) can be found at http://glossary.eea.europa.eu/EEAGlossary.

# Product safety, so as to ensure that substance data is up-to-date and available to appropriate users by integrating product safety capabilities into supply chain processes. This enables compliance with such regulations as the Food Quality Protection Act, Title 21 CFR Part 11; Title 29 CFR 1910.1200 and EU Directive 91/155/EEC for Material Safety Data Sheets (MSDS); the Toxic Substances Control Act (TSCA); the Clean Water Act; the Superfund Amendments and Reauthorization Act (SARA); and the Federal Food, Drug, and Cosmetic Act (FFDCA).

# Dangerous goods management, so as to support all processes connected with the manufacture and distribution of dangerous goods. Companies must comply with such regulations as the International Air Transport Association's (IATA's) and International Civil Aviation Organization's (ICAO's) Dangerous Goods Regulation, Title 49 CFR Parts 100-185; the International Maritime Dangerous Goods Code (IMDG); the Intergovernmental Organization for International Carriage by Rail's (OTIF's) Carriage of Dangerous Goods (RID); the European Agreement Concerning International Carriage of Dangerous Goods by Road (ADR); the Agreement on the Transport of Dangerous Goods on the Rhine (ADNR); the Canadian Transportation of Dangerous Goods Act; and the International Atomic Energy Agency's (IAEA's) Code of Conduct on the Safety and Security of Radioactive Sources.

# Industrial hygiene and safety management, so as to support a safe work environment, whereby companies can identify, control, and eliminate work hazards. Such solutions must enable compliance with regulations such as the International Labor Organization (ILO) Safe Work Agenda 21, Chapter 19, Programme B.

# Occupational health, so as to ensure the health of workers, protect personal data, and meet legal requirements, whereby enterprises can effectively comply with regulations such as the Occupational Safety and Health Act's (OSHA's) right-to-know (RTK) directives and the ILO Safe Work Agenda 21, Chapter 19, Programme B.

Chemicals, together with their utilities and oil and gas brethren, must comply with the Kyoto Protocol, the Clean Air Act, the EU Integrated Pollution Prevention and Control (IPPC) Directive, and other regulations related to greenhouse gases and other emissions. Moreover, the process of applying and monitoring permits can be labor-intensive. This is because enterprises need to monitor and manage operations and emissions permits to comply with regulations, reduce greenhouse gases and other emissions, and ensure the ability to audit.

On the positive side, efficient compliance management can result in competitive advantage. The revenue-generating potential of the emerging emissions trading markets means companies can turn regulatory compliance into new revenue streams. But they first have to garner a number of tools to mitigate risks, build trust with regulatory authorities, significantly reduce the cost of compliance over the long term, and pursue new business opportunities. Well-devised software tools could allow companies to reap the financial benefits of the emissions trading markets because the software can determine and document emission credits, and can communicate emissions credits with emission trading platforms.

This brings us to the enterprise software category for handling EH&S. EH&S entails many disparate, environmental compliance solutions to address regulations dealing with health and environmental protection, restriction of hazardous substances, occupational health and safety, and greenhouse gas trading schemes. Amid a growing number of environmental compliance challenges, manufacturers and suppliers today are looking to proactively monitor and improve product and EH&S compliance processes. Companies have to efficiently manage their businesses while ensuring compliance with complex EH&S processes and mandates, such as RoHS, WEEE, the International Material Data System (IMDS), the End-of-Life Vehicles (ELV) Directive, the Health and Safety at Work Act, OSHA, emissions-trading permits, and regulations around emissions trading schemes.

Potential benefits from leveraging EH&S software tools include the ability to deploy global EH&S processes while adapting them to practices in individual circumstances and geographies. Leveraging such software tools can also ensure much safer handling and tracking of hazardous substances, dangerous goods, and waste products. Also important, a company can deliver full-scale health management to provide for employee health and well-being, ensure the compliance of individual products with various regulations, and improve manufacturing productivity by aligning business processes with the fulfillment of environmental regulations for emissions management.

In part six of this series on how different industries address compliance issues, global trading will be looked at in light of the increasing amount of legal and regulatory requirements. With enterprises realizing the importance of having a holistic approach from top down, governance, risk management, and compliance (GRC) software is emerging as an essential enterprise solution.


