Merrill Lynch - BPO Activities

2001-2005

IT outsourcing in the financial services industry

In this article, I'll describe a Business Process Outsourcing (BPO) initiative that yielded positive results for help desk functions at a large investment services company.

During the downturn, BPO is the outsourcing activity that held up better than any others, according to the research firm Gartner, which defines BPO as the "delegation of one or more IT-intensive business processes to an external provider that, in turn, owns, administers, and manages the processes based on defined and measurable performance metrics." Financial services is one of the major markets for BPO, particularly its payroll and call center functions. Financial services pioneered BPO, and leads other business sectors in spending in this outsourcing area.

What has changed more recently is a move from massive BPO projects, such as outsourcing an entire HR department, to more modest deals. The point here is that financial services firms and their partners have learned that functions such as payroll and call centers are easier to standardize: this suits the BPO partner, because it can develop economies of scale; and it suits the bank, because it can outsource the operation with less fuss and, when complete, get a better fit.

Making the outsourcing decision
In 2001, Merrill Lynch decided that its IT help desk would be a good candidate for BPO. After a search process, Unisys was chosen to manage the support function for approximately 11,000 users in the United States and the United Kingdom. The help desk was broken down into a number of components: a help desk for routine troubleshooting; a service to deal with hardware failure; desk-side support for investment managers; and associated procurement processes, asset management, and reporting functions.

"We required a better quality of service than before and one we couldn't easily create ourselves," explains Stewart Carmichael, Merrill Lynch Investment Managers Europe Global Head of Technology and Applications Services. "We went to Unisys because help desks are their business."

However, although the arrangement ultimately worked well, Carmichael has a word of caution. "Organizations not experienced at buying services shouldn't underestimate the size of the challenge from a service management perspective. We had to adapt our business to an entirely new process and Unisys had to understand our environment, our business drivers, and most importantly, the Merrill Lynch culture, if it was to help us achieve our business objectives."

Developing the cultural fit between the two organizations demanded new thinking from both sides. Carmichael explains: "Unisys and Merrill Lynch first had to define what partnership means then develop a process, put it in place, and standardize it across the different businesses. Second, we had to understand how such a partnership could add value outside of our normal business. Finally, to support this idea, we wanted a level of measurement, a common understanding to the business relationship and our shared goals."

Unexpected benefits
To achieve these goals, a customized governance model was established. This model involves monthly executive steering meetings and a quarterly assessment against an analysis of progress and performance. Jon Wimpeney, Merrill Lynch's Global Markets and Investment Banking Technology Group Director, continues: "It took a year for the new structure to stabilize. The partnership project allowed us to develop a consistent set of questions and have them answered reliably, which in turn gave us a relative measurement of progress. Between us, we devised a series of key performance indicators underpinned with a capability maturity framework, and as a result, we can now track our progress, the user experience, and with it the service level we are receiving from Unisys."

For all that BPO is driven by the headline business functions, such as a reduction in capital investments and operating costs, Merrill Lynch found that softer deliverables such as asset management reporting and procurement billing turned out to deliver some of the most notable benefits. "Originally we thought if we could reduce our IT costs by 20 percent we would be entirely satisfied, and Unisys was prepared to offer the price-point and the service we wanted. However, not only is the service provided by Unisys more cost effective than we had before, we now have primary services that didn't previously exist, the first of these being asset management, which allows us to look at every user and understand what they have, where it is, and who owns it," Carmichael says.

Merrill Lynch was a tough customer for Unisys. Carmichael admits they were both sceptical and cautious. However, the BPO partnership worked. The key success factor was the mutual recognition that an understanding of business culture is as important as understanding the business processes.

http://articles.techrepublic.com.com/5100-10593_11-5692320.html

2003

IT Outsourcing: Merrill Lynch's Billion Dollar Bet

September 15, 2003 — CIO — Even though many companies have put the kibosh on big technology investments these past few years, some, like financial services giant Merrill Lynch, have sucked in their corporate stomachs and taken the plunge in the quest for competitive advantage. For the past nine months or so, more than 400 people from Merrill’s Global Private Client (GPC) and Global Technology and Services groups, Thomson Financial, and a number of other vendors have been working feverishly on Merrill’s biggest outsourcing initiative ever, a highly complex $1 billion makeover of its wealth management workstation platform designed to improve the efficiency of Merrill’s financial advisers (FAs). In the lingua franca of financial services, that means Merrill’s FAs are getting new, more powerful desktops geared toward capturing more of the assets of their high-net-worth customers.

The new platform also represents a major shift in the way Merrill approaches IT initiatives. In the 1990s, Merrill developed its previous platform, Trusted Global Advisor (TGA), as it did any other major system: in-house. The thought of outsourcing a critical business system to a vendor would have been deemed madness by any financial services organization and perhaps a confession that its IT department was not up to snuff. But last year, Merrill inked a contract that outsources much of the responsibility for its new platform to Thomson Financial, a large market data vendor with no previous experience managing an integration project of this size.

In this hybrid outsourcing model, Thomson, which serves as general contractor, is responsible for the desktop and is managing a number of subcontractors—a veritable who’s who of vendor all-stars including AT&T, Cap Gemini Ernst & Young, Dell, HP, IBM and Microsoft. Merrill retains control of the integration layer, which connects its proprietary databases, and manages Siebel, the platform’s CRM component.

