From the November 2007 issue of Treasury & Risk magazine

Advantage, GRC

An observer to the mid-October business software consolidation games could get whiplash watching all the volleying back and forth as enterprise resource planning (ERP) giants SAP AG and Oracle Corp. battled for the governance, risk and compliance (GRC) and business performance management (BPM) advantage.

No sooner did SAP announce an agreement to buy business performance management (BPM) software vendor Business Objects SA, in a somewhat tardy response to Oracle's February purchase of Hyperion Solutions Corp., then Oracle bid for LogicalApps, a maker of automated applications control products for Sarbanes-Oxley management--a niche that SAP filled
in April 2006 with the acquisition of Virsa Systems Inc. Not a week had elapsed before Oracle moved again, this time with an offer for BEA Systems Inc., which makes software that connects servers.

Rumors swirled. Would IBM Corp. swallow up SAP, giving the German software maker the deep pockets it needs to grow and launching IBM into the ERP and GRC stratosphere? Who will be scooped up next? The money is on Cognos Inc., the last big independent business intelligence (BI) and performance management software maker. And then the most fundamental question of all: Is this marking the end of the niche player in the GRC and BPM space?

To answer, or even attempt to answer those questions, consultants say, it's important to understand the evolving GRC and BPM landscape, especially following the recent buying binge. The point of the acquisition spree, of course, is to allow companies to funnel the business data they have been storing in ERP systems into solutions that can help them develops better analytics and metrics to evaluate and measure compliance, risk and performance. By buying the technology, SAP and Oracle can more readily promise seamless interfaces, at least eventually. "ERP represents the backbone onto which various GRC applications can be hooked," says Lee Dittmar, a Deloitte Consulting LLP partner and head of the enterprise governance practice. "So it's only natural that SAP and Oracle lead the way." The same goes for BPM, consultants say.

With these recent acquisitions--and the in-house development, notably in SAP's case--of the technology necessary for GRC applications, Oracle and SAP hope to provide end-to-end systems that manage accumulated information, pump it into an analytical framework and then relay highlights to executive dashboards. There, performance can be measured against budget, revenue, costs, risk and even peer group data enabling managers to see where there is a glitch and immediately correct it or where they stand against their rivals. The giants will provide the seamless integration of a one-stop shop.

That's necessary, explains Dittmar, because precise interfaces are essential. "It's like a bunch of Lego blocks scattered across a table," he says. "Unless they come together in an integrated way, they are of no use."

To be sure, it will be some time before the pieces are all snapped together and ready for sale. In fact, says Michael Rasmussen, vice president and head of GRC research at Forrester Research Inc., "it will be 12 to 15 months before SAP and Oracle are aggressively doing deals [to sell the recently acquired functionality]. Right now they are developing their GRC suites and gaining traction."

For now, though, interest remains limited. According to a recent survey conducted by the Open Compliance and Ethics Group (OCEG), most companies acknowledge the high costs and risks of fragmented GRC efforts, yet few have implemented the technology. The interest is there, however. About 75% said they would scrap their existing technology and start over with the latest products if they could.

The fact that a growing number of companies feel an impetus to move to the next level of compliance could help those niche players remaining make inroads. Of course, that also makes them more attractive for the big fish. Although the niche players cannot provide seamless integration, the preponderance of service-oriented architecture is making interfacing less onerous.

Do these smaller companies ultimately face extinction? Maybe not immediately, but down the road, consultants say. "It's survival of the fittest," says Rasmussen. "Even companies with outstanding technology or sales and marketing momentum will disappear, if they can't build their market presence. So even good technology ends up dying."
Or, as Dittmar put it: "When the elephants dance, the mice are in trouble," says Dittmar. "And the elephants are dancing."

But not all the best-of-breeds will get squashed in the acquisition stampede. Some will be acquired and others are already beginning to partner up to gain the heft they need if they even dream of one day walking among the giants. For example, in January, Securac Holdings Inc. and Certus Software Inc., both industry-leading providers of GRC software and services, merged. Another advantage the niche players have is being able to move quickly and stay ahead on the technology.

Meanwhile, IBM, Microsoft and H-P stand silently by, perhaps waiting for the dust to settle. Consultants say their strategies differ and it's hard to see them invading this space, especially moving up from the small- and mid-size businesses they now serve to large corporate clients, without acquisitions. Which is why the IBM/SAP rumor got so much ink. Some consultants say it could use IBM's riches to pour into more in-house development, and for future acquisitions.

As for the big question mark, Cognos: "The acquisition of Cognos may very well be a way for other companies to move up," says Bruce Myers, managing director at financial advisory firm AlixPartners. "It would certainly expand their customer base and make them more appealing to larger corporations."

But Cognos is resolute in its pledge to remain independent. "Cognos now stands as the independent performance management provider in the market and is committed to giving customers equal access to their entire infrastructure, applications and data sources," says CEO Rob Ashe. "We will continue to pursue an 'embrace and extend' strategy."

Then again, Business Objects insisted it wouldn't be sold--right up to the day SAP bought it.


Advertisement. Closing in 15 seconds.