Risks and rewards of cloud computing in the UK public sector: A reflection on three Organisational case studies

In the governmental context, cloud computing is used as a tool to facilitate information sharing, applications processing, and as a cost-saving measure compared to traditional technological architectures (Ali et al. 2014; Shin 2013; Mukherjee and Sahoo 2010). Cloud computing platforms offer an operational model that can digitally combine geographically remote data centres into a common infrastructure, providing a prime gateway to government related services and data. Thus, allowing organisations to leverage existing infrastructure and provide public services while using fewer resources, reducing carbon emissions, and contributing to wider carbon-reduction targets (Zissis and Lekkas 2011). Besides these significant benefits, cloud computing also facilitates strategic IT architecture for organisations as it allows for ubiquitous IT where it provides users with the freedom to access cloud systems from any location as long as they are connected to the internet (Nolan 2012). According to Paquette et al. (2010) the United States federal government, began to incorporate cloud computing infrastructures into the work of various departments and agencies. The interest in exploring the cloud as a strategic component in the federal IT transformation has been expressed in favour by President Obama and the Chief Technology Officer Vivek Kundra (Miller 2009; Paquette et al. 2010). Their key reason for wanting to explore cloud computing in federal IT transformation has been in order to openly engage with citizens and spur innovation within government organisations (Paquette et al. (2010).

In the UK, government announced the establishment of an UK onshore, private Government Cloud Computing Infrastructure called G-Cloud (Cabinet Office 2010, 2011b). There are six government initiatives that have sparked the creation of this cloud computing plan:

In addition to these six existing initiatives the G-Cloud is also there to help the government improve: a) Shared Services; b) Reliable Project Delivery; c) Supplier Management; d) Professionalizing IT Enabled Business Change. The UK central government is recommending that the UK public sector deploys cloud solutions (Cabinet Office 2011b) and there have been some early adopters. For example, the London Borough of Hillingdon is one of the first UK local government authorities that has announced plans to move into SaaS platforms by using Google Apps for Business. According to the Council (i.e. local government authority), this shift into cloud computing is expected to improve its internal collaboration and productivity, giving it the scope to develop new ways of working, and produce cost savings of nearly £3 m in the coming years (Guardian 2011). Another example in the UK is Warwickshire County Council, which is to phase out its current internal email solution and implement Google Mail as part of the government’s G-Cloud computing service. The council is working closely with the Cabinet Office with a pilot, which will be the one of the first major public sector organisations to provide email services via the public cloud. Anticipated benefits had included savings due to reduced licensing costs, increased flexibility and mobile working (Computer Weekly 2011). It is apparent that there is a need to continue to transform public services and administration by the use of emerging technologies such as Cloud computing to enable transformation of the way the public sector runs and operates (Cabinet Office 2010). The UK public sector has responded to the increasing demands and in doing so has built an ICT infrastructure that in many cases duplicates solutions across various areas of government. The Government ICT Strategy (Cabinet Office 2010) ensures that the Cloud infrastructure goes through a process of standardisation and simplification, to create a common infrastructure designed to enable local delivery suited to local needs. As a result of the synthesis presented in this paper around cloud computing and its significance across government, there is much need to explore this emerging domain. Specifically identifying those constructs supportive of the evaluation of cloud computing. Better understanding these constructs, namely risks and rewards will support decision makers in government to assess the impact of cloud computing on their organisation.

Government institutions implementing a cloud computing operating model can gain value from the concentration of data that result in centralisation, which leads to better consistency and accuracy (Zissis and Lekkas 2011). The centralisation of data and application solutions has the capacity to provide additional tools, thereby enhancing timely communications and control. Reducing the time required to access both data and applications, not only across departments but also between business partners, generates stronger collaboration. Leveraging existing remote infrastructures into a common information system (IS) reduces installation and monitoring time and expense, and focuses on improving quality (Chhetri et al. 2015). By centrally managing, developing, implementing and assessing a system, costs can be amortised across the federal structure. Nevertheless cloud computing is an emerging computing service paradigm. Consequently, due to its sheer scale, complexity and novelty, there are still uncertainties, risks and concerns surrounding the technology’s maturity. The key issues presented are those relating to performance, provider trust, service provider lock-in, control, performance, latency, security, privacy and reliability (Sultan 2011; Catteddu and Hogben 2009). One of the main challenges is to ensure that only authorised personnel can gain access to data as cloud computing provides ubiquitous access to stored data (ibid). In addition, although cloud computing allows for stronger collaboration, the sharing of knowledge is also risky and cannot be done in an arbitrary manner (Trkman and Desouza 2012; Marabelli and Newell 2012; Roberts 2011). This also ties in with the problem of trusting cloud computing and its service providers (Armbrust et al. 2010). Organisations question cloud computing’s capabilities as it is an emerging technology but trusting cloud computing doesn’t lie entirely in the technology itself. The lack of customer confidence also rises from a lack of transparency, a loss of control over data assets, and vague security assurances (ibid). Therefore, while cloud computing remains one of the top technology investments, the deployment of these technologies is being made cautiously due to its unknown long-term implications (Luftman and Ben-Zvi 2011).

