This week I spoke to Jeff Rishel, vice president of IT at Graham Packaging Co., a manufacturer headquartered in York, Pa., about his company’s GRC efforts. The company, which has 80 plants in 16 countries, has been an SAP user since 1999.

Rishel said that Graham purchased SAP Virsa in the early 2000s to help with Sarbanes-Oxley compliance. But even with Virsa, he said, there was one big problem: His team still had to gather all the information manually from various sources to give to the auditors.

Graham eventually replaced Virsa with ControlPanelGRC from SymSoft Corp.,  hoping to reduce the time spent on audit preparation, attain better SOX compliance and to streamline the Segregation of Duties (SOD) process.

All three goals were accomplished. The two weeks spent preparing for the audit process was reduced to one, and Rishel said that he personally no longer has to spend two hours a month doing SOD reporting. Much of the savings in time are because of the workflow engine embedded in ControlPanelGRC. The engine automates not just SOD but many IT business processes, allowing repetitive manual tasks to be done automatically with a workflow that tracks who requested changes, who developed, who tested, who approved, etc.

But the product has other features, including a bunch of utilities that make the day-to-day lives of security administrators and SAP technical administrators easier. “It’s not software you dust off once a year to get through an audit,” said Dan Wilhelms, president and founder of SymSoft, and a leading Basis consultant.

At SAP TechEd 2009, I attended a session on compliance tips for security administrators given by Maria Jenkins, SAP’s GRC senior technical architect. During her presentation, she said, “Auditors are like accountants, they always say, ‘Show me the money.’” She went on to say that there’s really only one way to keep the auditors happy, and that’s documentation. “Documentation is the most important thing that a security administrator can provide for SOX and security compliance.”

I asked Rishel about that, and he agreed that documentation is vital. “If we have SODs we can’t resolve, they require a lot of documentation,” he said.

SAP recently announced that it will work more closely with Novell to extend GRC to more of the IT infrastructure. If you’re an SAP security administrator, what do you think of that? I’d like to hear from other SAP administrators about the GRC issues they’re facing.

Is a relational database management system just a glorified storage facility?

That was what SAP CTO Vishal Sikka implied when he sat down at SAP TechEd 2009 with two editors from SearchSAP.com to discuss a range of trends. He said, “You don’t need a relational database management system for analytics applications,” pointing to BusinessObjects Explorer and its use of the NetWeaver Business Warehouse Accelerator as an example.

Sikka is the first CTO in the history of SAP (prior to that, Hasso Plattner held that role unofficially) and at TechEd he made a good impression on SAP Mentor Jon Reed, who said of Sikka in his post-TechEd blog What I liked (and didn’t like about SAP TechEd2009):

“I welcome his honesty regarding SAP’s product rollouts. Sikka did not try to blur the lines to give an appearance that ByD is in general release. When asked, he accurately described ByD as in “limited release” in several countries.”

Reed went on to write in his blog that the most compelling things SAP has to offer are either easier to do, or only possible to do, on ERP 6.0/NetWeaver 7.x. The use of the NetWeaver Business Warehouse Accelerator for in-memory database capabilities is one example. Reed writes that a 4.x ERP customer can run a separate BW 7.0 server to access BWA, but they must upgrade their BW instance to 7.0 to make that possible.

However, Reed concluded that, based on what he heard during private SAP Mentor sessions, SAP is shifting internally from an overemphasis on upgrading to SAP ERP 6.0 to paying more attention to the existing 4.6C/4.7 installed base. Good news for those R/3 users.

As for me, what didn’t I like about TechEd? Pretty much the same thing everyone else beefed about: the fact that every presentation included a slide with that odious “disclaimer legalese” about forward-looking statements. Remember the Bobby Fuller Four classic, “I Fought the Law and the Law Won”? Evidently the same thing goes for corporate lawyers. We fought ‘em, and they won.

The keynote set the tone. As you’ll read in coverage from Site Editor Peter Bochner, SAP executives talked about “timeless software” and the importance of being ready for change - and futurist and inventor Ray Kurzweil provided some inspiration about the logarithmic pace of change over the course of history.

After the keynote, we got a press briefing on announcements from SAP about two new partnerships - or well, extended partnerships. SAP is working more closely with Novell on integrating GRC products. It’s also getting cozy with HP in data warehousing - the two companies are currently developing a major data warehousing platform with SAP BW running on HP’s Neoview data warehousing platform. At a session on the SAP-HP deal, attendees had tons of questions while speakers had some answers. I think this will be an interesting area to watch.

Tuesday night was my first experience with “DemoJam.” Introduced as “American Idol for Geeks,” the contest pits innovative application demos against each other and the winner is chosen by crowd reaction. While our SearchSAP.com assistant editor Matt Perkins focused on the visuals from the event (check out our DemoJam coverage and pictures), I roamed the standing room area talking to people about their favorite demos. No doubt the open bar contributed to the rowdy support many attendees gave their favorite demos. I have to say - picking the winner was not difficult. Using a beer keg as a prop was bound to take home the trophy!

