1 H O W E N T E R P R I S E S A R E C A L C U L AT I N G C LO U D R O I

G O V E R N A N C E

HOW ENTERPRISES
A R E C A L C U L AT I N G
CLOUD ROI
And Why Some Enterprises Are
Moving Ahead Without It

© 2017 ISACA. All Rights Reserved.

2 H O W E N T E R P R I S E S A R E C A L C U L AT I N G C LO U D R O I

CONTENTS
4 Cloud ROI Survey
4 / Key Findings
4 / Survey Methodology

7 Enterprise Cloud Implementations

8 Enterprises Calculating Cloud ROI vs.

Enterprises Not Calculating Cloud ROI

9 How Enterprises That Do Not Calculate

Cloud ROI Justify the Investment

10 How Enterprises Calculate Cloud ROI

13 Conclusion

14 Acknowledgments

© 2017 ISACA. All Rights Reserved.

3 H O W E N T E R P R I S E S A R E C A L C U L AT I N G C LO U D R O I

ABSTRACT
Calculating anticipated return on investment (ROI) can be valuable when your enterprise
is considering moving to a cloud service. Likewise, calculating cloud ROI after cloud
implementation allows you to determine if your enterprise is employing cloud services
efficiently and, more importantly, ensures you are receiving the anticipated gains.

Despite the value in calculating cloud ROI, the ISACA Cloud ROI Survey reveals that
fewer enterprises are explicitly calculating cloud ROI than in the past. Although
the majority of enterprises continue to calculate cloud ROI, fewer enterprises are
performing that calculation. These enterprises cite a number of challenges, including
the lack of a reliable calculation model and increased investment that is justified
solely by nonfinancial business objectives.

This white paper outlines how enterprises are increasingly justifying their cloud
investment based on nonfinancial criteria, such as enhanced business agility, shifting
funding from capital expenses to operating expenses, or business cases that have
no specific specified financial outcomes.

Those enterprises that do calculate cloud ROI are taking the time to consider and
calculate tangible costs and intangible costs, such as employee time, and factor
them into their ROI calculations, whether in a quantitative, qualitative or hybrid model.
By calculating ROI, these enterprises can see clearly the costs and benefits of cloud
computing and if they are employing cloud services efficiently.

© 2017 ISACA. All Rights Reserved.

4 H O W E N T E R P R I S E S A R E C A L C U L AT I N G C LO U D R O I

Cloud ROI Survey

How Enterprises Are Calculating Cloud ROI reports the
results of the ISACA Cloud ROI Survey, conducted in
August 2017. The survey polled chief information
officers (CIOs) about cloud return on investment (ROI)
practices. The expectation of enterprises adopting
cloud services is often that they will have lower-cost
and more-agile IT resources to support the growth of
their core business.1 Calculating cloud ROI helps
enterprises to understand the value proposition for
implementing new cloud services and ensure that their
services do not calculate ROI for cloud computing.
Sixty-eight percent of the respondent enterprises that
implemented cloud services do calculate cloud ROI.
• Most enterprises that implemented cloud services,
but do not calculate cloud ROI, based their cloud
investment solely on business objectives, for
example, better business agility, better accessibility
and a more streamlined user experience.
• Of the enterprises that calculate cloud ROI, 95 percent

cloud investment improves efficiency, i.e., they are calculate ROI before cloud service implementation,

spending money to save money and better support and 58 percent calculate ROI after cloud service

their customers. implementation (with some enterprises reporting

calculation both before and after implementation).
This report provides C-suite members and others who
• Almost all enterprises that calculate cloud ROI use
have an interest in cloud ROI with current information
operational expense impact and capital expenses/
about how enterprises justify the cost of moving
savings as factors in their calculations. Other
services and data to the cloud, methods that enterprises
pertinent factors (that over half of the enterprises use
use to calculate cloud ROI, when enterprises calculate ROI
in their cloud ROI calculation) include change in
and the results of comparing estimated ROI before cloud
staffing requirements, business impact (e.g., agility,
implementation to actual ROI after implementation.
market penetration and time to market) and
transition expenses.
Key Findings • The enterprises whose actual cloud computing ROI
The ISACA 2017 Cloud ROI Survey reveals the differed from their anticipated cloud computing ROI
following findings: attribute higher- and lower-than-expected operational
expenses, transition expenses and time savings for
• Seventy-eight percent of the ISACA Cloud ROI
employees as the main reasons for the disparities.
Survey respondent enterprises implemented cloud
computing services.

