CIO’s view on SAM: confidence in risk management

With a change at the helm at the start of a pandemic, Toyota Finance adopted KPMG’s Software Asset Management as a Service (SAMaaS) to assist risk management and cost consolidation of their purchased software.

For newly appointed Chief Information Officer (CIO), Colin Mapp, joining Toyota Finance Australia (TFA) at the start of the COVID-19 pandemic in April 2020, the uncertainties from changing economic conditions whilst enabling the company to adapt to the new normal meant that being proactive in understanding his business’s cost base and inventory of technology assets was of paramount importance.

Mapp knew that having good software asset management (SAM) would ultimately be an enabler for both of these goals. It would assist him to uncover any hidden risks or over-spend that had previously been overlooked, and allow the Executive to have confidence that the house is in order before accelerating on their future IT roadmap.

To move quickly, Mapp took up KPMG’s Software Asset Management as-a-service (SAMaaS). SAMaaS gives organisations clear oversight of their software use and licences on one central platform and provides ongoing support from KPMG specialists for continuous lifecycle management. 

“We were busy running the business, so we were looking for guidance” Mapp says. 

Here, Mapp explains how KPMG’s SAMaaS approach is helping TFA to deliver on its strategy. 

The number one reason that Mapp decided on SAMaaS was improved risk management. He wanted to know exactly what software TFA was using, and be confident that every piece was being used for a valid business purpose and in accordance with vendor licensing conditions, but he did not have reliable data that he could trust.

“There are always software assets that you might have missed because they aren’t critical to operations,” he says.

Without SAMaaS, Mapp would need to rely on individual application subject matter experts to report on their software usage. But with the pace of change moving so quickly, having consistent and timely reports was a strain on delivery. Now, SAMaaS enables TFA to easily collate and view all software usage via the one platform. It enables Mapp to easily confirm that what is agreed with vendors is exactly what is deployed and used.

“With SAM, you don't get caught out by assumptions, as you have the data sitting there in front of you,” he explains.

If SAMaaS reveals any new pattern of software usage, the team can quickly act to fix any process or architectural gaps.

“It’s a chance to ask, how did that happen, and how can processes be tightened to ensure it doesn’t happen again?” he says.

The second driver for engaging SAMaaS was to check that every piece of software at TFA is used effectively. SAMaaS provides software deployment and usage reports, which help Mapp to forecast what software will be needed and when. He can see opportunities to reduce the number of licences, or where they need to increase, which helps to manage procurement cycles.

“I can determine whether we need to get on the front foot and negotiate a better price with vendors,” he says.

This holistic view helps with software consolidation, and enables him to focus on fewer but deeper relationships with vendors. With the richness of the data from SAMaaS, Mapp can move the conversation with vendors beyond pure price negotiation and focus more on where each vendor and their technologies can add value and create synergies between different application stacks.

“You can start creating a true partnership with vendors, where you can get a strategic view. You can say, here is my full portfolio, how can we rationalise it?” he says.

TFA is moving aspect of their technology from on-premise software to the cloud, and is embracing Agile practices into its operations. A key goal is to be able to build products and deploy them quickly. However, as teams work, iterate and experiment at pace, constant changes to software configuration may lead to increased licensing risk.

“It’s about supporting agile delivery, whether it’s on premise or in the cloud, with the right controls in place. If we scale up without proper consideration or approval, we want to be able to catch it quickly – and SAM allows us to do that” Mapp says.

SAM starts with data hygiene as the focal point, however it is not just about good quality data it is about results, and organisations can’t achieve results if they don’t use the data to take action and assess the effectiveness of that action.

SAMaaS includes a framework of key performance and risk indicators (KPIs and KRIs) that are presented to TFA on a monthly basis along with recommended actions.

And because it is a monthly checkpoint, the TFA and KPMG teams are regularly talking, assessing the effectiveness of prior month’s actions from the latest data and making iterative changes as needed to work towards reaching the KPIs and KRIs.

This is a cyclic process, “The key is having an open dialogue, and working back and forward on what the tool is telling us is very critical,” Mapp says.

Finally, all this effort in SAM helps Mapp demonstrate to the Executive that software risk and cost is being managed.

“The Executive want to know we’re on the front foot and managing our assets, whether that be software or hardware. They want to know that they aren't going to be exposed to something that they hadn't planned for” he says.

SAMaaS is also helping Mapp to have informed budget conversations with the Executive team about their spending on software and how that is supporting their business.

“SAM enables me to have discussions about what is potentially coming up, and what things the team is doing, and how to manage those scenarios. It gives them the confidence that we’re looking for ways to optimise our environment” he says.