ISACA Journal
Volume 1, 2,017 


Kickstarting Cloud ROI 

Cheryl Ritts, MSIS 

Many enterprises are quick to leap into cloud relationships. Very often, they do so without any analysis—formal or informal—of the value they expect to get in return. From a governance perspective, this is dangerous. To most efficiently meet stakeholder needs and goals, it is important to understand why an activity is undertaken and to make sure that the decisions are based on facts. Calculating the return on investment (ROI) for cloud computing provides an estimate of how favorable an enterprise’s potential investment in cloud computing will be. It is a useful tool to help understand the value proposition for employing a new cloud service.

The ROI calculation considers the costs of the investment and its expected gains (benefits). Therefore, identifying and quantifying, as much as possible, the value of all benefits (the return) and all expected and unexpected potential costs are important to accurately calculate the ROI so that it is a meaningful factor in the enterprise’s decision on whether to proceed with a cloud solution. This article presents a framework that an enterprise can use to kickstart its evaluation of ROI for cloud computing projects and cuts through the confusion of determining the actual benefits, costs and business challenges by providing the most common cloud computing benefits and costs that should be included in the ROI calculation and common business challenges to consider.

Calculating ROI

Calculating simple ROI entails subtracting the cost of the investment from the gain (return) of the investment, and then dividing that difference by the cost of the investment (figure 1). This calculation results in a percentage or ratio. In most cases, a ratio greater than zero means the return is greater than the cost,1 and the investment may be considered beneficial (how beneficial depends on the enterprise’s investment objectives or its corporate standards). This does not account for other factors that might be desirable in a cloud transition such as the user satisfaction associated with transitioning from a difficult-to-use legacy application to a state-of-the-art and universally accessible interface delivered via the web. However, looking just at the financials in this way can help to bolster a business case—or understand what those other desirable factors are costing.

For example, the ROI for a new Software as a Service (SaaS) cloud-based application that is expected to have an investment of US $600,000 over a period of five years and provide benefits (cost savings and new revenue) of $900,000 over the same period of time will yield a return of 50 percent.

$900,000 - $600,000
= 50%

If ROI calculations are the only financial measurement for decision making, they do not help to predict the likelihood of realizing the return or the risk that is involved with a particular investment. Ideally, the enterprise uses multiple financial metrics to decide whether to adopt cloud computing services, including ROI and the following:

  • Total cost of ownership (TCO)—Accounts only for the cost that is associated with an acquisition for its entire life span or a predetermined period of time
  • Net present value (NPV)—Compares anticipated benefits and costs over a predetermined time period using a rate that helps to calculate the present value of future cash flow transactions
  • Internal rate of return (IRR)—Finds the discount rate that would make the NPV of the investment equal to zero

The TCO, NPV and IRR are more complex calculations than simple ROI. The simplicity of ROI makes it a more popular calculation to use in project analysis and marketing materials.

The ROI calculation is simple for investments that have clear and quantifiable benefits and costs that are easily known. However, for more complex investments, such as cloud computing services, the ROI calculation can be complex and, sometimes, misleading. Generating a meaningful ROI result is dependent on accounting for all quantifiable variables and defining a clear and consistent time period. Intangible benefits and risk are not included in the calculation unless the enterprise is able to assign to them a value that is based on historical or statistical data. For justifying investments that are based solely on enterprise objectives, a business case that is supported by multiple financial metrics may be a better method than ROI calculation.

Cloud Benefits

Figure 2 shows the numerous benefits that make using cloud services enticing, including shifting cost from capital to operational expenses, lower overall cost and greater agility. The figure groups the benefits into tangible (quantifiable) and intangible (strategic) benefits. The strategic benefits are often subjective and difficult to include in financial calculations; therefore, they may require additional analysis to measure their financial impact over the duration of investment.

Cloud Costs

Cloud solution costs include many more elements than the obvious hardware and software costs. The three types of cloud costs are start-up (up-front costs), operational (recurring costs) and one-time (change or termination costs). Figure 3 describes the most common costs in each of the three cost types.

Business Challenges to Consider

Cloud computing presents the enterprise with new challenges it should consider while it evaluates cloud ROI for a possible cloud solution implementation. Figure 4 describes the common cloud challenges.

A Practical Approach to Measuring Cloud ROI

Calculating ROI for cloud services requires an understanding of business requirements/drivers, organizational maturity, control considerations and regulatory requirements. The three-phase approach for ROI that is presented in this section suits an enterprise that has reasonably mature operations (i.e., existing systems and business processes) and is considering moving to the cloud primarily to achieve cost savings. The concepts in this approach can also be applied to other scenarios; some steps may need more or less emphasis to suit the circumstances.

Figure 5 outlines the three phases of estimating cloud ROI and suggests questions to address in each step.

View Large Graphic.