Most of all, I really enjoyed talking to people. We met people from all across the U.S. - and across the globe. We learned about the BI plans at a sugar distributor and the manufacturing IT updates going on at a corn products manufacturer. I heard about SAP consolidation at a luxury car maker, and expanded use of Solution Manager at an oil and gas company. I learned about how SAP is used by a European grocery chain and got an update on SAP in the Netherlands — along with a lunchtime tutorial on how to say goodbye in Dutch.  And on that note, before I ramble on too much about all the great people I met here at TechEd — Tot ziens to my Dutch friends and goodbye to all from Phoenix!

This past May, SAP outlined its sustainability strategy at Sapphire in Orlando. The vendor explained how its approach to ‘going green’ focuses more on the business benefits rather than the environmental benefits alone.

If it’s the business benefits SAP is interested in, things should roll out nicely, at least according to a new report by IDC Manufacturing Insights titled Seeing the Business Benefits of Sustainability: Revenue, Profit and Inventory Management.

The report reveals that manufacturers who quickly develop green initiatives should realize a significant impact on revenue growth and cost savings. But Kimberly Knickle, author of the report, writes that there’s more to keep in mind than just the business benefits.

In many cases, what works from an efficiency or cost-saving standpoint is also better for the environment, but don’t assume the first option is necessarily the better. You still need to do a carbon impact assessment and you may even have to propose several options with varying impact on cost and emissions before you find the one that works for the CFO and the chief sustainability officer (CSO).

The 2008 SAP sustainability report, which was released at Sapphire along with the company’s Sustainability Map, proves that SAP is on the right track in terms of assessing its carbon impact, not to mention the company’s goal to reduce its total carbon footprint back to its year-2000 level by 2020, or a 49% reduction of its 2007 baseline Greenhouse Gas (GHG) emissions.

Even further, the recent SAP World Tour event in Hungary was awarded the title of “Green Festival” from the Ministry of Environment and Water. It apparently was the first time since the launch of the Green Festival initiative that a B2B conference has earned the title (until now, only large music or cultural festivals have received a similar award).

SAP also announced last month that to help close any gaps between carbon regulations and corporate execution, it is working with Microsoft and Accenture to develop a global reporting, benchmarking and analytics system for the Carbon Disclosure Project.

But it’s next week’s sessions at TechEd in Phoenix I’m interested in. At the event, SAP plans to indulge in the topic of sustainability in full, with sessions covering the Home Carbon Challenge, a social networking experiment focusing on reducing an individual’s carbon footprint through social networking and integrating “smart” devices; Greent IT through archiving and content management, which will focus on reducing the use of paper;  and sustainability practices with SAP technology and a business intelligence (BI) approach, which will cover integrating sustainability in the business strategy.

At this point, it looks like where Sapphire brought with it a general “touching-base” on the subject, TechEd should bring with it far more detail on sustainability in certain areas. In any event, with all of the goings-on with SAP and sustainable efforts, it’ll be interesting to see how much of this is going to have a substantial impact on customers.

So I took more than a little interest in recent reports that SAP is giving away CRM licenses. Of course, as several have noted, there’s FreeCRM and there’s free CRM and this is neither. Don’t forget to read the fine print, Thomas Walgium wrote. Free software isn’t really free, Ray Wang chimed in.

First and foremost, customers are still paying maintenance on the licenses, a not inconsiderable cost. Additionally, customers must buy at least 15 application professional licenses and 15 application limited professional license to get the “free” CRM.

So, it essentially sounds like a formalized process of what SAP has been doing informally for years — bundling CRM licenses in with its ERP license sales to give customers “a deal.”

It worked well enough that SAP could claim CRM supremacy even though the actual live users it had were far outweighed by Siebel. Meanwhile, SAP collects on the maintenance fees, while customers get shelfware. And shelfware is something that software buyers would do well to avoid when it comes to negotiating deals.

Besides, buyers are catching on to the expense of maintenance as we’ve seen in the recent brouhaha over SAP eliminating its low-cost maintenance option and the rise of third-party maintenance firms.

So, in some ways, this is old news. Yet, the “oldness” of it is what makes it interesting. Where, exactly, is SAP in the CRM market these days? Will it continue to simply push its CRM application to its existing customers, hoping that they don’t turn instead to a quick and easy installation of Salesforce.com? Wasn’t that what SAP CRM OnDemand supposed to solve?

By most accounts, SAP had turned the corner with its last CRM release, shedding the “ugly” label and providing users with an application they really wanted to use — even sales people.

So why the return to trick offers? Why not prove to people that the CRM product is not just something people want  — but something they want to pay for?