Automotive Industry and Food, Safety, and Drug Regulations

The issues of quality and safety in the automotive industry have recently become about more than simply complying with such regulatory requirements as the Automotive Right-to-Repair bill. Rather, for companies in the automotive industry, these issues are about maintaining consumer confidence, making certain companies have a more competitive supply chain, and making profitable growth possible in spite of the big original equipment manufacturers' (OEM's) arbitrary price pressures on the supply chain.

With sound, industry-oriented, and compliance-ready enterprise applications systems, OEMs and suppliers stand a better chance at achieving their coveted quality objectives of zero defects and safety incidents. In addition, such applications systems may allow OEMs, suppliers, and dealers to reduce warranty costs and to ensure that vehicles are safer and cheaper to drive.

For more information on compliance issues in other industries, please see previous parts of this series: Thou Shalt Comply (and More, or Else): Looking at Sarbanes-Oxley, Important Sarbanes-Oxley Act Mandates and What They Mean for Supply Chain Management, and Sarbanes-Oxley Act May Be Just the Tip of a Compliance Iceberg.

Automotive Compliance Issues

In addition to having to comply with each mighty OEM's proprietary communication standards and protocols, one of the latest key automotive regulations is the US Transportation Recall Enhancement, Accountability, and Documentation (TREAD) Act. This regulation requires greater control and traceability of safety-related automotive components, and aims to protect lives by detecting failure patterns in automotive parts.

The current regulation requires two types of reports. The first collects data relating to production, consumer complaints, property damage claims, warranty adjustments, and field reports. The other involves data on claims and notices of death or injury. Management and analysis of a great deal of data (both structured and unstructured) is needed with TREAD reporting. The law also requires integration with new and legacy transactional systems. Logically, a sound enterprise infrastructure platform should address these governance and accountability requirements through data that is reasonably easy to access for reporting and analysis purposes. In addition, such a platform should clear audit trails for critical quality, procurement, and dealer management systems.

Further, the International Organization for Standardization (ISO) TS 16949 specification aligns international automotive quality standards, defining quality-system requirements for the design, production, installation, and servicing of automotive products. This section of ISO emphasizes that companies must ensure that both the parts and the processes meet customer requirements. This process approach to quality is not centered solely on documentation, but rather it focuses on customer satisfaction. Suppliers are required to show the processes' interactions from end to end, including inputs, outputs, and overall effectiveness.

For instance, users should be able to automate paper-intensive revision processes within a document control module (or capability). A document control module offers tools that should help users gain real time visibility into the key documents so that the right people can view the right documents as changes occur. Such a feature should provide secure document control throughout the enterprise, with documents stored in secure libraries that can then be linked and viewed throughout the enterprise resource planning (ERP) system. At the same time, the system can automatically keep revisions for future access.

For visibility into quality processes at the component level, user enterprises can use the APQP-enabled modules (provided by some ERP or PLM providers that focus on the automotive industry) with integrated templates for automotive requirements based upon, for example, the Ford or General Motors (GM) APQP programs. This should help users tremendously to link and manage APQP process-related, component-level documents.

DRM Associates' Failure Modes and Effects Analysis (FMEA) explains the process this way:

One of these would be to design according to the Failure Modes and Effects Analysis (FMEA) methodology for analyzing potential reliability problems early in the development cycle where it is easier to take actions to overcome these issues, thereby enhancing reliability through design. FMEA is used to identify potential failure modes, determine their effect on the operation of the product, and identify actions to mitigate the failures. A crucial step is anticipating what might go wrong with a product. While anticipating every failure mode is not possible, the development team should formulate as extensive a list of potential failure modes as possible.

For example, one should be able to access and maintain Gage repeatability and reproducibility (Gage R&R) studies to identify and reduce measurement variation, capability studies, set up instructions, or computer aided design (CAD) and computer aided manufacturing (CAM) files and forms. With timely information, one can thereby reduce data entry efforts, identify substandard quality much earlier, and keep the customers happy.

A PPAP-enabled module typically provides tools for planning and controlling part production information, including the ability to outline the sampling process, provide checkpoints for adherence to plans, and ensure a process has the potential to consistently manufacture product and meet or exceed customer quality requirements. Typically, the module is directly linked to inventory items and customer information; it has a built-in control plan, and FMEA management and reporting facilities. For more pertinent information, see Benefits of a Single Database Solution: Improved Enterprise Quality Management from IQMS.