• In 2014, 20 percent of enterprises surveyed by

Survey Methodology
The ISACA Cloud ROI Survey targeted chief information
InformationWeek indicated that they do not
officers (CIOs) to gather information about current
calculate ROI for cloud services.2 The 2017 ISACA
cloud ROI practices. A global population of over 3,000
survey reveals that that percentage is rising—
ISACA members with CIO responsibilities received
32 percent of enterprises implementing cloud
the survey invitation by email. The survey data was

1 ISACA, “Cloud Computing Market Maturity,” 2015, www.isaca.org/Knowledge-Center/Research/ResearchDeliverables/Pages/cloud-computing-market-maturity.aspx

2 Babcock, Charles; “Cloud ROI: Why It’s Still Hard to Measure,” InformationWeek, 4 August 2014,
www.informationweek.com/cloud/infrastructure-as-a-service/cloud-roi-why-its-still-hard-to-measure/d/d-id/1297746

© 2017 ISACA. All Rights Reserved.

5 H O W E N T E R P R I S E S A R E C A L C U L AT I N G C LO U D R O I

collected anonymously through SurveyMonkey®. Figure 2 illustrates that the survey participants span
The total number of individuals who participated in across 20 industries; Figure 3 shows that participants
the survey is 102. Figure 1 summarizes the survey span all five major global regions.
respondents’ demographics.

MAJOR INDUSTRY SECTORS REPRESENTED

21 % 18%
Technology Services/
Financial/Banking
Consulting

13%
100% Government/Military
N AT I O N A L /S TAT E /LO CA L
A member of ISACA

MAJOR GEOGRAPHIES REPRESENTED

32%
14%
Europe

42% Asia
North
America

7%
Africa

E N T E R P R I S E S R E P R E S E N T E D B Y N O. O F E M P LO Y E E S

20% 22% 19% 16%

50–149 employees 150–499 employees 500–1,499 employees 1,500–4,999 employees

F I G U R E 1 : Leading Respondent Demographics

© 2017 ISACA. All Rights Reserved.

6 H O W E N T E R P R I S E S A R E C A L C U L AT I N G C LO U D R O I

Which of the following, if any, best describes your Please select your region.
business category?

North America 42%

Financial/Banking 21%

Europe 32%
Technology Services/
Consulting 18%
Asia 14%

Government/Military
NATIONAL/STATE/LOCAL 13% Africa 7%

Other 8% Middle East 3%

6% Latin America 1%
Insurance

Oceania 1%
Manufacturing/
Engineering 6%
F I G U R E 3 : Global Regions

Retail/Wholesale/
Distribution 5%

Advertising/Marketing/
Media 4%

Health Care/Medical 3%

Public Accounting 3%

Transportation 3%

Utilities 3%

Pharmaceutical 2%

Telecommunications/
Communications 2%

Legal/Law/Real Estate 1%

Mining/Construction/
Petroleum/Agriculture 1%

Aerospace 0%

F I G U R E 2 : Industry Sectors

© 2017 ISACA. All Rights Reserved.

7 H O W E N T E R P R I S E S A R E C A L C U L AT I N G C LO U D R O I

Enterprise Cloud Has your enterprise implemented cloud computing?

(e.g., PaaS, SaaS or IaaS)?

Implementations
Yes 78%

No 22%
Seventy-eight percent of the ISACA Cloud ROI Survey
respondents’ enterprises implemented cloud computing Don’t know 0%

services, as shown in figure 4. The distribution of

F I G U R E 4 : Enterprises That Implemented
cloud type deployed (i.e., architecture model) was
Cloud Services
diverse, as shown in figure 5, with a majority (84
percent) investing in Software as a Service (SaaS),
and a significantly smaller percentage investing in Which cloud computing services does your enterprise
Infrastructure as a Service (IaaS) (49 percent) and use? Select all that apply.

