The Total Economic Impact Of ACL

Transcription

1 A Forrester Total Economic Impact Study Commissioned By ACL December 2016 The Total Economic Impact Of ACL Cost Savings And Business Benefits Enabled By The ACL Platform

2 Table Of Contents Executive Summary 1 Key Findings 1 TEI Framework And Methodology 3 The ACL Customer Journey 4 Interviewed Organization 4 Key Challenges 4 Solution Requirements 4 Key Results 4 Financial Analysis 6 ACL Helps Avoid Costs With Improved Risk Event Management To Reduce Shutdowns 6 ACL Helps Improve Business-Decision-Making With Real-Time Data Access And Improved Analysis And Visualization Tools 8 Audit-Related Cost Savings With ACL 8 Saved And Avoided Resource Costs With ACL 10 Unquantified Benefits 11 Flexibility 11 Deployment And Implementation Costs 12 ACL Licensing And Ongoing Resource Costs 12 Financial Summary 14 ACL Platform: Overview 15 Appendix A: Total Economic Impact 16 Total Economic Impact Approach 16 ABOUT FORRESTER CONSULTING Project Director: Sean Owens December 2016 Forrester Consulting provides independent and objective research-based consulting to help leaders succeed in their organizations. Ranging in scope from a short strategy session to custom projects, Forrester s Consulting services connect you directly with research analysts who apply expert insight to your specific business challenges. For more information, visit forrester.com/consulting. 2016, Forrester Research, Inc. All rights reserved. Unauthorized reproduction is strictly prohibited. Information is based on best available resources. Opinions reflect judgment at the time and are subject to change. Forrester, Technographics, Forrester Wave, RoleView, TechRadar, and Total Economic Impact are trademarks of Forrester Research, Inc. All other trademarks are the property of their respective companies. For additional information, go to forrester.com

3 Executive Summary Benefits and costs Reduced frequency and impact of issues with ACL risk management $446,794 New profit attributed to improved decisions with better data visibility $652,799 Upfront costs $140,000 ACL provides governance, risk, and compliance (GRC) management software for assessing risk, executing projects, continuously monitoring data, managing process documentation, and creating reports and dashboards for business visibility. ACL commissioned Forrester Consulting to conduct a Total Economic Impact (TEI) study and examine the potential return on investment (ROI) enterprises may realize by deploying ACL software. The purpose of this study is to provide readers with a framework to evaluate the potential financial impact of the ACL Platform on their organizations. To better understand the benefits, costs, and risks associated with this investment, Forrester interviewed a current ACL customer, an international airport management organization with several years of experience with the software. In airport management, regulations and business needs dictate the need to measure operational, security, and safety data to demonstrate compliance. Prior to ACL, the organization struggled to quickly pull together report and dashboard data from various sources to give visibility to key audit performance metrics. Data sources were not always reliable; data was often days or weeks old when reviewed by managers. Audits and operational risk reviews were slow and time intensive. With ACL, the organization was able to improve data collection and report creation, speed up operational risk reviews, complete more audits, improve business visibility and decision-making, and do all this with a smaller team. ACL was part of a total solution that delivered the right software tools to the right personnel for the right activities, said the program manager for the airport. Key Findings Quantified benefits. The following risk-adjusted quantified benefits are representative of those experienced by the company interviewed: Reduced frequency and impact of issues, especially related to avoidable airport shutdown events, by 50%. With ACL, the organization is able to both better manage and collaborate on process documentation and also connect to real-time data sources to identify out-of-compliance equipment (like a security x-ray machine with a scanning fluctuation). Avoidable airport or terminal shutdown events are now greatly reduced in both frequency and duration by about half, adding up to a three-year present value of nearly $450,000. More than $650,000 (present value over three years) in new profit attributed to improved decision-making with fresh, reliable, and comprehensive data reports and dashboards. The organization has developed a number of reports and executive dashboards to monitor and track performance and share the health of the business with managers and executives. Those leaders are able to make more informed decisions, which can reduce avoidable losses and take advantage of new opportunities. A 33% improvement in the number of audits completed and a 50% reduction in the amount of time it takes to complete some audits all with a smaller audit team. With ACL s easy setup and management, access to data sources can be quickly configured, and both planned and ad hoc audits can be completed much more quickly with more and more 1 The Total Economic Impact Of ACL

