Exploring an Alternative Perspective | An Infogix Position Paper by Lane Lambert and Chris Kosin Decades of experience and research have shown that organizations maximize their return on investment (ROI) when they build or buy solutions that automate core processes. While making the build versus buy decision for automated or ancillary data integrity controls, an organization needs to determine if it is in the business of controls and how each option impacts Capital Expenditures (CAPEX) and Operational Expenditures (OPEX) budgets. “Buy to standardize, build to compete” has been an IT mantra for many years. Yet, executives responsible for developing an automated controls strategy continue to struggle with this question. The decision not only impacts the ability of an organization to meet its immediate controls needs but also has longstanding influence on the ability to maintain and sustain an internal control environment that is aligned with business needs. The rule of thumb has been: if the system is a requirement for business, “buy” is the answer; conversely if the system provides a competitive advantage, then the answer is “build.” In this paper, we propose an alternative way to look at Build vs. Buy by splitting “buy” into two options: – pre- packaged offering and configurable solution. The pre- packaged offering refers to an off-the-shelf product, while a highly configurable solution combines the virtues of a “build” solution with the flexibility and adaptability of a “buy” solution that is faster to deploy and removes the risk inherent in building internal controls. Regardless of the solution, the decision points remain the same: CAPEX vs. OPEX cost, time to deployment, internal politics, regulatory compliance mandates, architecture, IT staff competencies and strategic importance to the organization’s bottom line. However; as IT departments are increasingly stretched thin, in part due to increased data governance, audit, and overall challenges to close fragmented data integrity gaps, the case for a highly configurable data integrity controls solution becomes a compelling consideration to deliver a tailored system that capitalizes on the benefits of both building and buying. Leading organizations that use Infogix Controls have achieved significant cost savings (up to 80%) compared to internal development options. In addition, implementing Infogix Controls has enabled these organizations to rapidly deploy controls to efficiently meet changing business and audit needs. This position paper provides a framework to compare and contrast build versus buy by evaluating buy in two dimensions – pre-packaged vs. configurable – to delve into the financial and non-financial implications of these options.

1. BUILD OR BUY?
Abstract
Decades of experience and research have shown that
organizations maximize their return on investment (ROI)
when they build or buy solutions that automate core
processes. While making the build versus buy decision
for automated or ancillary data integrity controls, an
organization needs to determine if it is in the business
of controls and how each option impacts Capital
Expenditures (CAPEX) and Operational Expenditures
(OPEX) budgets. “Buy to standardize, build to compete”
has been an IT mantra for many years. Yet, executives
responsible for developing an automated controls strategy
continue to struggle with this question. The decision
not only impacts the ability of an organization to meet
its immediate controls needs but also has longstanding
influence on the ability to maintain and sustain an internal
control environment that is aligned with business needs.
The rule of thumb has been: if the system is a requirement
for business, “buy” is the answer; conversely if the system
provides a competitive advantage, then the answer
is “build.”
Leading organizations that use Infogix Controls
have achieved significant cost savings (up to
80%) compared to internal development options.
In this paper, we propose an alternative way to look at
Build vs. Buy by splitting “buy” into two options: – pre-
packaged offering and configurable solution. The pre-
packaged offering refers to an off-the-shelf product,
while a highly configurable solution combines the virtues
of a “build” solution with the flexibility and adaptability
of a “buy” solution that is faster to deploy and removes
the risk inherent in building internal controls. Regardless
of the solution, the decision points remain the same:
CAPEX vs. OPEX cost, time to deployment, internal
politics, regulatory compliance mandates, architecture,
IT staff competencies and strategic importance to the
organization’s bottom line. However; as IT departments
are increasingly stretched thin, in part due to increased
data governance, audit, and overall challenges to close
fragmented data integrity gaps, the case for a highly
configurable data integrity controls solution becomes a
compelling consideration to deliver a tailored system that
capitalizes on the benefits of both building and buying.
Leading organizations that use Infogix Controls have
achieved significant cost savings (up to 80%) compared to
internal development options. In addition, implementing
Infogix Controls has enabled these organizations to rapidly
deploy controls to efficiently meet changing business and
audit needs. This position paper provides a framework to
compare and contrast build versus buy by evaluating buy
in two dimensions – pre-packaged vs. configurable – to
delve into the financial and non-financial implications of
these options.
Introduction
An automated data integrity controls solution helps an
organization reduce costs, mitigate risks such as fraud
and revenue leakage, and streamline compliance efforts
by providing a complete audit trail of the control activity.
A number of recent market trends like the exponential
increase in transaction volume, adoption of real-time
distributed systems, and compliance requirements are
forcing organizations to automate their internal
controls environments.
While the importance and criticality of automated controls
in sustaining a cost-effective internal control environment
is paramount, executives are traditionally faced with
the dilemma between building custom controls versus
buying off-the-shelf solutions. While conventional wisdom
may provide a clear-cut answer, executives and project
teams are often tasked to present a business case for the
option that is best aligned with short-term and long-term
organizational needs.
While the “buy” option gives an organization the flexibility
to rapidly deploy controls to meet immediate needs,
it also requires financial OPEX commitment in terms of
license and maintenance fees. Similarly, the build option
gives flexibility to develop features and functionality that
are more closely aligned with the short-term needs, but it’s
also fraught with several risks such as scope and cost creep
In Automated Controls It’s No Longer the Traditional Build vs. Buy
Exploring an Alternative Perspective
An Infogix Position Paper by Lane Lambert and Chris Kosin