Platform as a Service (PaaS) (36 percent). Cloud ROI Software

calculations are significantly different among the cloud as a Service
(SaaS) 84%
types, with some being more rigorous than others.
Therefore, cloud type may be a factor in the decision of
Infrastructure
whether to calculate cloud ROI.
as a Service
(IaaS) 49%
Although new enterprises have the opportunity to
implement cloud computing services from inception, Platform as
the majority of new enterprises that implemented a Service
(PaaS) 36%
cloud services indicate that they did not employ cloud
services until later (figure 6).
Don’t know 0%

Other 0%

F I G U R E 5 : Implemented Cloud Services

If your enterprise is relatively new, did your

enterprise use cloud computing from the time of
start-up?

Yes 44%

No 56%

F I G U R E 6 : Enterprises Implementing Cloud

at Start-up

© 2017 ISACA. All Rights Reserved.

8 H O W E N T E R P R I S E S A R E C A L C U L AT I N G C LO U D R O I

Enterprises Calculating Cloud

ROI vs. Enterprises Not Calculating
Cloud ROI
In 2014, 20 percent of enterprises surveyed by Of the enterprises that calculate cloud ROI:
InformationWeek indicated that they did not calculate
• Forty-three percent only calculate ROI before
ROI for cloud services.3 The 2017 ISACA survey reveals
implementation of cloud services.
that the percentage is rising—32 percent of ISACA-
survey enterprises implementing cloud services do not • Six percent only calculate ROI after implementation
calculate ROI for cloud computing (figure 7). Sixty-eight of cloud services.
percent of the respondent enterprises that implemented
• Fifty-two percent calculate ROI before and after
cloud services explicitly calculate cloud ROI, with some
implementation of cloud services.
performing ROI calculations multiple times.

How, if at all, does your enterprise calculate ROI for cloud computing?

We do not calculate any ROI for cloud computing 32%

We only calculate ROI BEFORE implementation of the cloud 29%

We only calculate ROI AFTER implementation of the cloud 4%

We calculate ROI BEFORE and AFTER implementation of the cloud 35%

Don’t know 0%

F I G U R E 7 : Percentage of Enterprises That Calculate Cloud ROI and Percentage of Enterprises That Do Not

3 Op cit Babcock

© 2017 ISACA. All Rights Reserved.

9 H O W E N T E R P R I S E S A R E C A L C U L AT I N G C LO U D R O I

How Enterprises That Do Not

Calculate Cloud ROI Justify
the Investment
The majority (68 percent) of enterprises that implemented
If your enterprise did not calculate cloud computing
cloud services, but do not calculate cloud ROI, based their
ROI, why did it not?
cloud investment solely on financial or nonfinancial
business objectives (figure 8). Lack of a reliable Our cloud investment
was based solely on
calculation model for cloud ROI was a limiting factor for business objectives 68%
some enterprises (28 percent).

Lack of a reliable
If enterprises did not calculate anticipated cloud ROI calculation model 28%
before implementing cloud services, slightly more
than half of these enterprises justified their cloud Other 4%
investment based on nonfinancial criteria, such as
F I G U R E 8 : Reasons Why Enterprises Do Not
enhanced business agility and shifting funding from
Calculate Cloud ROI
capital expenses to operating expenses (figure 9).

Twenty-one percent of the enterprises that did not

calculate anticipated cloud ROI before implementing If your enterprise did not calculate anticipated cloud
computing ROI BEFORE cloud implementation, how
cloud services justified their cloud investment with a did it justify the investment in cloud?
business case that is supported by multiple financial
metrics. For example, an enterprise creates a business A business
case supported
case that includes financial outcomes, such as
by multiple
anticipated cost savings from transitioning to the cloud. financial metrics 21%
This type of business case differs from ROI, because the
business case financial metrics may not include the Justified on
nonfinancial
specific value proposition from the cloud usage itself
criteria (e.g.,
and instead, focuses on more business-centric business agility,
financial metrics. capex vs. opex,
other factors) 52%

Another 21 percent of the enterprises that did not

calculate anticipated cloud ROI before implementing Business case with
no explicit metrics 21%
cloud services justified their cloud investment with a
business case that has no explicit metrics. For example,
Did not justify 6%
a business case states that cloud supports the overall
strategic direction. Six percent of the respondents F I G U R E 9 : How Enterprises Justify Cloud

indicate that they did not justify the cloud investment Investment If They Do Not Calculate Cloud ROI
Before Implementation
before cloud implementation.