Food Safety—Not to Be Treated Lightly

Resembling the automotive traceability requirements to a degree, food safety and traceability too must be about more than simply complying with regulatory requirements. Maintaining consumer confidence, ensuring a more competitive supply chain, and enabling profitable growth are also key motivators for enterprises in the food industry. Food manufacturers need solutions that will afford them the capabilities they need to comply with the growing amount of government legislation and safety initiatives affecting the food and personal care industries today. These solutions should also help them avoid costly product recalls, build trusted brands, and create shareholder value.



Food safety is a global issue, and the present-day threats and potential costs associated with food safety have never been higher. As companies seek to increase their control and in turn, minimize the risks, they discover that many varied activities, both within and outside the organization and both upstream and downstream the supply chain, must be considered and addressed. Most countries have governmental agencies, such as the US Food and Drug Administration (FDA) and US Department of Agriculture (USAD), that are responsible for regulating food products. These agencies help to ensure that foods are safe to eat and do not contain any harmful additives. To that end, correct labeling of food products is strictly enforced and some countries now exercise strict guidelines relating to product advertising. Food control and safety will only increase with the closer linking of food supplies among countries and regions, especially in light of illnesses such as mad cow disease and avian (bird) flu, which can spread to humans through food consumption.

The rules typically cover all food products sold in the country and therefore, any product imported into the country is covered by the regulations. For all members of the food supply chain, the import, export and domestic impacts of the worldwide regulations must be considered. As concerns for food safety continue to rise, it should be not surprising that industry regulations and enforcement are becoming more stringent. Many food producers regulated by the FDA and USDA have thus implemented hazard analysis and critical control point (HACCP) programs to standardize their practices in food quality and safety, with the aim of streamlining the business processes and reducing the risks of compliance while keeping the operational costs down as much as possible.


* "The U.S. Public Health Security and Bioterrorism Preparedness and Response Act of 2002 requires organizations to track the immediate sources of raw materials of their food products and the immediate recipients of any products they produce. The Bioterrorism Act also requires that organizations notify the U.S. FDA before they import food products into the United States." See SAP's Consumer Product: Regulatory Compliance for more.

The regulation has created a new requirement for consumer goods manufacturers, whereby they must track the source of raw materials as well as the destination customer of the finished goods. The participants in the entire supply chain have to maintain inventory attributes, such as lot numbers, revision codes, manufacturing dates, expiration dates serial numbers, etc., all of which should help everyone involved to combat bioterrorism threats and to manage product recalls should they occur.

"Most of the bioterrorism security regulations require food manufacturers, distributors, and logistics companies to establish and maintain records that would allow inspectors to conduct a trace investigation to protect the food and animal feed supply." See Manufacturing & Logistics IT's Food industry QA managers influence technology selection for more information.

The regulation requires companies to have the means to provide the required reporting mechanisms beyond traditional lot traceability. With the US FDA's authority over approximately 80 percent of the US food supply, the Bioterrorism Act will likely have more impact on the worldwide food and beverage industry than all other regulations combined.

While limited exemptions exist, the law is intended to be broadly applied to all companies that manufacture, process, pack, hold, transport, distribute, or receive regulated food product. It is estimated that the US Bioterrorism Act covers over 400,000 US and foreign facilities.

* The EU's General Food Law Regulation 178/2002 establishes similar requirements and procedures for food safety, including the ability to trace materials back to the source producer. The US Bioterrorism Act is being replicated throughout the EU to ensure the food supply's safety from terrorist attack by applying an integrated approach from "farm to table," covering all sectors of the food chain, including feed production, primary production, food processing, storage, transport, and retail sale. This clearly indicates that food safety concerns impact all members of the food supply chain.

The European Food Safety Authority (EFSA), setting forth the basic conditions for safeguarding food, established EU Regulation 178/2002. Article 18 of the regulation specifies that the traceability of food must be established at all stages of production, processing, and distribution, or from "farm to fork," including growers, processors, manufacturers, and distributors, plus retail and food services.

Indeed, the stricter new EU regulations make food processors legally bound to have traceability systems, even if their customers do not necessarily require them. This is applicable to the entire supply chain (production, storage, purchasing, quality control, and so forth), and to everything that contributes to food safety (including packaging, closures, seals, bottles, jars, and the like). This is in contrast to the former requirement of identifying only the source of an ingredient. Backward traceability is also needed for multiple ingredients, as well as forward traceability for recall purposes. For more information, see Food and Beverage "Delights".