4 ROI 402% NPV $1,657,027 Audit cycle time 4 to 2 weeks Avoidable risks 50% reliable data stored in ACL. Two audit team members have been reallocated to other underresourced teams. With improvement in audit processes, some current audit team members as well as future planned hires can be avoided. Unquantified benefits. The interviewed organization experienced the following benefits that are not quantified for this study: Productivity improvements and cost savings related to the reduction of other issues. While shutdown-related issues are more noticeable, there are plenty of other avoidable issues reduced with better monitoring and management, such as a reduced risk of stockouts in stores, improved food handling in restaurants, and shorter security lines. Additional audit management improvement time savings. Audit team time savings have been estimated, but every location and department participating in an audit can also benefit from streamlined and faster audit processes. Costs. The interviewed organization experienced the following riskadjusted costs: Deployment and implementation costs of $140,000. This includes planning, implementation, and training. Ongoing total licensing and management costs of less than $275,000 (present value over three years). Forrester s interview with an ACL customer and subsequent financial analysis found that the organization experienced benefits of more than $2 million over three years versus costs of less than $415,000, adding up to a net present value (NPV) of more than $1.6 million and an ROI of 402%. Three-Year Risk-Adjusted Financial Summary Three-Year Present Value Of Risk- Adjusted Benefits $652.8K $547.1K PV of benefits $2,068,715 $446.8K $422.0K PV of costs $411,689 Initial Year 1 Year 2 Year 3 Reduced issues Improved decisions Faster and less costly audits Avoided resource costs 2 The Total Economic Impact Of ACL

5 TEI Framework And Methodology From the information provided in the interview, Forrester has constructed a Total Economic Impact (TEI) framework for those organizations considering implementing the ACL Platform. The objective of the framework is to identify the cost, benefit, flexibility, and risk factors that affect the investment decision. Forrester took a multistep approach to evaluate the impact that the ACL Platform can have on an organization. Specifically, we: DUE DILIGENCE Interviewed ACL stakeholders and Forrester analysts to gather data relative to the ACL Platform. CUSTOMER INTERVIEW Interviewed an organization using the ACL Platform to obtain data with respect to costs, benefits, and risks. FINANCIAL MODEL FRAMEWORK Constructed a financial model representative of the interview using the TEI methodology, and risk-adjusted the financial model based on issues and concerns of the interviewed organization. The TEI methodology helps companies demonstrate, justify, and realize the tangible value of IT initiatives to both senior management and other key business stakeholders. CASE STUDY Forrester employed four fundamental elements of TEI in modeling ACL s impact: benefits, costs, flexibility, and risks. Given the increasing sophistication that enterprises have regarding ROI analyses related to IT investments, Forrester s TEI methodology serves to provide a complete picture of the total economic impact of purchase decisions. Please see Appendix A for additional information on the TEI methodology. DISCLOSURES Readers should be aware of the following: This study is commissioned by ACL and delivered by Forrester Consulting. It is not meant to be used as a competitive analysis. Forrester makes no assumptions as to the potential ROI that other organizations will receive. Forrester strongly advises that readers use their own estimates within the framework provided in the report to determine the appropriateness of an investment in ACL. ACL reviewed and provided feedback to Forrester, but Forrester maintains editorial control over the study and its findings and does not accept changes to the study that contradict Forrester s findings or obscure the meaning of the study. ACL provided the customer name for the interview but did not participate in the interview. 3 The Total Economic Impact Of ACL

6 The ACL Customer Journey BEFORE AND AFTER THE ACL INVESTMENT Interviewed Organization For this study, Forrester conducted an interview with a current ACL customer, the audit team at an organization that manages all operations at several major airports, as well as does parts of terminal or retail management at several other international airports: ACL was part of a total solution that delivered the right software tools to the right personnel for the right activities. Program manager, international airport INDUSTRY REGION INTERVIEWEE TEAM STARTED ACL Transportation Europe Program manager Six people 2014 Key Challenges The organization knew it was not managing risk as well as it could, which exposed it to a greater possibility of a variety of business issues, including the shutdown of an airport terminal or the complete shutdown of an airport due to a mistake or lapse in security, food handling, health, or other procedures. Data used for monitoring and reporting was often out of date. Key systems were measured, but extracting data from various sources was time consuming; aggregating data from multiple sources would take even longer. By the time a manager or executive could see business health, the information was days or weeks old. Audit processes were time consuming and required a lot of inperson management and legwork. Again, data sources were not easy to access to extract data, meaning audit managers had to create and run ad hoc reports, sometimes also requiring help from IT. Process documentation was not well managed, with no scheduled review and update actions. Process documents were not stored in a central place and were not regularly reviewed or updated. Solution Requirements The interviewed organization searched for a solution that could: Help standardize and publish procedures. Help manage data from multiple sources that track process metrics. Deliver a summary of overall risk management health. The organization found its own homegrown and third-party solutions lacking, and it chose the ACL Platform as its global risk and process management solution. ACL was deployed and connected to data sources at both the main and international locations to monitor, audit, and manage risk exposure. Key Results The interview revealed that key results from the ACL Platform investment include: Reduced risks, leading to reduced issues and shutdown events. With better and more timely access to key process data, audit managers can quickly identify when a task or procedure is skipped or noncompliant to identify and deal with issues before they happen. In particular, for an airport, many security and health issues can lead to Using ACL in a more mature process where essentially there s an audit performed almost every week that s at least 33% more than we completed before ACL. And now with fewer people, as well. Program manager, international airport 4 The Total Economic Impact Of ACL