© 2017 ISACA. All Rights Reserved.

10 H O W E N T E R P R I S E S A R E C A L C U L AT I N G C LO U D R O I

How Enterprises Calculate Cloud ROI

Enterprises can use quantitative, qualitative and hybrid
models to calculate cloud ROI. A quantitative model is What method do you use to calculate cloud computing
built on specific numeric criteria. For example, an ROI? Select all that apply.
enterprise may expect to realize an overall cost savings
Quantitative model 45%
of US $150,000 over a given amount of time. A qualita-
tive model, by contrast, can be ranked, but generally
Qualitative model 23%
does not include specific numeric targets as part of the
model. For example, an enterprise may estimate its
Hybrid model 49%
cost savings in reduced IT overhead to be high and its
cost savings on support to be medium. A hybrid model
Don’t know 6%
is a combination of quantitative and qualitative models.

Other 0%
The hybrid model and the quantitative model for
calculating cloud ROI are used most often by
F I G U R E 1 0 : Cloud ROI Calculation Methods
enterprises that report that they calculate cloud ROI
(figure 10).

Most enterprises use a time frame of one-to-five What time frame do you use to calculate cloud
years for calculating cloud ROI (figure 11). One computing ROI?
survey-respondent enterprise calculates cloud ROI
Less than 1 year 6%
over the life of the cloud-service contract.

1 to 2 years 36%

3 to 5 years 55%

6 to 10 years 0%

Don’t know 2%

Other time frame —

Life of contract 2%

F I G U R E 1 1 : Cloud ROI Time Frame

© 2017 ISACA. All Rights Reserved.

11 H O W E N T E R P R I S E S A R E C A L C U L AT I N G C LO U D R O I

Almost all enterprises use operational expense impact

and capital expenses/savings as factors in their cloud Which factors does your enterprise consider in its
cloud computing ROI calculation? Select all that apply.
ROI calculations. Other pertinent factors that over half of
the enterprises use in their cloud ROI calculation include Operational
change in staffing requirements, business impact (e.g., expense
98%
impact
agility, market penetration and time to market) and
transition expenses (figure 12). Respondents specified
Capital expenses
additional ROI factors: or savings 91%

• Unique availability of platform or service

Change in staffing
• Security offerings requirements 68%

Results for the 44 enterprises that compared the Business impact

anticipated ROI for cloud computing to the actual ROI (e.g., agility, market
penetration, time
are distributed evenly across possible outcomes, with
to market) 66%
slightly more enterprises reporting that the actual ROI
is the same as the anticipated ROI (figure 13).
Transition
expenses 57%
The enterprises whose actual cloud computing ROI
differed from their anticipated cloud computing ROI Time savings
attribute higher- and lower-than-expected operational for employees 49%
expenses, transition expenses and time savings for
employees as the main reasons for the disparities Other — Unique
availability of
(figure 14). Employee-resource time—for example,
platform or service;
time spent on level-two support—is often difficult to security offerings 4%
estimate. One enterprise reported that additional
services were required to achieve the expected benefits. Don’t know 0%

F I G U R E 1 2 : Cloud ROI Factors

How did the anticipated cloud computing ROI value

compare to the actual received ROI?

The actual ROI

was higher than
the anticipated ROI 32%

The actual ROI

was lower than
the anticipated ROI 30%

The actual ROI

was the same as
the anticipated ROI 39%

F I G U R E 1 3 : Anticipated vs. Actual ROI

© 2017 ISACA. All Rights Reserved.

12 H O W E N T E R P R I S E S A R E C A L C U L AT I N G C LO U D R O I

You indicated that your actual received ROI after implementation differed from your anticipated cloud computing ROI value.
What caused the difference? Select all that apply.

