One Impact of SaaS on Internal Controls: You Can’t Cook A Trendline

May 31, 2006 by Matt Ammerman

   There are many internal control implications derived from the new software as a service delivery paradigm – and most are just now being discovered as companies explore SaaS and the effects that it has on core internal business operations.  In the accounting realm, software as a service directs changes on both ends of the SaaS delivery pipeline – the provider and the subscriber.  Subscribers looking to outsource key enterprise applications must do so in a way that does not undermine their internal controls strategy with weakened monitoring of company data.  After all, outsourcing applications and data to application providers does not mean less accountability on the part of the subscriber.  Perhaps I will delve further into subscriber-side internal controls issues (customization, etc.) in a future article.  Today I’m writing to illustrate one particular internal control related benefit that the SaaS business model affords the SaaS provider (ISV, Application Enabler, Infrastructure Host).  The somewhat understated benefit is that SaaS revenue modeling rolls financial accountability into the actual process of moving cash and revenue streams through the financial system.  Internal controls procedures don’t have to be retro-fitted umbrella policies or hammers brought down upon traditional accounting practices; instead they are actually built into the accounting model that SaaS creates.

   An important thing to remember about software as a service is that it rewrites the provider revenue model almost entirely.  An SaaS provider’s primary revenue stream becomes exactly that – a flow of money (in the truest sense) over time, driven by term-based usage fees paid by subscribers (customers).  Please note that for the sake of this article I’ll be politely ignoring other money-making offerings such as Professional Services and Consulting, and I’ll focus on the major benefit of actual SaaS application provisioning and delivery.

   A popular pro-SaaS talking point is the benefit that a recurring revenue model has on financial projection.  Because revenue from subscriptions is a volume number, and is not tied to the binary yes/no of landing one time deals for $unknown, revenue and cash flow projections are closely coupled to the subscriber (customer) base growth rate trendline:

Subscribers x Growth Rate x Access Fees ($)

Rather than the less predictable statistics of the traditional formula:

Leads x Conversion Ratio x Average Sale Size ($)

   While I whole-heartedly agree with the statement that this change in revenue forecasting is beneficial, I don’t believe that the statement is fully mature without a relation to accounting process controls. Software as a service revenue models align, by nature, with best practices for financially sound internal controls because recurring revenue models spell out future revenue and cash flow expectations much more clearly than the often subjective estimates provided by traditional financial systems.  Such ‘estimates’ have proven to be the catalyst for high-profile legal issues rooted in financial integrity concerns, i.e. ‘cooking the books’ a la Enron.  So, while I agree that accounting practice benefits from a recurring revenue model, I believe that accountability practice is the true beneficiary.  

   Simply put, the recurring revenue models provided by subscription-based SaaS delivery roll accounting and accountability into the same control.  Order to cash flow and order to revenue streams are tracked by placing money in definite timeslots (monthly, quarterly, yearly) whose terms are the very foundation of the recurrence model, rather than the somewhat arbitrary practice of predicting sales based on a subjective, and difficult to moderate, account of lead conversion potential.

   And, of course, there’s Sarbanes-Oxley, with one of its primary goals being to institute a corporate revenue reporting compliance standard.  SarbOx exists to ensure that companies are accurately reporting revenue numbers.  To do this, SarbOx layers controls on top of accounting practices that track and verify numbers through the entire order to revenue process.  SaaS recurring revenue models, as explained above, have that built in since the order to revenue process and revenue projection models are essentially the same numbers.  Furthermore, the revenue numbers are so closely tied to subscriber base growth rates that past performance becomes a much larger (and undeniable) player in the formulation of revenue estimates.  In traditional models, previous performance effects on projections can be mitigated by tactfully inflating/deflating anticipated sales numbers, since $unknown can effectively be fabricated entirely, and is quite difficult to argue against.  In the recurring models of SaaS, the proof is in the pudding of time and subscribership.

   Given the increasing adoption of internal control procedures (an August 2005 IDC report showed 55% of public companies have made augmentations to their internal controls procedures as a result of SarbOx), software as a service stands as a key business catalyst on multiple fronts.  While it does introduce business challenges, it is surely a multi-faceted problem solver.  And, just like many paradigm shifts of the past, it does so by building refined approaches out of seemingly disjointed processes – concatenating hurdles and jumping them all at once.

Further reading: The Impact of Sarbanes-Oxley on Revenue Recognition Practices by Robert O’Connor, Softrax