7 an area or all-airport shutdown, which can mean significant lost revenue, expensive compliance fees, upset customers and airline partners, and costs to remediate any problems. Audit and risk management strategic value to the business. For the airport, like many other organizations, the audit team used to be seen as an obstacle or a traffic cop. With ACL, the audit team is able to respond more quickly before an issue occurs, not days or weeks or months after. Business groups recognize that these issues are important and that the audit team is there to help, which has increased the value of the information the audit team provides and the visibility of the team within the organization. ACL enables us to get so forensic and so precise that it means there is essentially no hiding place. So it means that the business would take us more seriously than they did previously, said the program manager for the airport. Audit time savings. With ACL s easy-to-use tools and data connections to a wide variety of sources, data monitoring and dashboarding is much easier and faster to set up. Audit information is more connected, so in-person audit trips are shorter or needed less often, saving not only on the overall audit process time but also on airfare and hotel costs. Using ACL in a more mature process where essentially there s an audit performed almost every week that s at least 33% more than we completed before ACL. And now with fewer people, as well, continued the program manager. Audit group employee reallocation savings. Along with faster audit processes, the group is able to take on more audits at more of its home and international locations, with the same or fewer resources. ACL enables us to get so forensic and so precise that it means there is essentially no hiding place. So it means that the business would take us more seriously than they did previously. Program manager, international airport Key metrics Six FTEs on the audit team Up to 48 audits per year 14 days to complete fieldwork for each audit 5 The Total Economic Impact Of ACL

8 Financial Analysis QUANTIFIED BENEFIT AND COST DATA Total Benefits REF. BENEFIT YEAR 1 YEAR 2 YEAR 3 TOTAL Atr PRESENT VALUE Reduced cost of risk event issues with ACL $179,663 $179,663 $179,663 $538,988 $446,794 Btr Ctr Dtr New income as a result of better decisions using info from ACL reports Risk management team audit process time and cost avoidance with ACL Risk management team salary cost avoided with ACL $262,500 $262,500 $262,500 $787,500 $652,799 $169,698 $169,698 $169,698 $509,095 $422,015 $220,000 $220,000 $220,000 $660,000 $547,107 Total benefits $831,861 $831,861 $831,861 $2,495,583 $2,068,715 ACL Helps Avoid Costs With Improved Risk Event Management To Reduce Shutdowns Airport shutdowns occur due to a variety of external influences, such as the weather or a security threat. But some shutdowns are avoidable, like evacuating because of a mishandled bag or a malfunctioning screening device. Process data was stored, but not immediately available, so that if an x-ray scanner slipped outside of performance limits it might not be fixed until the end of a shift or the day, or the scanner might break down completely and cause significant delays and have an impact on the traffic into a terminal. When an avoidable event did occur that caused a shutdown, a section of the terminal, the entire terminal, or even the whole airport could be evacuated or shut down for several hours. Retail stores could lose sales, passengers could cancel trips, regulatory agencies could levy fines, and, as the program manager for the airport said, In an airport environment, if a key system goes down, we could have a camera crew from television, likely leading to bad PR and having to invest in a marketing campaign to recover. With the ACL Platform, the organization is able to reduce, eliminate, and/or shorten any issues that might lead to a shutdown, as well as avoid or mitigate many other types of issues. Data monitoring with ACL is done in real time and can immediately flow into reports and dashboards for effective information distribution and delivering alerts before an issue occurs. Before, the organization dealt with issues in a reactive manner, after something happened. With ACL, the organization can identify and mitigate issues before they occur: Avoidable issues occur about zero or one times per location per year. An issue such as those covered above may shut down an area for about 2 hours. The organization, through retail and other operations revenues, earns about $3,000 (at an international location) to nearly $100,000 (at a primary airport) per hour at each location. Total of all benefits across the four areas listed below, as well as present values (PVs) discounted at 10%. Over three years, the organization expects risk-adjusted total benefits to be a PV of more than $2 million. $446,794 Three-year benefit Reduced issues 6 The Total Economic Impact Of ACL

