Asset management firms view outsourcing as both a way to reduce fixed costs and a way to keep their businesses running in the event of a disaster like Superstorm Sandy. By moving more functions to the cloud, there’s a greater chance that they will be available should a firm’s primary location be inaccessible for extended periods of time.

At least three primary cloud-based delivery models have been identified—Software-as-a-Service (SaaS), Infrastructure-as-a-Service (IaaS), and Platform-as-a-Service (PaaS). Whatever the acronym, asset managers believe that cloud computing greatly expands the number of outsourcing options open to them.

“In going through our recovery processes, we just liked the combination of using a cloud-based service to not only eliminate capital infrastructure expenditures, but also improve upon business recovery,” said Ken Meister, chief operating officer of Evanston Capital Management, which manages $4.6 billion, specializing in the construction of multimanager hedge fund programs for 300+ institutional investors. “It was really the combination of thinking about the dollars and buying hardware. We thought it was a significant and pretty elegant way to implement both.”

“I’m probably not one to have a deep knowledge on the intricacies of the different varieties of cloud solutions out there, but I can tell you how we approached it and what our thought process was and what we’ve implemented,” he said. “For us, it really started with just thinking we want to continue with having the internal infrastructure and going through a capital expenditure every several years in terms of replacing those servers, and the maintenance of it. So there was a decision in terms of the services that we were employing here. As the capital has grown, we want to think about, ‘Is that still the best thing to do, continue to buy all this hardware, software, and so forth?’”

A big part of the outsourcing decision must necessarily be the ability of the service provider to withstand a disaster, and its track record in keeping up and running when it’s had to invoke its DR plan.

“When performing due diligence on DR/BCP vendors, it’s important to look beyond regulatory audits of the data center and technology,” said Michael Asher, chief information officer at Richard Fleischman & Associates, which provides business continuity, disaster recovery and other technology services. “Explore how recent critical events were handled and how smoothly DR invocation was accomplished. DR testing, which is executed under controlled circumstances, is different from invocation of a DR environment in an emergency.”

Vendors should demonstrate a proven track record of successful DR activations as well as the ability to meet clients’ recovery time objectives. “As there is always a possibility that events impacting your firm may also affect the vendor’s ability to do business, always verify that the vendor has a strong DR/BCP framework for their own organization,” Asher said.

The decision on which functions to outsource and which should be retained in-house has been made easier by the fact that many functions viewed as core to the asset management business model can now be safely moved to the cloud.

“Firms should retain the intellectual property in-house, namely the persons responsible for making investment decisions and managing client relationships,” said Bruce Cooper, chief technology officer at Liquid Holdings, a cloud-based technology and managed services provider to the global hedge fund and active trading markets. “The systems and processes firms rely on to make, manage, reconcile and report investments should be outsourced to a SaaS provider. Those services include order management, trade execution and management, portfolio management, reporting, accounting, broker reconciliations, data management, security master maintenance and corporate actions.”

Knowing when to outsource functions versus retaining them in-house is a decision largely based on risk management, and can be driven by a Business Impact Analysis (BIA).

“BIAs are used to determine how best to recover applications and the associated risks for critical applications,” said Chris Burgher, principal, consulting services at SunGard Availability Services. “Knowing the risk landscape for applications better informs what cloud model to use. IaaS models are predominantly being deployed with some SaaS services for niche applications like Salesforce automation or core financial applications that are already being hosted.”

When firms outsource, they need to have in place plans for services that they would not be able to provide on their own should disaster strike. Using offsite data center service providers and or restoration services should be explored.

“Quite often, companies make the mistake of requesting these services during or after the event, when it is too late,” said Matthew Liotine, head of the program in emergency management and continuity planning at the University of Illinois at Chicago’s College of Business Administration. “They should understand what priority the service providers will give them during a widespread event such as Sandy. They should also closely examine their other key suppliers to determine which ones are most critical and ensure those providers also have sound preparedness and response plans.”