Owen Morris, Operations Director at Doherty Associates

Even prior to the pandemic, research revealed how over a quarter of private equity professionals felt their firms’ due diligence to protect against cyber security was poor. Prior to Covid-19, some Private Equity firms wanting to maintain secrecy used their office buildings as physical firewalls and some even used sound-proof meeting rooms to avoid sensitive data leaking out. Now, fast forward to today’s virtual workplace borne out of the crisis, where a greater number of PE professionals are benefiting from the flexibility of working between home and the office.

Home working can result in greater productivity, but a rush to fully remote working and inadequate remote security systems can suddenly make a PE firm’s dispersed workforce an ideal target for cyber attackers seeking lucrative, highly confidential financial data.

It’s therefore no surprise that PE firms are frequently asked to sign nondisclosure agreements (NDAs) by prospective portfolio companies, protecting against a breach of confidential information including cyberattacks. This demand by clients for tightly worded NDAs will only rise as remote access to information becomes ever more commonplace.

Not every company may want to sign an NDA due to the associated constraint on operating within an industry sector and possibly with competitor companies.  Implementing appropriate information security controls can both avoid the need for an NDA by satisfying partners of appropriate levels of safety, or, if one is in place, ensure that the obligation for confidentiality can be met.

Starting Out

Start with defining a location where any data under NDA is stored and where controls are enforced.  This means that policies can be applied that allow the data to be controlled to meet the requirements of the agreement.  When choosing a platform, it’s important to ensure that it offers features to label the data as being protected and either prevent data leaving the protected location or to protect it even if downloaded.

Securing in place

Once a location is created and data is stored within it, it’s important to understand where the data will be physically located and whether it’s properly protected.  Encryption is one of the main risk mitigation tools that should be in place across the board.  Where companies might previously have looked at this for mobile or laptop devices only, the pandemic has meant that devices are now dispersed much more widely, or conversely, might be in largely unattended locations.  Theft is probably a bigger risk than ever.  Encrypt all devices across the board, and ensure that a remote wipe facility is in place.

Where data can be shared with third parties or could be stored on home machines in a ‘bring your own device’ scenario, encryption remains an option. Some next generation products offer encryption within documents that can be used to allow features such as ensuring that documents can only be read by the person that they are sent to and cannot then be forwarded.  These features can also be used to allow documents to be ‘timebombed’ – for example, documents could be made inaccessible after an NDA expires.

Knowing the right people have access

A successful information control ensures that the right people have access to the data and people that shouldn’t, don’t.  Being sure of the identity of the people accessing the data therefore is paramount.  Unfortunately, passwords are no longer sufficient as a way of identifying users and multi-factor authentication (where you have a combination of something you know – the password, and something you have – a phone or biometric like a fingerprint) proves it is you.  Locking down sharing of documents to specific people or organisations is a key way of ensuring this.

Keeping your data close

The flip side of the coin to sharing with other parties is ensuring that data doesn’t leak out to other people that shouldn’t be able to access it.  Some next generation platforms come with Data Leak Prevention features that can identify documents as having been marked as protected and prevent them being sent by email or shared through the platform to untrusted parties.

Getting rid of the data when you’re done

The best way of reducing data protection risk is not to have the data at all!  This is where using technology can help.  By marking the data as being under the NDA it allows organisations to trace where that data is (potentially even outside the organisation) and automatically remove it when it no-longer needs to be kept using features such as retention policies.

What do we do in a breach?

The job of responding to a breach is made much easier by having a defined, rehearsed breach response process.  Once this is in place, implementing the technological controls above puts companies in a good position to confidently respond to a breach.  By knowing where the data is stored, forensic investigations are made much easier.  Device management, wiping and encryption reduces risk of data loss and strong access controls plus data leak prevention can reduce the likelihood of data being accessed and exfiltrated.

Covid-19 restrictions and ongoing uncertainty have prompted a fundamental switch in mindset across a multitude of different sectors. Many organisations have begun to recognise that outsourcing their finance can make them more agile and give them the competitive edge they need to compete and scale effectively in today’s market.