9 ACL can reduce the frequency or length of avoidable issues by 50%. Regulatory fines cost about $15,000 per avoidable event. Marketing costs to recover from any PR mishaps due to avoidable PR events cost about $20,000 per avoidable event. Many other issues, while not causing a shutdown, are also reduced or avoided with ACL, but they are not as easily measured. See the Unquantified Benefits section below for more detail. There are a number of potential risks that can affect this benefit, mainly stemming from some assumptions that are highly variable. Refer to Appendix A for more details, but changes in assumptions that can affect this benefit are: Shutdown events happen at irregular times and their frequency is hard to predict. The amount of lost revenue in an hour is greatly dependent on factors such as the location, what retail shops are nearby, and the time of day. Impact risk is the risk that the business or technology needs of the organization may not be met by the investment in the ACL Platform, resulting in lower overall total benefits. The greater the uncertainty, the wider the potential range of outcomes for benefit estimates. Avoided Costs From Reduced Risk Event Issues Calculation Table REF. METRIC CALCULATION YEAR 1 YEAR 2 YEAR 3 A1 Annual revenue (millions) $700 A2 Number of airports primary service 2 A3 Number of airports secondary service 21 A4 Revenue (per hour per location) $23,973 A5 A6 A7 A8 A9 A10 A11 Estimated revenue per hour peak time at primary location Estimated revenue per hour slow time at primary location Estimated revenue per hour secondary location (at any time) Chance an airport-closing event is during peak time Chance an airport-closing event is during slow time or at secondary location Chance any airport-closing event happens in a day Airport-closing events per year across all locations $95,890 $11,986 $2,854 80% 20% 1.00% A12 Average time of each closing event (hours) 2 A13 A14 A15 A16 Percentage of events that could be avoided with better planning and management Reduction in time or frequency of events affected by ACL Regulatory fines or fees as a result of avoidable airport shutdown Estimated additional marketing cost to recover from avoidable airport shutdown 84 10% 50% $80,000 $40,000 At Reduced cost of risk event issues with ACL TBD $199,625 $199,625 $199,625 Atr Risk adjustment 10% Reduced cost of risk event issues with ACL (risk-adjusted) $179,663 $179,663 $179,663 7 The Total Economic Impact Of ACL

10 To account for these risks, Forrester adjusted this benefit downward by 10%, yielding an annual benefit of $179,663. Over the three-year analysis period, the risk-adjusted present value of this benefit is $446,794. ACL Helps Improve Business Decision-Making With Real-Time Data Access And Improved Analysis And Visualization Tools The organization manages airports, terminals, and airport retail operations at a number of locations around the world. Periodic reporting was a manual and time-intensive process for a variety of reasons. It was difficult to track ongoing operations as data is captured by different systems, measured at different times, and valued with different currencies. That meant any monthly review would be looking at information that was days or weeks old. Managers and executives made decisions, but often the issue to be dealt with had become more severe or the opportunity had been missed. With ACL, the organization is able to connect to data sources to set up real-time monitoring, and also use that data to feed reports and dashboards for executive and management review. The organization is able to deal with issues and take advantage of opportunities more quickly, saving costs and increasing revenue. While the exact increase in revenue specifically as a result of ACL is hard to measure, given the many influences and activities that can affect revenue, the organization feels the following is a credible approximation of ACL s improvement: $652,799 Three-year benefit Improved decisions Total annual revenue of $700 million across all operations. A 0.05% improvement in total revenue due to better data monitoring and reporting with ACL. As already mentioned, it is difficult to estimate the exact impact that better data monitoring and reporting with ACL has on total revenue. Refer to Appendix A for more details, but changes in assumptions that can affect this benefit are: Revenue will likely vary from year to year. The impact of ACL may be overestimated. To account for these risks, Forrester adjusted this benefit downward by 25%, for a risk-adjusted annual benefit of $262,500. Over the three-year analysis period, the present value of this benefit is $652,799. Reduction In Software Integration Development Expense Calculation Table REF. METRIC CALCULATION YEAR 1 YEAR 2 YEAR 3 B1 Total annual income (millions) $700 $700 $700 B2 Improvement in income as a result of ACL 0.05% 0.05% 0.05% Bt New income as a result of better decisions B1*B2 $350,000 $350,000 $350,000 Btr Risk adjustment 25% New income as a result of better decisions (risk-adjusted) Audit-Related Cost Savings With ACL Before ACL, the organization conducted annual in-person audits at most main and international locations. Local audits were easy enough to schedule and manage. An international audit would regularly take four weeks onsite to review the books, review process documentation and $262,500 $262,500 $262,500 8 The Total Economic Impact Of ACL