2. BUILD OR BUY?
that can directly impact business performance. Therefore,
it’s time to consider looking at the “buy” option from a
different perspective to determine the most optimum use
of CAPEX and OPEX, and deliver the best ROI.
Option A: Custom Built Controls
While custom built controls allow an organization
the luxury of a complete control solution tailored for
specific, unique business needs, there are significant
and unanticipated challenges. The complexity of today’s
disparate computing environments only magnifies the
difficulties of implementing and integrating custom
integration applications. Problems inherent in building and
evolving these solutions to rapidly changing business and
regulatory changes include:
• Cost of Development
• Cost of Maintenance
• Cost of Audit
• Cost of Training
• Ability to Expand and Evolve
• Time to Deployment
Most companies underestimate the resource
requirements for developing controls in-house.
Many don’t consider challenging factors like
compatibility of customizations along with
supporting new technology platforms.
Though all of these factors are critical considerations for
choosing a custom built option, let’s expand upon the
following three areas that must be considered in
greater detail:
1. Expensive to Develop
2. Expensive to Maintain
3. A Lack of Process Improvement
Expensive to Develop
Undoubtedly, expense is the number one risk associated
with custom building a controls application. Industry
studies show that companies do not achieve the ROI when
building a solution versus buying an off-the-shelf package.
A custom built solution requires a wide range of technical
expertise such as software developers, application
architects, and user interface designers that are often
scarce resources that can be utilized for other higher
priority projects. In-house development can be more
costly than it appears, with significant cost over-runs
for organizations of all sizes. These over-runs can range
from changing requirements to failing to understand the
business requirements early in the project definition stage.
Additionally, developers must be trained and code must
be carefully tested. One should also bear in mind the loss
of time and resources that could be devoted to other
projects. In fact, according to a 2015 CompTIA survey
published in eWeek, about a third of respondents re-
deploy staff from low-priority IT projects. The overall cost
of ownership can be significant in manpower and systems
usage. It has been estimated that only 26% of all software
development projects succeed.
Expensive to Maintain
Total costs during the software lifecycle can extend seven
or eight years and a significant percentage of those costs
occur after implementation. In short, maintaining and
upgrading a custom built integration application can be
an expensive proposition. Additionally, in situations where
department knowledge is siloed, alternate plans must
be made when the programmers who developed the
original application move on to other projects or leave
the organization. The maintenance burden of custom
integration applications is complex and time-intensive.
With a loss of the knowledgeable source, the maintenance
burden can grow extensively. Compounded with the risk of
poorly documented functions, the need to make necessary
changes to the application can be complex and time
consuming to implement.
No Real Process Improvements
Most companies underestimate the resource requirements
for developing controls in-house. Many don’t consider
challenging factors like compatibility of customizations
along with supporting new technology platforms. The
risk of not being well-versed in industry best practices
and regulatory requirements is another concern. In reality,
unless your organization is a software company, building
software applications should not be central to running
your business.