Mark Pullen, CEO at Xledger  explains to what extent outsourcing can boost resilience for a lockdown recovery.

Solving the pain points

Inefficient processes are prone to causing delays and errors which can have a huge impact on the bottom line when viewed at scale. They can also negatively impact the client experience, causing frustration with missed deadlines and mounting uncompleted tasks.

New finance technology is automating many of the daily, monotonous back office functions such as bank reconciliation and invoice entry, meaning that the nature of the work that a finance professional provides will change. This presents a huge opportunity as it gives these employees the opportunity to be involved in higher-level work. Technology can also provide a resource that gives real time insight, allowing for better strategic decision making, which is so key in the current climate.

Optimising your finance function

Outsourcing high-value services within the finance function can improve workflow by implementing a defined and transparent process which streamlines operations. For a finance department, this can speed up areas that require internal controls such as expense reporting and cash release, but it can also speed up the full lifecycle of a project; from time tracking and resource to accounting and billing.

There is also a cost efficiency benefit when outsourcing, as management bandwidth is effectively increased by eliminating the need to be involved in many of the day to day processes. Instead this time can be focused on other business priorities and planning for future growth.

Outsourcing accounting functions to bespoke and standardised technologies means using data led processes that can be measured, optimised and benchmarked against in-house requirements. These processes can also be undertaken remotely, boosting the resilience of your business in these uncertain times.

Case study box-out: RPC Tyche

RPC Tyche is a global insurance software supplier with offices in London, Paris, and the USA. Initially a division of award-winning law firm RPC, but now a stand-alone entity, RPC Tyche’s main software offerings support capital modelling, and pricing commercial insurance and reinsurance.

The challenge

As part of a restructuring process following the de-coupling with the law firm RPC, RPC Tyche had to separate its back-office processes. They remained under the umbrella of the law firm while the changes were taking place, so initially had some flexibility with the shared finance system, but time was running out to separate the two entities cleanly. As a stand-alone company, RPC Tyche now needed its own financial system; one that could align with its new business processes and that could be implemented quickly to deliver the organisation’s business objectives. Furthermore, they needed a new finance solution that could help them grow exponentially, facilitate a globally diverse group structure, and still maintain efficiency when operating as a small team.

Gavin Dilley, Chief Finance Officer for RPC Tyche commented, “Following an initial discussion with a third-party advisor regarding Xero and Quickbooks, we were recommended Xledger because we required a swift and scalable solution. After contacting Xledger, their tried and tested implementation methodology ultimately assured us that we would achieve the fast-paced implementation needed for our go-live objective. We also really liked that Xledger was a multi-tenanted, true cloud solution with its scalability setting it apart from the competitors.”

Implementation and training

Following conversations with Xledger, RPC Tyche created a project management team to keep everything on track on their side, an arrangement that Gavin emphasised “worked really well.” He said that “as a small project team, the flexibility to undergo substantial configuration during the training sessions with the Xledger consultants brought focus and enabled us to dedicate sufficient time to the system without distractions.”

Although the implementation was expected to take three months, RPC Tyche experienced hold-ups owing to the separating of back-office processes, so they were pleased when it was mutually agreed to facilitate a one-month delay.

Post-implementation results

“The implementation process was highly effective, and we’re very happy with the results,” said Gavin. “Since implementing the Xledger solution, we’ve been so pleased we haven’t had to dip back into the old system as the transfer of historic data has been particularly successful.” RPC Tyche had a large volume of historic data and transactions, including timesheets and work in progress reports that were all successfully migrated to Xledger during implementation. “We’re particularly happy with how easy it has been to onboard our new Finance Controller, due to flexible training and the system being so intuitive.”

Gavin added, “Since implementing Xledger, we have far greater reporting flexibility, better distribution of skills within the finance team and are naturally more self-sufficient because we can make amendments to the system without relying on the software provider.

The system is easy to use, and the purchase order functionalities, integrated workflows and automation of processes have enabled us to be highly efficient, even as a small finance team. Not to mention that the Xledger support team are incredibly responsive, so we can continually maintain productivity.”