11 metrics, and prepare an audit summary report. That meant a lot of lost productivity, airline tickets, and hotel rooms. Also, ACL process documents were previously stored in a secure online repository, but they were reviewed on an ad hoc basis and were sometimes hard to find. This meant not every employee had easy access to process documentation to be able to reference as part of completing his or her job effectively. Easy data connection with ACL, integrated with real-time monitoring and reporting, provides the tools to quickly focus on key financial and process metrics. This means that audits are quicker to complete, and some (if not all tasks) for an audit can be completed remotely. Process documentation is stored within the ACL Platform, for easy access as well as management tools to review and update these regularly. The organization is also able to complete more audits with the same number or fewer people on the team meaning they can work with more business groups that may have been less of a priority in the past (also reflected in the better business decisions benefit in the previous section). Comparing the before- and after-acl audit team performance, the organization found: Before ACL, 32 audits were completed each year, and now it is up to 48. Half of all audits are at the main location, while the other half are spread out across international locations. Audits before ACL would take four weeks, and now they take two. Audits may be conducted by more than one person, but essentially they averaged one full-time equivalent (FTE) working at about 85% before ACL. Now, they average one FTE working at about 65%. International-location audits before ACL were conducted fully at that location; today only half the time is spent onsite. All audits used to be on a one-year cycle, but now they can be completed once every two or three years (though the increase in total audits reflects the ability to review more departments across the organization many of which were not a focus before ACL when resource constraints were more of an issue). Since all international audits are completed onsite, and they are now conducted less often than before, there is a reduction in airline ticket costs. Since all international-location audits now take less time onsite, much fewer hotel nights are required. Given the amount of inputs driving the total financial impact of this benefit, there is a lot of opportunity for variance. Refer to Appendix A for more details, but changes in assumptions that can affect this benefit are: Overestimated airfare or hotel costs. Too high or low estimates for resource cycle or work time estimates. Overestimated number of audits possible in future years with the slightly smaller audit team. To account for these risks, Forrester adjusted this benefit downward by 10%, for an annual benefit of $169,698, which adds up to a three-year risk-adjusted present value of $422,015. $422,015 Three-year benefit Faster and less costly audits Before: one audit per year per international location Now: one audit every three years per international location 9 The Total Economic Impact Of ACL

12 Faster And Less Costly Audits, Including Reduced Airfare And Hotel Costs Calculation Table REF. METRIC CALCULATION YEAR 1 YEAR 2 YEAR 3 C1 Internal audits per year before ACL 32 C2 Internal audits per year with ACL C3 Weeks spent on each audit before ACL 4 C4 Weeks spent on each audit with ACL C5 C6 Percent of time spent specifically on audits before ACL Percent of time spent specifically on audits with ACL C7 Hours spent on each audit before ACL % 65% 65% 65% C8 Hours spent on each audit since ACL C9 Hours spent on audits each year before ACL 4,352 C10 Hours spent on audits each year with ACL 2,496 2,496 2,496 C11 Audit team FTE salary (fully burdened, per FTE) $110,000 $110,000 $110,000 C12 C13 C14 C15 C16 Audit team audit process time savings with ACL (per year) Flights required to complete audits (per year) before ACL Flights required to complete audits (per year) with ACL Hotel nights required to complete audits (per year) before ACL Hotel nights required to complete audits (per year) with ACL C17 Average airfare cost (per round trip) $1,500 C18 Average hotel cost (per night) $200 $98,154 $98,154 $98, C19 Airfare and hotel savings (per year) $90,400 $90,400 $90,400 Ct Ctr Audit team audit process time and cost avoidance with ACL C12 + C19 Risk adjustment 10% Audit team audit process time and cost avoidance with ACL (risk-adjusted) $188,554 $188,554 $188,554 $169,698 $169,698 $169,698 Saved And Avoided Resource Costs With ACL In addition to the audit process productivity savings, the organization is able to conduct audits with fewer employees, meaning current employees can be reallocated to other tasks (such as ongoing process monitoring), and/or planned future hires can be avoided. With ACL, the organization has reduced the size of the audit team by two people, while still completing as many (and even more) audits at a higher level of quality. While a 0% risk adjustment has been applied to the organization s estimate, refer to Appendix A for more details, and note that other organizations may apply a risk adjustment if salaries are not known and thus could be overestimated. The annual benefit is $220,000, adding up to a three-year risk-adjusted present value of $547,107. $547,107 Three-year benefit Avoided resource costs 10 The Total Economic Impact Of ACL