3. BUILD OR BUY?
Option B: Pre-Packaged Controls Solutions
The decision to purchase a commercial off-the-shelf
(COTS) data integrity solution is a viable option for many
businesses to accelerate deployment, lower development
costs, and provide authoritative industry expertise.
Nevertheless, the following potential challenges remain:
• Development of new controls can require vendor
support and external consulting
• Limitations on product architecture, scope, and
capabilities limit the ability to expand
• Maintenance cost, upgrades, and infrastructure
requirements yield additional OPEX budget
Development and Customization of Controls
Many solution providers offer a pre-defined set of software
controls that are seemingly ready for deployment. While
the initial phase may fulfil short-term requirements, a pre-
packaged solution often requires substantial resources
to customize or expand the controls to the organization’s
unique business requirements. A thorough risk assessment
is often required to address complete regulatory
compliance.
Limited Scope and Capabilities
The major reason for acquiring a pre-packaged solution is
to effectively and efficiently support one or more business
processes. However, this could be a shortsighted view;
it’s in the best interest of the organization to not limit
the scope to just the project at hand. In order to gain
the greatest ROI, the software provider must be able
to adapt to an ever-evolving process and meet future
business requirements. The failure of a solution to meet
this capability will merely result in a short-term fix and not
a long-term solution. Pre-packaged solutions often require
an organization to change their business process, rather
than having the software adapt to the business’ needs.
Maintenance Cost
Ideally, the selected provider chosen is on the forefront of
technical advancement. Of course, with this advancement
comes the need to upgrade over time and with each
upgrade comes cost in addition to the vendor’s annual
maintenance fees. Upgrades are vital so that the
organization can take advantage of the latest feature
and security enhancements, but as commonly accepted:
upgrades do have a cost to the organization in regards to
manpower and time requirements. Additional cost could
include infrastructure upgrades.
Option C: Configurable Controls Solution
Ever-changing technology and business model pressures
are forcing industries to deliver new and improved
products and services at a pace most companies
struggle with providing the resources to maintain. With a
configurable controls solution, it is possible to attain the
best of both “build versus buy” worlds: buy a customizable
industry-specific solution built on best practices for that
industry, from an outside firm, all while allowing for future
expansion and continuous growth.
The advantage of a configurable controls solution is the
ability to capitalize the vendor’s best practice expertise in
creating and identifying an ideal solution while minimizing
internal resource constraints and CAPEX budgets. The
key attribute of a configurable controls solution is in
the software development that is purpose-built to allow
configuration to the unique business processes of the
organization. This approach minimizes the company’s
financial risk while deriving a positive impact on the ROI
over the lifetime of the controls application.
As with any option, there are challenges to the
configurable controls solution. These include:
• Evaluating vendors that offer a best-in-class buy
solution that is purpose-built to be customized and
tailored to your unique requirements.
• Identifying a break-even point for measuring ROI or
capturing value
• Seamless integration amongst existing organizational
infrastructure
• Configurable capability to ensure seamless expansion
opportunity
Deciding Which Option is Best
In order to help determine which option is best suited for
the needs of your organization, here are some insights to
help make a sound decision1
:
1 Gilbert, J.B., “Build vs. Buy” White Paper 2006, EH&S and Crisis Management Solutions

4. BUILD OR BUY?
1. Perform a Needs Assessment. A needs assessment
allows you to objectively identify the needs of
various internal and external stakeholders. If a needs
assessment cannot be conducted with internal
resources, a third party with best practice expertise
can provide a credible recommendation to build a
business case.
2. One Size Does Not Fit All. Adapting your business
processes to off-the-shelf software or adapting the
software to the business can be a challenge. Consider
what alterations will be required to adapt the system
for your organization.
3. The Business Issues are Not Unique. Chances are,
while a business may have a unique perspective,
another business has addressed the same issues, but
with a different twist. Learn from others before trying
to reinvent the wheel.
4. IT Best Practices Should Be Employed. Follow
these suggested development philosophies for
creation, deployment, and extended life of software
systems:
• Adapt the process; right-size and continually improve
• Balance competing priorities of the stakeholders
• Collaborate across impacted teams
• Illustrate value repetitively
• Quality needs to remain the focus beyond software
requirements
5. Measure what’s Important. Create Key Performance
Indicators (KPIs) to measure quantitative, relevant and
comparable principles.
6. Software as a Business is Risky. Unwanted risk is
a potential problem that may cause loss or threaten
the success of a project through increased CAPEX or
OPEX cost, deployment delay, or benefit reduction.
Some risks include dependencies, management
issues, lack of knowledge, and issues with both
organizational and regulatory requirements.
7. Software Development is a Niche, and Not for
Everyone. If you decide to build, be sure to invest
in enough resources for both the development and
maintenance of the application.
8. Avoid Speed Traps. Do not intentionally or
inadvertently give in to unrealistic deadlines. Unclear
requirements, roles and responsibilities can curtail
the pace of the project and compromise the business
requirements.
9. Watch for Hidden Costs. Budget for the present and
the future of the application. Plan for maintenance
and upgrade expenses so that you have a
comprehensive view of the costs.
Why Leading Companies Choose Infogix
Infogix as a configurable controls solution provider
offers many advantages to a customer looking for a
tailored solution. With its internal team of product
developers, strategic service managers, and project and
implementation experts, Infogix offers various alternatives
to partner with you in developing and deploying a
customized, automated controls solution in a timely, and
cost-effective manner. The Infogix data integrity controls
solutions sits on top of your data processes and monitors
the data looking for errors, or risk, and provides detailed
visibility and reporting. A benefit of using Infogix lies in the
improvements and upgrades possible through available
support and maintenance agreements.
Infogix, with over 32 years of experience, works with
some of the world’s most data-intensive organizations
across multiple industries. Infogix understands industry
requirements from both business user and technology
perspectives. Infogix solutions can be incorporated into all
business processes required for successful implementation.
Infogix uses the philosophical approach for its best
practices, which allows continuous learning
and improvement.
Infogix software provides the capability to feed data
into powerful analytic reporting, which enables valuable
real-time capabilities and trends on KPIs. This allows for
significantly improved and faster decision-making.
Financial Benefits
With decades of industry experience and knowledge,
Infogix has internal case studies demonstrating substantial
financial benefits. On average, Infogix customers have
enjoyed the following advantages:

5. BUILD OR BUY?
Infogix
Value
Lower
Development &
Maintenance
Cost
Lower Training
Cost
Lower Audit
Cost
Higher
Effectiveness in
Preventing
Errors
Summary of Benefits
The below graph outlines case study results in the development, maintenance, audit and training resources associated
with the implementation of automated controls.
Assumptions Infogix Internal Development
Effectiveness 0.9 0.75
Development effort per control (hrs) 40 120
Development cost per control ($) 1600 4800
Avg Maintenance Effort per control per year (hrs) 8 36
Avg Maintenance cost per control per year ($) 320 1440
Percentage of controls subject to audit (%) 40% 40%
Avg audit effort per control (hrs) 2 8
Avg audit cost per control ($) 32 128
Avg cost cost avoidance per control per year ($) 240 200
Cost of training per year 80 hrs total 5 hrs per interface
Infogix Solutions provide significant cost savings compared to internal development options through the use of
standardized and reusable controls and components. From the analysis of the numbers, we can calculate the following
results:
• Cost of Development: 85% lower than the internal developed*
• Cost of Maintenance: 80% lower than the internal developed*
• Cost of Audit: 75% lower than the internal developed*
• Cost of Training: Standardized training versus control specific training
*Results based on Infogix internal average case findings.

6. BUILD OR BUY?
Non-Financial Benefits
Benefits of an automated controls solution should not be measured on financial results alone. Listed below are some
non-financial benefits that will be recognized.
Usability and Productivity
Role based intuitive interface to increase usability
Reusable components and rules to increase productivity
Independence & Standardization
Independence to meet audit and compliance requirements
Standardized components to decrease deployment time
Support & Partnership
Multi-tier and dedicated resources to support customer’s initiative
Partnership to engage customer in product and company development
• Usability and productivity allows more time to use the product than time spent in development, and reduces the
chance of a project getting placed on hold for time constraints, or worse, forgotten altogether.
• Independence and Standardization provides out-of-box visibility, monitoring and trending capability for audit and
compliance purposes, resulting in higher productivity.
• When expert assistance is required, Support and Partnership provides the ability to develop complex controls,
thereby increasing effectiveness and scaling manpower coverage of an organization. Multi-support levels are
offered to tailor the unique business support needs of the client. If staffing or resource availability is an issue,
Infogix offers managed services -- a unique combination of people, processes, and technology to operate under
outcome-driven service level agreements.

