The view by the Australian Prudential Regulation Authority (APRA) that the use of global cloud-based technology providers is risky is ‘nonsense’ and ‘stuck in a time-warp’, according to a local market provider.
The comments from online superannuation, insurance and advice administration service provider PractiFI follow the release of an APRA paper that expresses concerns about the use of cloud-based technology including providers outside Australia.
In the paper – titled Outsourcing Involving Shared Computing Services (including Cloud) – APRA expressed concerns about common risks and assumptions it has seen being made by financial services providers.
APRA stated based on its concerns on observations “it is not readily evident that risk management and mitigation techniques for public cloud arrangements have reached a level of maturity commensurate with usages having an extreme impact if disrupted”.
“APRA’s stance aligns with the position of other international financial regulators who also question the appropriateness of transitioning systems of record to a public cloud environment,” the paper stated.
APRA also stated that many decisions to use cloud-based services were driven solely by the costs and benefits to the financial services provider without considering the risks.
However, these risks could be reduced if groups choose Australian hosted options as this “eliminates a number of additional risks which can impede a regulated entity’s ability to meet its obligations”.
PractiFI co-founder and sales director, Adrian Johnstone, said APRA’s approach was that “globalised, multi-tenant technologies are forever trapped as new entrants”.
“The stated position… is that anything that may be used by more than one entity, from more than one location, where the data is outside Australia, is really scary,” he said.
Johnstone asked whether APRA’s concerns held true when comparing the ability of small local operators working on a per client basis with that of a global technology provider that handles millions of transactions per day. PractiFI uses US based cloud services provider Salesforce in the provision of its services.
“Where it all breaks down, however, is with APRA’s assertion that IT risks are dramatically ramped up when using contemporary outsourced approaches. They just aren’t,” he said.
“The inference that globalised, multi-tenant technology is inherently riskier than locally-built and hosted systems is nonsense.”