13 Reduction In Software Integration Development Expense Calculation Table REF. METRIC CALCULATION YEAR 1 YEAR 2 YEAR 3 D1 Audit team FTE salary (fully burdened) $110,000 $110,000 $110,000 D2 Audit FTE hires avoided or reallocated to other valued tasks Unquantified Benefits The organization was not able to quantify all benefits enabled by ACL. Some benefits are related to a variety of process changes, technology tools, and employee training in addition to the implementation of ACL. Some benefits that the organization has identified but not quantified are: It may see improvements related to nonshutdown issues, such as reducing stockouts in the retail stores and duty free shops, improving bag check and security procedures, and others. The audit department is a relatively small team within the large organization. It focuses on more than just traditional finance and accounting auditing, and other departments benefit from its help. For example, faster and reduced audits also mean that people on the teams being reviewed spend less time on audit tasks. They can also benefit from the guidance provided by the audit team as well as data available in ACL, such as when an executive or manager reviews the audit risk management information and targets a new business opportunity (potentially improving revenue as detailed above), which may also lead to team-specific cost savings or productivity benefits Dt Audit team salary cost avoided with ACL D1 * D2 $220,000 $220,000 $220,000 Dtr Risk adjustment 0% Audit team salary cost avoided with ACL (risk-adjusted) $220,000 $220,000 $220,000 Flexibility The value of flexibility is clearly unique to each customer, and the measure of its value varies from organization to organization. There are multiple scenarios in which a customer might choose to implement the ACL Platform and later realize additional uses and business opportunities. For the organization this includes: There are many departments that could benefit from a focused ACL implementation. As mentioned, the audit department is a relatively small team within the large organization. The security department, for example, has its own set of (often very confidential) data and processes that it needs to track to ensure quality and compliance. ACL is already being considered for expansion to that team and others. Flexibility, as defined by TEI, represents an investment in additional capacity or capability that could be turned into business benefit for a future additional Investment. This provides an organization with the "right" or the ability to engage in future initiatives but not the obligation to so. Flexibility would be quantified when evaluated as part of a specific project (described in more detail in Appendix A). 11 The Total Economic Impact Of ACL

14 Total Costs REF. COST INITIAL YEAR 1 YEAR 2 YEAR 3 TOTAL Etr Ftr Deployment and implementation costs Ongoing licensing and resource costs PRESENT VALUE $140,000 $0 $0 $0 $140,000 $140,000 $0 $109,250 $109,250 $109,250 $327,750 $271,689 Total costs (risk-adjusted) $140,000 $109,250 $109,250 $109,250 $467,750 $411,689 Deployment And Implementation Costs To implement ACL, the organization was able to get ACL up and running extremely quickly, though some IT and audit resource time was required at each location to connect data sources and develop standard reports and dashboards. Additionally, the organization needed to deliver training to many people in its main airports as well as in international locations, to understand new data monitoring processes, learn how to use and read new ACL reports, and know what would be needed (or not needed anymore) for upcoming audits. The organization estimated: About 750 hours of planning, data setup, and ACL implementation. About 2,000 hours of training across all its locations. Forrester risk-adjusted implementation costs by 0%, but refer to Appendix A for more information about Forrester s approach to risk adjustment. The organization estimates an initial cost of $140,000. Total of all costs across the areas listed below, as well as present values (PVs) discounted at 10%. Over three years, the organization expects riskadjusted total costs to be a PV of less than $415,000. Two months Total deployment time Two weeks ACL implementation time Deployment And Implementation Costs Calculation Table REF. METRIC CALCULATION INITIAL YEAR 1 YEAR 2 YEAR 3 E1 Implementation resource costs $40,000 E2 Training/change management costs $100,000 Et Etr Deployment and implementation costs Risk adjustment 0% Deployment and implementation costs (risk-adjusted) E1 + E2 $140,000 $0 $0 $0 $140,000 $0 $0 $0 ACL Licensing And Ongoing Resource Costs The organization only needs a few ACL licenses for its audit team. As a service, ongoing subscription costs are applied, along with some new tasks associated with creating and managing reports and dashboards, monitoring new data sources, and managing ACL features. (However, note that while some ACL-specific task time is included here, overall task time related to audits is greatly reduced, as covered in the Benefits section.) Given that third-party consulting and internal resource costs may vary over time, Forrester adjusted this benefit by 15%. Refer to Appendix A for more information about Forrester s approach to risk adjustment. Implementation risk is the risk that a proposed investment in the ACL Platform may deviate from the original or expected requirements, resulting in higher costs than anticipated. The greater the uncertainty, the wider the potential range of outcomes for cost estimates. The organization estimates ongoing costs are $109,250 per year, adding up to a risk-adjusted, three-year present value of $271, The Total Economic Impact Of ACL