Operational expenses
higher than anticipated 32%

Transition expenses
higher than anticipated 32%

Time savings for employees

higher than anticipated 32%

Operational expenses
lower than anticipated 25%

Capital expenses
lower than anticipated 21%

Transition expenses
lower than anticipated 18%

Business impacts worse

than expected 14%

Business impacts better

than expected 11%

Staffing requirements
higher than anticipated 11%

Capital expenses higher

than anticipated 7%

Staffing requirements
lower than anticipated 7%

Time savings for employees

lower than anticipated 7%

Other — Additional
services were required to
achieve expected benefits 4%

F I G U R E 1 4 : Reasons for Differences Between Anticipated and Actual Cloud ROI

© 2017 ISACA. All Rights Reserved.

13 H O W E N T E R P R I S E S A R E C A L C U L AT I N G C LO U D R O I
Conclusion
When enterprises consider moving to the cloud,
calculating anticipated cloud ROI is potentially valuable
for supporting their decision. Likewise, calculating cloud
ROI after cloud implementation allows enterprises to
determine if they are employing cloud services efficiently
and if they are realizing the expected financial benefits
that they planned at the outset.
The initial response to—and perception of—a cloud
computing investment can either be that it is
expensive or that it represents a vehicle for large-scale
cost savings. Unless ROI is explicitly calculated in
advance and used as a measuring instrument for
validating outcomes, the ability to refute or validate
those perceptions can be difficult. Despite the value
of calculating cloud ROI, this survey suggests that
more enterprises than in prior years are moving
ahead with cloud computing without performing this
analysis. Potential reasons for not performing ROI
calculations include:
• Technology practitioners are becoming more familiar
with cloud computing.
• Detailed ROI calculations are deemed unnecessary to
validate investment.
• Nonfinancial outcomes are increasingly seen as
sufficient to justify investment, regardless of potential
financial impacts.
Although the majority of enterprises do continue to
calculate cloud ROI at some point in the cloud
implementation process, the challenges associated
with the mechanisms available for them to do so are
4 ISACA, “Calculating Cloud ROI: From the Customer Perspective”, July 2012,
www.isaca.org/Knowledge-Center/Research/ResearchDeliverables/Pages/Calculating-Cloud-ROI-From-the-Customer-Perspective.aspx
© 2017 ISACA. All Rights Reserved.
clear. The lack of a reliable, industry-standard
calculation model poses one such challenge. ISACA
has, in the past, proposed mechanisms for calculating
cloud ROI, for example, in the “Calculating Cloud ROI:
From the Customer Perspective” white paper.4 However,
without an industrywide consensus for cloud ROI
calculation, adoption of a formalized model is
understandably stunted.
Another limiting factor is justification of the investment
solely using business objectives. Enterprises are
increasingly justifying their cloud investment based on
nonfinancial criteria or on a business case that either
includes financial outcomes (without explicit ROI) or
does not have financial metrics. These practices
suggest that cloud services are expanding their appeal
to enterprises in ways that are not tied to specific
financial objectives. For example, cloud services enable
users to access services from anywhere or from any
device. As these features become more refined,
financial justification for investment may become less
important to the overall value proposition.
Despite this, enterprises that do calculate cloud ROI
are taking the time to consider and calculate tangible
costs and intangible costs, such as employee time,
and factor them into their ROI calculations, whether
in a quantitative, qualitative or hybrid model. These
enterprises are able to clearly see the costs and
benefits of cloud computing prior to investment
and compare the anticipated outcomes with actual
outcomes to validate that they are employing cloud
services efficiently and in a manner commensurate
with expectations.
14 H O W E N T E R P R I S E S A R E C A L C U L AT I N G C LO U D R O I

Acknowledgments
ISACA would like to recognize:

Development Subject ISACA Board of Directors
Matter Expert Theresa Grafenstine
CISA, CRISC, CGEIT, CGAP, CGMA,
David Casper
CIA, CISSP, CPA, Deloitte-Arlington, VA,
CTO, Global Algorithmic IT Operations
USA, Chair
(AIOps) Company, Previous Co-Chair,
Open Data Center Alliance, USA Robert Clyde
CISM, Clyde Consulting LLC, USA,
Expert Reviewers Vice-Chair
Chris Richter
Brennan Baybeck
CISM, CISSP, Senior Vice President, CISA, CRISC, CISM, CISSP, Oracle
Global Security Services, Level 3 Corporation, USA, Director
Communications, USA
Zubin Chagpar
Mike Saurbaugh CISA, CISM, PMP, Amazon Web
CRISC, CISM, CISSP, Consultant, First Services, UK, Director
Security Alliance, LLC, USA
Peter Christiaans
CISA, CRISC, CISM, PMP, Deloitte
Consulting LLP, USA, Director
Hironori Goto
CISA, CRISC, CISM, CGEIT, ABCP, Five-I,
LLC, Japan, Director
Tichaona Zororo
CISA, CRISC, CISM, CGEIT, COBIT 5
Certified Assessor, CIA, CRMA, EGIT |
Enterprise Governance of IT (Pty) Ltd,
South Africa, Director
Christos K. Dimitriadis, Ph.D.
CISA, CRISC, CISM, Intralot, S.A.,
Greece, Past Chair
Robert E Stroud
CRISC, CGEIT, Forrester Research, Inc.,
USA, Past Chair
Tony Hayes
CGEIT, AFCHSE, CHE, FACS, FCPA,
FIIA, Queensland Government, Australia,
Past Chair
Matt Loeb
CGEIT, FASAE, CAE, ISACA,
USA, Director

Mike Hughes
CISA, CRISC, CGEIT, Haines Watts,
UK, Director

Leonard Ong
CISA, CRISC, CISM, CGEIT, CPP, CFE,
PMP, CIPM, CIPT, CISSP ISSMP-ISSAP,
CSSLP, CITBCM, GCIA, GCIH,
GSNA, GCFA, Merck & Co., Inc.,
Singapore, Director

R.V. Raghu
CISA, CRISC, Versatilist Consulting India
Pvt. Ltd., India, Director

Jo Stewart-Rattray
CISA, CRISC, CISM, CGEIT, FACS CP,
BRM Holdich, Australia, Director

Ted Wolff
CISA, Vanguard, Inc., USA, Director

© 2017 ISACA. All Rights Reserved.

15 H O W E N T E R P R I S E S A R E C A L C U L AT I N G C LO U D R O I

About ISACA
Nearing its 50 th year, ISACA® (isaca.org) is a global association helping
individuals and enterprises achieve the positive potential of technology. 3701 Algonquin Road, Suite 1010

Technology powers today’s world and ISACA equips professionals with the Rolling Meadows, Il 60008 USA

knowledge, credentials, education and community to advance their careers

Phone: +1.847.660.5505
and transform their organizations. ISACA leverages the expertise of its
Fax: +1.847.253.1755
half-million engaged professionals in information and cyber security, gover-
nance, assurance, risk and innovation, as well as its enterprise performance Support: support.isaca.org

subsidiary, CMMI Institute, to help advance innovation through technology.

®
Web: www.isaca.org
ISACA has a presence in more than 188 countries, including more than 215
chapters and offices in both the United States and China.

Provide Feedback:
DISCLAIMER
www.isaca.org/Calculating-Cloud-ROI
ISACA has designed and created How Enterprises Are Calculating Cloud
ROI: And Why Some Enterprises Are Moving Ahead Without It (the “Work”) Participate in the ISACA
primarily as an educational resource for professionals. ISACA makes no Knowledge Center:

claim that use of any of the Work will assure a successful outcome. www.isaca.org/knowledge-center
The Work should not be considered inclusive of all proper information,
Twitter:
procedures and tests or exclusive of other information, procedures and
www.twitter.com/ISACANews
tests that are reasonably directed to obtaining the same results. In
determining the propriety of any specific information, procedure or test, LinkedIn:
professionals should apply their own professional judgment to the www.linkd.in/ISACAOfficial
specific circumstances presented by the particular systems or information
Facebook:
technology environment.
www.facebook.com/ISACAHQ

RESERVATION OF RIGHTS
Instagram:
© 2017 ISACA. All rights reserved. www.instagram.com/isacanews/

© 2017 ISACA. All Rights Reserved.