7. BUILD OR BUY?
The Infogix Value
When discussing development and maintenance cost, error prevention, audit cost, and training, Infogix has shown its
advantage over the build or pre-packaged options. Customers who use Infogix Solutions have experienced the
following benefits:
Lower Cost of Controls
• Costs 85% lower than the in-house
development option
• Cost savings through
standardization
• Lower lifecycle cost
Active Product Lifecycle
• New releases each year
• Minor enhancements and bug fixes
throughout the year
• Customer driven product roadmap
Lower Audit Cost
• Reduced testing requirements
• Enhanced controls transparency
for audit
• Audit trail for exceptions
Knowledge and Expertise
• Access to controls best practices
• Participation in maturity model
• Participation in product advisory
groups
Summary
The options for implementation of a data integrity controls solution include Build, Buy, and Infogix’s Configurable
Controls. The following table summarizes these options and corresponding benefits, cost factors and risks that need to
be considered.
Option A
Build A Custom Built Solution
Option B
Buy A Pre-Packaged Solution
Option C
Configurable Controls Solution
(Infogix)
Summary
Your Controls
Your Process
Vendor’s Controls
Vendor’s Platform
Your Controls
Infogix Platform
Definition
Controls are custom built to meet business
requirements. Each control is custom coded and
maintained
A pre-defined set of controls are provided as part
of a package.
Substantial coding and configuration changes
are required to develop new controls or change
existing controls
A controls platform is provided and controls are
developed using standardized methods.
Benefits
Much more control over the solution.
Can be customized for maximum business
advantage.
Can be cheaper because of its fixed set of
capabilities to solve a specific problem.
Provides the flexibility to customize controls to
meet business needs.
Costs
Cost of control development and maintenance.
Cost of control operation and monitoring.
Ongoing licensing costs
Cost of control customization and maintenance.
Cost of control operation and monitoring
Ongoing licensing costs.
Cost of control development and maintenance.
Cost of control operation and monitoring.
Risks
Project Delays
Cost Overruns and Scope Creep.
Controls not aligned with business needs.
Integration risks.
Integration Risks.

8. BUILD OR BUY?
Conclusion
With the accelerating changes in the source systems
that support business needs, coupled with increasing
reliance on information for critical business operation and
decisions, and an expanding (and ever-changing) array
of regulation and compliance requirements, the use of
automated information controls is a strategic necessity to
ensure information accuracy and prevent fragmentation
across the organization.
Infogix Controls provide out-of-box visibility,
monitoring and trending capability. Infogix’s
solutions are highly reliable and many are highly
productive 10, 20, and even 30 years after
their deployment.
Regardless of the industry (government, healthcare,
banking, insurance, telecom or retail), IT demands are
always in motion and on the rise. In the end, everyone
is being asked to do more work with reduced resources.
In order to determine if build or buy (pre-package or
configurable) solution is best, an honest needs assessment
should be performed to ensure objectivity. To make a
sound decision, we encourage you to review the following
questions regarding your business operations:
• Is current in-house technology keeping up with the
business needs?
• Does the needed solution provide a competitive
advantage?
• Is the solution needed now, or can it be delayed
with a stronger focus on it being more specific and
correct?
The adoption of a Configurable Controls solution is
becoming more mainstream and it’s a win-win for any
organization looking to improve their applications and
to minimize their CAPEX. Furthermore, it reduces the
number of in-house developers needed, which helps
lower development costs, frees up resources to work on
higher priority projects, and allows a more streamlined
and scalable design process. Infogix Controls provide
out-of-box visibility, monitoring and trending capability.
Infogix’s solutions are highly reliable and many are
highly productive 10, 20, and even 30 years after their
deployment. Many organizations have realized savings
between $2 million to $10 million a year when adopting
Infogix Controls as their enterprise standard.
In order to get all necessary parties on board for this
undertaking, a business case should be developed
to promote the needs of the various cross functional
stakeholders. When developing a compelling business
case, consider the following steps:
1. Quantify the benefits of automated information
controls
2. Articulate the intangible benefits of automated
information controls
3. Quantify the costs of automated controls. Consider
both one-time cost and recurring costs
4. Develop the financial model to project return on
investment
5. Summarize key findings using a business case
6. Present the business case to all the key stakeholders
When evaluating “build versus buy,” the possibility exists
to make a sound decision that minimizes risk and delivers
the best result for the business by clearly recognizing
needs, expectations, and resources strategically in
the process. While each situation has advantages and
disadvantages, the configurable controls solution is
becoming the dominant trend to minimize CAPEX and
maximize OPEX.

9. Visit www.infogix.com or call 1.630.649.6800 (US, Canada, and
International), +44 1242 674 137 (UK and Europe).
Copyright ©2015 Infogix, Inc. All rights reserved. Company, product, brand, and mark names and logos herein are
the property of their respective owners. For a list of Infogix trademarks, visit: www.infogix.com/legal
twitter.com/Infogix facebook.com/Infogix linkedin.com/company/Infogix plus.google.com/+Infogix
BUILD OR BUY?
About the Authors
Chris Kosin and Lane Lambert hold leadership positions as Customer Advocates with Infogix. They collaborate with
our clients on a daily basis, providing strategic guidance and ensuring that we deliver value-specific solutions that yield
tremendous efficiency gains and cost savings for our clients.
Chris holds a B.A. from Northern Illinois University and an MBA with a Certificate in Project Management from the Keller
Business Graduate School of Management.
Lane holds a degree in Business Management from McNeese State University.
Chris Kosin Lane Lambert