Over the past 10 years or so, the choice and number of services that can help businesses be more efficient has increased. Whether it’s an email newsletter service, a necessary website plugin, or just plain old Office365, you can easily subscribe to any of the thousands of services. But in many cases, managing service accounts feels like an afterthought.
The well-known phenomenon of shadow IT in the form of employees getting subscription services on a corporate credit card is understandable frustration for those who have to pick up the pieces. Apart from the “WTAF? The reaction when IT takes over services is a well-worn joke. What is much less of a joke is trying to transfer the ownership of the account of those same services into good hands. This is of paramount importance when it comes to changing billing details. A particular credit card or virtual card may have been used consistently across all departments. However, the person to whom he is attached leaves his role or leaves the organization altogether.
Here is a selection of issues that organizations of all sizes are likely to encounter:
In a recent conversation, a vendor CEO told me that in a startup they were engaged with, the company estimated (but wasn’t sure exactly) that the company was using more than 120 service instances of one type or another. ‘another. It’s all too easy to forget what you have in your tech landscape, a problem that gets worse when, like many companies do, they test and use, then abandon services. Or, they use the services for a while and then forget to cancel the subscription.
Discounts and automatic renewal
We have long been advocates of “pay as you go”, but many services offer attractive terms for longer subscription periods. So, for example, if you’ve found real utility in a service that offers a good discount in exchange for paying a year in advance, then who isn’t going to accept that? But what if, as is too common, the service provider doesn’t remind you that the subscription needs to be renewed and automatically charges you. This may not be a problem for a popular service in use, but it can be a real headache when there is a late change of service provider. Again, it’s too easy to forget what’s in the service store cabinet and then bingo! You are hooked on something that you no longer need.
The myriad of ownership models
You might think that ownership of services is an industry standard with corresponding processes, on the contrary. The ways in which you should interact with the technical support of a service provider are many and varied. Here are some pitfalls:
- No obvious way to change account ownership credentials without going through tech support and an associated email exchange.
- Submit a change of account owner request that gets lost in the tech support reshuffle. It does happen, but it’s easy to ignore if you make a lot of changes at the same time.
- No obvious way to transfer account ownership to an existing user who already has administrator rights. It’s a weird case where you find yourself in what appears to be the IT support equivalent of going around in circles when you click on My Profile, Account Settings, Billing Info, and vice versa in a futile attempt to find what you need.
- Changing ownership rights by simply changing the email address of the account owner. This is particularly unpleasant as there is often no requirement to provide a new password. This often means manually assigning a new password which the new owner must then replace with the one of their choice in order to ensure the security of the account.
- Multiple simultaneous connections when changing account holder. It is a voucher that demonstrates appalling security. First, you change the administrator rights of the target user so that they get the ownership rights of the account. This is done while the account owner is logged in. This may also include a password change, which is done separately from the contact details. At this point you would want to verify that the target person has the type of access you want, so you make a call and walk them through the new identification process. You are logged into the account all the time, albeit with changed credentials, because guess what? The system did not sign you out when you changed the account details. And there you have it, your target user can go for a long time simultaneously without error message or alert. This is surprisingly common and raises the question: how secure is the service in the first place?
- Inadequate or outdated documentation that triggers a request for technical support. Check whatever service you are using and type “change ownership” or “account owner” in the help section and see how far you go. Too often the information you need is undocumented or vague.
- The suggestion is that you use a generic email address like dbadmin @ … so the ownership doesn’t have to change. This might be a way to go, but you should always think about password security when the person administering the accounts changes.
- Account details can be edited manually but without confirmation from the new account holder that they are an authorized person. This may not matter in a small business or an owner-run business where the number of people involved is relatively small, but imagine what it is like in a business with, say, 500 people, who have all access to services and who have also purchased their own services.
It follows from the above that many departments don’t seem to care so much about thoroughness in their billing processes. As long as they can suck the money out of a credit card, they’re good to go. Many departments do not have any degree of automation to link the service payment and invoice to your accounting system. For me, these are table stakes in the 21st century, but there are also a lot of pitfalls here.
- If you are using a third-party service to capture billing and expense information – say a ReceiptBank or Expensify – then it would be great if the functional services you use offered the ability to have multiple email addresses for account holders and the e-mail address processing service. It’s not as common as you might think. Quite often a service provider only allows one email address for account holder information, which is not good at all.
- Some service providers do not issue invoices but only provide a receipt. I suspect this violates local compliance requirements.
- Others will send an email with an invoice attached. In these cases, you must forward the invoice to the third-party chargeback service. It’s not a huge ordeal and, you can argue, acts as a reminder of what you are paying for. Even so, it represents friction.
- Others will send an email with a link to find the invoice which you will then need to download and process manually. Hmm.
Name me a tech vendor and I’ll tell you with almost guaranteed certainty that they’ll have the phrase “digital transformation” tattooed on their marketing materials somewhere. What that phrase means is still open to discussion, but in my world it starts with the digitization of services and the automation of processes. You would think there are enough API hooks to make things easier, but not in the area of service account management. There is no consistency of approach which I find ironic because it is an administrative function that should be standardized horizontally.
After going through the process of changing account ownership on a dozen departments, I can say that the time spent resolving account ownership and billing transfer is ubiquitous, with surprises around every turn. It shouldn’t be that way.
You might ask – isn’t there an app for this? Not that I could find. If you know better then contact me as this is an issue that should be resolved.