15 Ongoing Costs Calculation Table REF. METRIC CALCULATION INITIAL YEAR 1 YEAR 2 YEAR 3 F1 ACL subscription costs $20,000 $20,000 $20,000 F2 Internal net-new ACL task resource costs $50,000 $50,000 $50,000 F3 Additional third-party consulting $25,000 $25,000 $25,000 Ft Ongoing costs F1+F2+F3 $95,000 $95,000 $95,000 Risk adjustment 15% Ftr Ongoing costs (risk-adjusted) $0 $109,250 $109,250 $109, The Total Economic Impact Of ACL

16 Financial Summary CONSOLIDATED THREE-YEAR RISK-ADJUSTED METRICS Cash Flow Chart (Risk-Adjusted) Total benefits Total costs Cumulative total $2.5M Cash The financial results calculated in the Benefits and Costs sections can be used to determine the ROI and NPV for the organization's investment in the ACL Platform. Forrester assumes a yearly discount rate of 10% for this analysis. $2.0M $1.5M $1.0M $0.5M -$0.5M INITIAL YEAR 1 YEAR 2 YEAR 3 These risk-adjusted ROI and NPV values are determined by applying risk-adjustment factors to the unadjusted results in each benefit and cost section. Cash Flow Table (Risk-Adjusted) INITIAL YEAR 1 YEAR 2 YEAR 3 TOTAL PRESENT VALUE Total costs ($140,000) ($109,250) ($109,250) ($109,250) ($467,750) ($411,689) Total benefits $0 $831,861 $831,861 $831,861 $2,495,583 $2,068,715 Net benefits ($140,000) $722,611 $722,611 $722,611 $2,027,833 $1,657,027 ROI 402% 14 The Total Economic Impact Of ACL