One trend the series did not cover was the change in hardware buying patterns. More specifically, it didn’t address the trend toward running hardware in the cloud as an alternative to buying hardware — or hardware as a service.

The dynamics of purchasing hardware are changing by the day. Bruce Richardson, chief research officer of AMR Research, is just one analyst asking whether it makes sense for companies to continue to own their servers and desktop computers.

The question is also being posed by Chris Carter, CEO of HiLn, an SAP cloud and services provider. Carter in August hosted a webinar called “SAP in the Cloud and How Soon is the Reality?” during which he demonstrated how to move a SAP landscape to the cloud. His message is that companies can attain significant cost savings by moving their non-mission-critical SAP infrastructure to the cloud. For many firms, he said that amounts to 75% of their SAP infrastructure, encompassing development, testing, training, demos and trial evaluations — in short, pretty much everything except the production environment.

During the webinar, Carter demonstrated fully functioning SAP Business One and SAP ECC 6.0 environments running in the cloud (HiLn uses the cloud services of Amazon, Rackspace, Terremark and GoGrid.) He was upfront about recommending that SAP users not yet put their production environments into the cloud, but he did say that Amazon and GoGrid are working on hosting a company’s full SAP ERP environment.

Carter is confident that security and performance are (or will soon be) non-issues. SAP licensing is another matter. He advised interested users to talk to their SAP reps to make sure they have the proper licensing on their production environments before moving anything to the cloud and to make sure they’re SAP-compliant.

According to Carter, SAP is currently supporting private clouds, but cloud providers like Amazon will start negotiating support options with SAP directly, just as it has with IBM. SAP, he said, has an internal cloud running on Citrix servers. He said he hopes that SAP will be supported public clouds in the next six to 12 months.

Carter said that one of the biggest benefits to working in the cloud will be with upgrades. For example, a company still running R/3 would be able to do migration testing to see how its data would work in ECC 6.0 or 7.0.

However, Vijay Vijayasankar, a senior managing consultant with IBM Global Business Services, has some qualms about what happens if a company’s development and QA environments are on the cloud but not production. He wonders about issues like refreshing QA from production, or moving transports between these two systems, as well as backup and recovery. He writes:

I also don’t know if Solution Manager can handle such a landscape with one foot in cloud and one foot outside

Carter expects there will lots of conversations at TechEd about the cloud from not just SAP but IBM, HP and Sun. I’ll be in Phoenix to hear what they have to say. If you have thoughts you’d like to share, drop me a line at pbochner@techtarget.com .

SAP is “waiting for more guinea pigs” before releasing its SaaS-based ERP system, BusinessWeek reports and there is “still no ship date” for Business ByDesign, according to InformationWeek.

This is the same thing we’ve been hearing since SAP first announced its ambitious plans to develop and release an on-demand ERP system and have 10,000 customers by 2011. Those plans have since been scaled back significantly. SAP currently has 90 customers trying out the service. Two years ago it had 20 customers.

And while it’s important to hold software vendors to statements and promises they’ve made in the past, the fact that SAP underestimated the complexity of delivering a profitable on-demand ERP system has been well reported.

The fact that some customers can use Business ByDesign and it also needs work was reported on SearchSAP.com in July. The handful of beta testers we’ve heard from at SearchSAP.com (and those SAP has put us in touch with) have also had generally positive reviews of the product.

This is a similar sentiment to the a few nuggets of information from the event and subsequent reports.

As Managing Automation reports, “it’s two years later and SAP is still laboring over Business ByDesign,” yet some early customers are pleased. Dennis Howlett offers similar analysis that while the product is not generally available, and work remains to be done, there are users and the product is improving.

So, if there are positive reviews and SAP is making progress, is the company being particularly cautious with Business ByDesign? SAP certainly has had no problems releasing complex software in the past. The rapid pace of innovation in the SaaS market in particular in and competitive pressure in general would dictate sooner is better than later. SAP’s early estimates of 10,000 customers suggested that they had confidence in how quickly they could develop and sell the product.

So then, what is the wait?

I checked in with state of Pennsylvania Secretary of Administration Naomi Wyatt, who was planning to use some of the SAP BusinessObjects dashboards in the SAP package, to see how the tracking process was going there.

She said in an email interview that the process was going well. They built a database using SAP BusinessObjects and other SAP tools that will centrally collect all of the federal reporting requirements into a single report that will be submitted to the Office of Management and Budget.

“That we already have much of the required information in our central SAP system has given us a huge head start,” she wrote. “In addition, the Business Objects tool, which pulls information outside of SAP into a report with our SAP data, made building a comprehensive reporting solution straightforward and doable in the extremely tight timeframe we are facing.”