GMPs define a quality system that drug manufacturers must use as they build quality into their products. For example, approved drug products that have been developed and produced according to GMPs are expected to be safe, properly identified, of the correct strength or potency, pure, and of high quality. At a high level, GMPs address

* the proper design, maintenance, and cleaning of equipment and facilities;
* the development and approval of standard operating procedures (SOPs);
* the need for an independent quality unit (such as quality control or quality assurance); and
* the qualifications and training for personnel and management.

GMPs are defined as regulations that describe the methods, equipment, facilities, and controls required for producing drug products, and these regulations are found in the Congressional Federal Register (CFR) 21 in the following parts:

* Human pharmaceutical products and veterinary products (21 CFR Part 210 and 21 CFR Part 211)
* Biologically derived products (21 CFR Part 600 and 21 CFR Part 620)
* Medical devices (21 CFR Part 820)
* Processed food (21 CFR Part 100)

The set of regulations that are currently in effect are called current good manufacturing practices (CGMPs), emphasizing that they are dynamic and ever-changing. They can change either formally or informally. For instance, the US medical device GMPs were formally changed when the US Congress rewrote them to make them more compatible with the ISO-9001 quality document. The medical devices GMPs were then renamed the quality system regulation (QSR).

The following parts pertain specifically to pharmaceutical products:
Part 210 CGMP In Manufacturing, Processing, Packing, Or Holding Of Drugs; General
Part 211 CGMP For Finished Life Science Products
Part 11 Electronic Records; Electronic Signatures

Title 21 CFR Part 11 specifies further controls for electronic records and electronic signatures. This US FDA regulation establishes requirements for electronic records systems, thereby regulating the use of computer systems, audit trails, lot and serial traceability, change control, archiving, e-signatures, and security. As automation began to replace paper-based systems, the US Congress feared a loss of documented control over safe pharmaceutical production processes. With an initial focus on medical devices and life science products, Congress mandated a verifiable, traceable plan that would allow digital signatures and automated audit trails to replace the volumes of regulatory paperwork.

This plan was published as 21 CFR Part 11, simply known as "Part 11," and the impact of Part 11 on manufacturers will likely be as great, if not greater, than the Y2K issue. One should, however, note that Part 11 is a loosely written regulation that intends to add a layer of security to the production processes of the pharmaceutical industry through audits and authorized sign-offs. Hence, it is not mandatory, and it is only called into play if a company chooses to use electronic records. Conversely, if a company decides to stay with paper-based records, Part 11 does not apply.

However, compliance-aware enterprise solutions for the life science industry should have the functionality user enterprises need to comply with regulations and guidelines related to regional GMPs or electronic records and signatures, including the following:

* EU Directive 91/356 (EU GMP Guideline)—this directive specifies legal requirements for GMP in the EU, and it requires that data be available at the proper time, provided in a readable form, and protected against damage or loss.

* ICH Q7A Guideline—International Conference on Harmonization (ICH) Q7A provides guidelines for active pharmaceutical ingredients in the EU, the US, and Japan.

* PIC/S—The Pharmaceutical Inspection Cooperation Scheme (PIC/S) and the Pharmaceutical Inspection Convention provide guidance on pharmaceutical inspections.

Well-attuned solutions for the industry should also provide capabilities that enable compliance with regulations and guidelines related to radio-frequency identification (RFID), including

* FDA Bar Code Label Requirements for Human Drug Products and Biological Products, since the FDA requires bar codes on most prescription drugs and certain over-the-counter drugs;

* Procedure for Handling Rapid Alerts and Recalls Arising from Quality Defects, since the European Commission has established procedures for the rapid transmission of information related to pharmaceutical recalls;

* RFID Feasibility Studies and Pilot Programs for Drugs, which is an FDA Compliance Policy Guide that describes how the FDA intends to enforce regulations related to labeling, electronic records, and product quality for pharmaceutical manufacturers, re-packers, re-labelers, distributors, and retailers; and

* US state regulations, since several states are establishing mandates that require pharmaceutical wholesalers and distributors to maintain pedigrees for every drug shipped (see Drug Pedigree Guidelines and How Software Can Help).

The enterprise application providers that aspire to address the regulatory requirements of the life sciences industry should do so through the industry-oriented ERP systems. What's more, they should use the underlying infrastructure platform, which should additionally provide functionality and support for advanced security, audit trails, digital signatures, RFID technology, and more. For more information, see RFID in Healthcare—A Whole Industry of Value.