17 ACL Platform: Overview The following information is provided by ACL. Forrester has not validated any claims and does not endorse ACL or its offerings. ACL Services provides GRC technology solutions to approximately 8,000 supported customers from nearly 140 countries around the world, including close to 90% of the Fortune 500 list companies. Founded in 1987 and headquartered in Vancouver, Canada, ACL employs 280 professionals across the globe, with offices in North America, Europe, and Asia. ACL s integrated family of products including a cloud-based GRC solution and data analytics products supports all key components of the GRC process and is designed to integrate risk management activities between all levels of the organization, from the C-suite to front-line audit and risk professionals to the business managers they interact with. Through a combination of software tools and related domain content, accumulated over nearly 30 years of experience, ACL provides the software solutions that enable risk management professionals to identify and mitigate risk, protect company profits, and improve business performance by: APPROACHING RISK MANAGEMENT INTELLIGENTLY IN ALIGNMENT WITH STRATEGIC OBJECTIVES ACL software provides users with an integrated platform for assessing risk, managing projects, continuously monitoring transactional data, and collaborating with the business to create better visibility and reporting of organizational risk performance. Using ACL, risk management professionals can provide risk intelligence to their organizations by linking strategic risks to enterprise objectives and centrally tracking their risk events. Executives can gain visibility into strategic risk performance with one-click reports and dashboards that indicate significant movements in their risk environment. PROVIDING ACTIONABLE DATA-DRIVEN INSIGHTS AND DECISION SUPPORT FOR EXECUTIVE MANAGEMENT ACL is the only GRC platform vendor with the integrated ability to collect data from any enterprise data source, transform it in any way necessary, exercise powerful analytic capability (ranging from deep data mining to predictive analysis), and visualize it in an interactive format for powerful storytelling. Furthermore, ACL is the only vendor that integrates the results of such "data-driven" capability directly into the GRC management process, thereby enabling GRC professionals to objectively track those risks that affect their organization the most and trigger appropriate corrective actions. It s the data-driven risk management solution. FOCUSING ON WHAT MATTERS WITH A MODERN, COLLABORATIVE RISK MANAGEMENT AND DATA ANALYTICS PLATFORM The broad landscape of risk management and electronic work paper platforms is largely built on legacy technology by vendors with antiquated approaches to software development. This created an opportunity for ACL to put the customer back at the center of the software design process by focusing on user interface (UI) design and user experience first. ACL UIs are beautiful, simple, and easy to use, leading to rapid customer adoption. This customer experience aspect of ACL is difficult for competitors to match. ACL's intuitive design and user interface enables GRC professionals to easily facilitate communication between team members and business owners, send notifications for incident analysis and remediation, perform risk assessment surveys, and manage attestations. In addition, social collaboration capabilities allow users to seamlessly manage workflow and content, author and approve documents, store supporting evidence, and perform risk mitigation action planning. REALIZING VALUE QUICKLY Leveraging true SaaS delivery along with a simple design and mobile app capability, ACL solutions deliver value in two to three months of implementation (not six months or one to two years down the road after a lengthy customization process). Moreover, customers can access online self-help resources and quick-start guides to start onboarding quickly and evolve to full GRC process automation. SUPPORTING A VARIETY OF USE CASES ACL technology was architected to accommodate a variety of GRC use cases with domain-specific support. ACL uses a domain model architecture, a "one objective, risk, and control"-oriented framework that spans across different use cases. Customers are able to leverage a fully integrated platform that not only provides flexibility across various use cases but also future proofs their technology choice when partnering with ACL. Learn more about ACL s integrated family of products at 15 The Total Economic Impact Of ACL

18 Appendix A: Total Economic Impact Total Economic Impact is a methodology developed by Forrester Research that enhances a company s technology decision-making processes and assists vendors in communicating the value proposition of their products and services to clients. The TEI methodology helps companies demonstrate, justify, and realize the tangible value of IT initiatives to both senior management and other key business stakeholders. Total Economic Impact Approach Benefits represent the value delivered to the business by the product. The TEI methodology places equal weight on the measure of benefits and the measure of costs, allowing for a full examination of the effect of the technology on the entire organization. Costs consider all expenses necessary to deliver the proposed value, or benefits, of the product. The cost category within TEI captures incremental costs over the existing environment for ongoing costs associated with the solution. Flexibility represents the strategic value that can be obtained for some future additional investment building on top of the initial investment already made. Having the ability to capture that benefit has a PV that can be estimated. PRESENT VALUE (PV) The present or current value of (discounted) cost and benefit estimates given at an interest rate (the discount rate). The PV of costs and benefits feed into the total NPV of cash flows. NET PRESENT VALUE (NPV) The present or current value of (discounted) future net cash flows given an interest rate (the discount rate). A positive project NPV normally indicates that the investment should be made, unless other projects have higher NPVs. RETURN ON INVESTMENT (ROI) A project s expected return in percentage terms. ROI is calculated by dividing net benefits (benefits less costs) by costs. DISCOUNT RATE Risks measure the uncertainty of benefit and cost estimates given: 1) the likelihood that estimates will meet original projections and 2) the likelihood that estimates will be tracked over time. TEI risk factors are based on triangular distribution. The interest rate used in cash flow analysis to take into account the time value of money. Forrester assumes a yearly discount rate of 10% for this analysis. Organizations typically use discount rates between 8% and 16%. The initial investment column contains costs incurred at time 0 or at the beginning of Year 1 that are not discounted. All other cash flows in years 1 through 3 are discounted using the discount rate at the end of the year. PV calculations are calculated for each total cost and benefit estimate. NPV calculations in the summary tables are the sum of the initial investment and the discounted cash flows in each year. Sums and present value calculations of the Total Benefits, Total Costs, and Cash Flow tables may not exactly add up, as some rounding may occur. PAYBACK PERIOD The breakeven point for an investment. This is the point in time at which net benefits (benefits minus costs) equal initial investment or cost. 16 The Total Economic Impact Of ACL