Government organisations are under increasing pressure to find ways to measure the contribution of their organisations’ IT investments to enhance performance, as well as to find reliable ways to ensure that the value from these investments is actually realised (Lin and Pervan 2003; Smith et al. 2004; Xu 2012). Therefore, it is important for managers to improve their understanding of the impact of IS on organisational performance; in particular, understanding the rewards and risks related with the financial and social capital investments in developing such infrastructures (Irani and Love 2008). Proponents of the cloud argue that implementation can reduce costs and improve current IT deployment. Existing literature and practitioner reports (Wyld 2009; Sultan 2011) mainly present a few ambiguous arguments on cloud computing rewards and risks. Although these discussions present a general assessment of this emerging phenomenon, very few case studies articulate a systematic list of rewards and risks that seek to aid government organisations in their decision-making processes when choosing to use cloud computing. When it comes to theoretical insights associated with cloud computing, these tend to be orientated around for example the science of the cloud (see for example Marinescu 2013) which suggests that existing theories such as IT diffusion (Fichman 1992; Moore and Benbasat 1991) and Technology Acceptance Model (Venkatesh and Davis 2000; Legris et al. 2003) to name but a few are relevant to the cloud based computing domain. However, before assembling the literature through which those factors associated with cloud computing are to be extrapolated, an appropriate organisational lens needs to be identified. In support of identifying such a lens, a normative framework that recognises the transformational and transactional implication of cloud computing was sought. The works of Anthony (1965) provides a progressive hierarchical structure that propose the following management levels around which organisations are traditionally structured. This layered approach was considered to offer a structured approach through which the rewards and risks of cloud computing could be mapped:

These hierarchical levels are related to the traditional structure of top management, middle management, and operating or supervisory management functions. The mapping of this hierarchy to an emergent taxonomy of benefit realisation was first proposed by Irani and Love (2001a, b) and then empirically tested by Irani (2002). It is the extension of this perspective when mapped to rewards and risks of cloud computing that adds to new knowledge. In this regards, Tables 1 and 2 present a categorised list of rewards and risks of cloud computing through a lens proposed by the normative work of Anthony (1965) where this paper contributes to the normative literature. The proposed tables therefore provide a practical means to assist decision makers in making informed IT investment decisions, and help with the evaluation of business cases for the implementation of these emerging technologies (Irani et al. 2005).

There are a number of different models (e.g. Ward et al. 1996; Wilderman 1999) that exist in the academic literature to classify the evaluation of benefits of information systems. However, most studies tend to range between either depicting a very specific perspective or a very general overview of IS benefits and, additionally, lack a long-term perspective of the benefits needed for a rigorous IS evaluation. Therefore, for the purpose of this research that is to strengthen and enhance existing benefits taxonomies, the chosen benefit model is adapted from Irani and Love (2001a, b). The authors adapted a strategic planning framework proposed by Anthony (1965) and applied it to the IS domain. In this context, the authors report that IS benefits can be mapped on to three corresponding planning levels; strategic, tactical and operational. While the strategic dimension relates to benefits that are intangible and non-financial in nature (e.g. centralisation of infrastructure), the operational dimension tends to reflect benefits that are tangible and financial in nature (e.g. reduced maintenance and support). On the other hand, the tactical dimension comprises both tangible and intangible benefits such as improved business continuity and faster implementation.

While it is important to assess and recognise the rewards of an IT system, in order to complete a robust IS evaluation, it is equally important to understand the adverse implications of an IS project. This element of risk evaluation or cost implications is often ignored as it is believed that there are significant difficulties with regards to quantifying costs and risks (Irani et al. 2005). The notion of risks in this research context is referred from the viewpoint of cost implications/drawbacks or uncertainty brought about by deploying IT/IS solutions to the organisation (Kaplan and Garrick 1981). According to Saarinen and Vepsäläinen (1993) uncertainty and risk are often used as synonyms in information systems literature. Table 2 presents the risks of cloud computing in order to highlight these implications and also help decisions makers conduct robust evaluations when investing in such emerging technologies.