But in other state and local agencies, the process isn’t as advanced. And despite billions headed for states, cities and towns, the stimulus package so far doesn’t appear to be the boon to the software industry that many vendors counted on.

“We haven’t seen anybody buying any software,” said Ron Wince, CEO of Guidon Performance Solutions, a consulting firm that helps public sector agencies, among others, implement lean principles.

The ARRA sent $787 billion to U.S. state governments with the promise to its citizens that such spending would be transparent. To that end, the federal government has set up a website — Recovery.gov — that is supposed to provide up-to-date data on the expenditure of the funds.

Analysts have said software vendors were hoping some of this money would trickle down to software purchases - especially those aimed at helping ARRA compliance.

But in most cases, governments are using workarounds with what they already have, and relying on Excel for reporting, Wince said.

What’s worse, the amount of information they need to collect, and a lingering ambiguity about how exactly to do so, is leading to the development of a lot of bad processes, Wince said.

What’s a government to do?

Some are getting ahead of the problem. Guidon’s been getting a lot of requests from state agencies to assess where they are and put a roadmap in place for a better IT management system, Wince said. What they’re doing with many of their clients are three to four small, one week quick-hit projects on hot spots, and completing process redesign in four to five days.

Wyatt recommends nailing down all the data required as a first step, and determine what’s already in existing systems. Then fill in gaps using other tools.

If you work in government, how are you dealing with ARRA compliance? Have you had any challenges and how are you dealing with them?

Oracle also filed more allegations in the case - filing a fourth amended complaint that attempts to make Siebel and Oracle’s database technology part of the lawsuit.

Oracle now alleges that SAP extended TomorrowNow’s illegal business model to Siebel just days after Oracle completed the acquisition. It also says that TomorrowNow’s environments ran on copies of Oracle database software that weren’t licensed for commercial or production use, according to court documents. SAP refused to purchase Oracle database licenses for TomorrowNow’s use, “even though as an authorized Oracle database reseller, they knew full well the permissible uses of database copies,” the document states.

Oracle certainly hasn’t been shy about piling on the charges in this lawsuit - amending its original complaint four times over the past two years. One now has to wonder what this means for Rimini Street, and whether it will now be dragged into this lawsuit.

Often referred to as the cash cow of the enterprise software world, maintenance is a perennial hot-button issue, but very much so in the past year. SAP’s attempt to raise its maintenance and support fees was met with criticism, and similar discontent is brewing over Oracle maintenance and support fees in the Oracle customer base.

While SAP has made strides with its new Enterprise Support KPI program (though we haven’t seen many details), many companies are still interested in third-party support. Ray Wang told me a few months back that of the more than 900 clients he had talked to about the issue, between 60% and 70% were interested in exploring the option.

It’s just that there aren’t a lot of options for them to explore.

Rimini Street is the big game in town when it comes to third-party support. It just announced a global expansion of its tax and regulatory updates for more than 100 countries. In May, it announced the rollout of third-party support services for SAP R/3 releases, ECC 5.0, ECC 6.0 and BW.

Oracle maintains in its motion regarding Rimini Street that it’s perfectly legal to provide third-party support. But does merely calling into question the legality of the business practices of the biggest game in town suggest that third-party support is in for more of a battle?

Will Oracle’s latest move discourage the market for this type of service?

There’s still the matter of the European Union’s OK - which is being held up by concerns over Java, middleware and databases, according to the Wall Street Journal. But the WSJ also reports that the Justice Department’s OK is an encouraging sign that the EU’s approval isn’t far behind.  

Meanwhile, SAP CEO Leo Apotheker has been making it very clear over the past few weeks, in interviews with the Wall Street Journal and the New York Times, that SAP has no intention of following the Sun.

“I have never, ever heard a customer expressing the faintest wish for having everything delivered out of one hand,” he said in an interview with the New York Times. “Someone is probably trying to imagine wishes that they would like to hear.”

 SAP executive Bill McDermott made the same clear to me in an interview back in April.

“I think they have introduced a tremendous level of risk into their business model by making this wild foray into hardware,” McDermott said. “They know nothing about hardware and now they’ve made a move into the hardware business.”

But, if Oracle can actually deliver on its vision, would it be easier to get everything out of one hand? Are the competitive drawbacks overshadowed by the ease-of-use advantages, particularly for smaller companies, which SAP’s so aggressively courting these days?

Forrester Research analyst Stefan Reid argues that SAP should use this as an opportunity to partner more aggressively with hardware vendors in his excellent analysis “Oracle’s Sun Acquisition is a Game Changer.” He recommends strengthening relationships with Dell, HP, IBM and Fujitsu as potential partners for joined appliance and cloud-style offerings.

“Oracle’s new strength also represents a weakness until the ecosystem balances out,” he writes. “SAP should turn to the soon-to-be broken relationships between Oracle and its hardware partners into a growth opportunity.”

What do you think?