To maximize the three-phase approach:

  • Focus quickly on the optimal cloud solution— Start with an initial/baseline cloud model, e.g., public SaaS, and then iteratively identify the model that is best suited to enterprise needs (cost, risk, compliance, etc.) to make the selection process faster and more effective.
  • Make an apples-to-apples comparison—Evaluate a holistic and comparable set of costs for the current service model and the optimal cloud solution alternatives to make a fair comparison between two solutions that are potentially very different (either comparing two different cloud solutions or comparing cloud with traditional IT). Measuring monetary values in a consistent manner increases ROI accuracy and reliability.
  • Stay within the enterprise risk tolerance—Perform a risk assessment of the current service model and the optimal cloud solution options to help ensure that they are within the enterprise’s risk tolerance and the costs of mitigating unacceptable risk are factored into the calculations. Knowing the enterprise risk appetite before the calculations begin is a must.

Phase 1 Considerations

Following are some points to consider when applying phase 1 of this ROI approach:

  • Evaluating a simple and cost-effective baseline cloud model for the proof of concept enables an enterprise to quickly demonstrate the model’s features, benefits and risk. With low sign-up and operating costs, many public cloud solutions can be very helpful for this purpose.
  • If the enterprise is certain that it has already identified its optimal cloud option, it may be possible to skip the steps in phase 1 that are related to evaluating an initial/baseline model. However, if the ROI of the optimal model is not yet estimated, and these phase 1 steps are skipped, the question may be raised as to how it was determined that the model is the optimal model.
  • Gaining a firm understanding of the risk that is related to cloud services can be challenging due to the wide variety of services offered, the lack of transparency around controls and the difficulties in comparing across providers.

Phase 2 Considerations

When applying phase 2 of this ROI approach, the steps may be relatively straightforward, depending on how much documentation and analysis exist for the current service model and associated costs. The ease of these steps depends on whether a full assessment of the current service model has been completed. If not, and unknown areas of risk exist, the enterprise could be significantly underestimating the costs of the current service model and/or the benefits of the optimal cloud solution.

Phase 3 Considerations

When applying phase 3 of this ROI approach, it is worthwhile to note that many enterprises that are moving to cloud services are redirecting a significant portion of IT operating cost savings toward managing cloud-related risk and management. This redirection is because the cloud is introducing new types of risk and the methods to manage that risk can be quite different from the approaches that are used for traditional IT (e.g., vendor management, change management, usage management). This redirection of savings to cloud-related costs may be reflected in current service model and optimal cloud solution costs.


Decision making around use of cloud services can be complex, and estimating the ROI is a critical part of ensuring that the path taken is the right one. Some key points to consider include:

  • Estimating ROI does not need to be complex—ROI is just an estimate. A simple, but effective ROI calculation enables the enterprise to support an investment decision and measure whether the expected costs and benefits occur. An overly complex calculation can make it hard to understand why a decision was made and/or measure its effects, essentially defeating the purpose of performing the ROI calculation in the first place.
  • Cloud is not right for every organizational need—The type of cloud service an enterprise selects is critical. How the cloud service is managed is also critical. Thinking strategically about benefits, costs and risk is paramount and must be done up front, before any contract is signed.
  • Many costs may be hidden and are not obvious from the cloud provider fee schedule—For example, while there may not be any up-front service provisioning costs from the provider, the time and effort that is spent migrating existing systems into the cloud can be expensive. The same can be said of pulling systems or data back in-house or porting them to another provider. The lesson is that selecting the right CSP can result in cost savings, but selecting the wrong CSP can be very expensive.
  • It is far easier and cheaper to change a decision (e.g., different service model or provider) when it is still on the drawing board or perhaps in the proof-of-concept stage—It can be far more difficult and expensive to change a decision when the service is up and running, interfacing with other systems and processes, and using live customer data. With so many cloud service options available, the time the enterprise spends considering the respective ROIs and selecting the best fit for its needs is time well spent.

Author’s Note

This article is based on the ISACA white paper Calculating Cloud ROI: From the Customer Perspective.2


1 Schmidt, Marty J.; “Encyclopedia of Business Terms and Methods: Return on Investment,” Solution Matrix Ltd., USA, 2011
2 ISACA, Calculating Cloud ROI: From the Customer Perspective, USA, 2012,

Cheryl Ritts, MSIS
Is a technical writer at ISACA and writes on emerging technologies, information security and other topics of interest to ISACA audiences. Previously, she wrote user guides, operating manuals, online help, and press releases for the software industry, and business proposals and various corporate communications.


Add Comments

Recent Comments

Opinions expressed in the ISACA Journal represent the views of the authors and advertisers. They may differ from policies and official statements of ISACA and from opinions endorsed by authors’ employers or the editors of the Journal. The ISACA Journal does not attest to the originality of authors’ content.