Given the recent emergence of cloud computing on a large scale, the call from UK central government to deploy this technology and with very few implementations in the public sector in the UK, the rewards and risks, as highlighted above from the normative literature, are now investigated from an organisational user perspective and mapped against three case study scenarios in the next section. The aim is to strengthen and add to the existing literature on public sector cloud computing and to present practical lessons for effective cloud computing deployment.

It is important for an organisation to evaluate its business objectives through continuous appraisal of its IT and also to deploy new IT developments (Andersen and Henriksen 2006; Mutsaer et al. 1998). There is a strong corporate desire in all case organisations to continue to improve the use and exploitation of IT to support improved business efficiency, decision-making, performance management as well as to serve as an important tool to engage and transact with the public. There is a consolidated IT function, which makes it easier to identify whether any IT associated financial resources are best utilised. IT functions and projects are well supported, with due diligence on return of investment. The IT maturity factor in UKLA1 would be 5, UKLA2 would be 3 and UKLA3 would be a 4 on a scale of 1 to 5 (Gartner 2011), where 5 is the most advanced and mature and 1 the least mature. These assessments were undertaken by the researchers during the case studies utilising the Gartner IT maturity measurement model.

The data collection technique was participant observation (Atkinson et al. 1994; Myers 1997) but followed the major principles of doing fieldwork research as advocated by Fiedler (1978), Bonoma (1985), Dane (1990) and Yin (2009). In the context of this and other studies of this nature, participant observation provided unique access to data points, organisational processes and idiosyncrasies that may not normally have been available to others. However, this approach does come with drawbacks that need careful mitigation and management. Bias represents a significant challenge, with the threat of the observer being ‘sucked’ into the project as an advocate rather than observer. A variety of data have been used to derive the findings presented in this paper, which include interviews, observations, illustrative materials (for example, newsletters and other publications that form part of the case study organisations’ history) and past project management documentation. Table 4 presents a collection of data sources used in this study. A variety of secondary data sources were also used to collect data with regard to the development of technology management taxonomies and the extrapolation of lessons learnt.

The authors have extensive industrial experience and have published research of a similar nature; thus, tacit and explicit experience played a major role in predefining the interview protocol to determine the blueprint of the research process. The interview protocol was subjected to the standard university process with regard to ethical approval of data collection methods and modes of collection. Notwithstanding, great care was taken to ensure that data bias did not contaminate the data collection process. An approach consistent with that used by Molla et al. (2006) when conducting exploratory research was used as part of the research design, where an iterative process of data collection, analysis, and checking was employed. This led to pattern identification and explanation building that resulted in the authors proffering descriptive lessons learnt after suitable balances and checks.

Interviews were conducted among those who were considered to be independent and most knowledgeable when it came to the human, organisational and technical factors associated with the adoption of cloud computing within the case environment. Given the relatively new phenomenon under study the aim was to explore, analyse, understand, gain insight and facilitate sense making of the three organisations. Their job functions (to elicit data) in all three cases were:

The duration of each interview was 45 min, where every interview was conducted on a ‘one-to-one’ basis so as to stimulate conversation and break down any barriers that may have existed between the interviewer and interviewee. Furthermore, all interviews took place away from the normal office environment and possible disruption (interviews were conducted in a bookable meeting room). The authors acted as a neutral medium through which questions and answers were transmitted in an endeavour to eliminate bias. Essentially, bias in interviews occurs when the interviewer tries to tweak the wording of the question to fit the respondent (this also raises the problem of inconsistent questioning) or records only selected portions of the respondent’s answers. Most often, however, interviewer bias results from the use of probes or leading questions. Shaughnessy and Zechmeister (1994) explain that these are typically used by interviewers to get respondents to elaborate on ambiguous or incomplete answers. The interviewers were also mindful of the feedback respondents gave from their verbal and non-verbal responses.

The use of interviews, documentary sources, and observations indicated that internal validity needed to be addressed to ensure robustness of the findings. Interviews, in particular, were used, with each being digitally recorded and subsequently transcribed. These were given to each person that had been interviewed to check and resolve any discrepancies that may have arisen and eliminate any interviewer bias. Bearing in mind the array of evidence that was amassed, great care was undertaken by the authors to ensure that the data collected converged around similar facts rather than emotion. The authors believe that the procedures followed in conducting the study and use of triangulation for data collection (see, for example, Jick 1979) contributed to the reliability and validity of the study, while conforming to the prescriptions of Pan and Tan (2011). Therefore, the researchers have full confidence in the veracity of the research process and findings.