Merrill and Thomson are working in a tight partnership, the bedrock of which is a voluminous contract containing lots of service-level agreements spelling out bonuses and penalties. And Merrill has not only outsourced much of the project, it has also shed itself of the responsibility of dealing with the subcontractors. "Thomson is on the hook for some SLAs, so it’s in their interests that the subcontractors are successful," says Byron Vielehr, cohead and CTO for the GPC.

Although the use of a general contractor and subcontractors is not uncommon in large outsourcing deals, what gives this one a different twist is Thomson’s role. "I’d say it’s unusual in a deal of that size for the supplier of a proprietary system to be general contractor for the rollout," says Michael Murphy, a partner in the technology group at the legal firm Shaw Pittman who specializes in IT outsourcing deals. (Shaw Pittman worked on the Merrill-Thomson deal and could not comment on the contract’s specifics.) "More common would be using more of a generalist outsourcer, such as IBM, EDS or CSC, that focuses on managing implementation projects from an infrastructure perspective," Murphy says.

So far, according to Merrill, the rollout, which begins next month, is right on schedule. If it’s successful, Thomson won’t be shy about hawking its general contracting services to the rest of Wall Street, and Merrill will likely continue marching down the outsourcing path, complementing its in-house expertise with best-of-breed providers. "There’s no stigma attached to being really good integrators of commercially available products and building where you need to," says John Cummings, senior vice president and chief information and services officer of Merrill Lynch. "We’ll look back and probably say this project was one of the turning points for that."

Dennis Ceru, director of retail brokerage and investing at research and advisory company TowerGroup, notes that "just the fact Merrill is outsourcing such a critical system at all is being watched closely by the financial services industry. It’s huge," he says. "It’s a major Wall Street firm with the largest number of registered brokers making a decision to partner with external providers to create its lifeblood system."

Merrill’s Outsourcing Strategy
The platform Merrill is replacing, TGA, was a giant, monolithic application that required tons of bandwidth and demanded an incredible amount of testing before every new application was added. "It was brittle technology, old technology, that was expensive to maintain and support," says the GPC’s Vielehr. Plus, the world was moving away from client/server to the Internet. And TGA didn’t have any CRM capabilities.

In addition, it was difficult to integrate Merrill’s online sites (where clients could do transactions) with TGA. That led to a mismatch between the information clients saw on the websites and what FAs saw on their screens.

So Merrill began exploring options as the mind-set among Merrill executives, led by Chairman and CEO Stan O’Neal (then head of the GPC), shifted from the IT macho of "build everything yourself" to the more conservative "build whatever can differentiate you from your competitors, but buy the rest."

"Our core competence is helping people manage their financial affairs," not CRM or trading systems or networks, says James Gorman, executive vice president of the GPC.

Or, as Mark Greenberg, first vice president and program manager for the wealth management technology platform project, says, "I’d rather be working on some really neat analytical tool and understanding the mind of an analyst than banging out some account maintenance type of thing."

According to Vielehr, this shift in the GPC’s thinking "was probably the largest transformation of a technology shop in the United States." And a big shop it is, with an IT staff of 1,800 that supports 35,000 desktops. The GPC itself is the leading issuer of debit cards in the world, the seventh largest bank, and it has major insurance, mortgage and 401(k) businesses. With all those silos, a lot of uncoordinated IT activity was going on.


Looking for Mr. Good Vendor
At first, GPC’s execs leaned toward having one vendor manage the whole project. But, given its size and complexity, they concluded that no one could do it all—manage the desktop, the networks, the hardware and the integration issues. So they decided to hire one vendor to help with the integration and act as a general contractor. "We wanted someone to have responsibility for the [desktop] all the way back, manage the subcontractors and have responsibility for the SLAs," Vielehr says.

The company tried out three vendors—Bloomberg, Reuters and Thomson Financial—in a few branches. In November 2002, Merrill announced that Thomson had won the bidding. "The most important driver was the comfort level Merrill execs had with Thomson execs, and Merrill’s belief that Thomson’s senior management team would stay intimately involved in the project," says Vielehr, also citing the company’s strong background in retail, its financial market data feeds and its other wealth management applications. Merrill also valued Thomson’s e-learning expertise. During the pilots, Vielehr says, "it became obvious how critical training was." He liked the fact that Merrill’s FAs would have access to Thomson’s e-learning product on the new workstations.

Merrill hammered out a contract with Thomson that included SLAs, set out performance bonuses, established penalties and covered more than a few other details. "There’s a whole bunch of SLAs around network availability and latency," says Vielehr. There are others addressing response times on the client websites, and bonuses are attached to how well the websites score on user surveys. Similarly, there are SLAs in place for the FAs’ desktops—response times, uptime in branches and training satisfaction. Taking into account user feedback—such as website response times and training satisfaction—is a new wrinkle for Merrill, says CIO Cummings. "For us, that’s a unique series of SLAs that aren’t driven just by delivery times and metrics, but are also driven by the users’ end view of what’s being provided."

Jim Alberg, who works with Murphy as a partner in the technology group at Shaw Pittman, says that good outsourcing deals should measure customer satisfaction and tie it to compensation. "It’s something that should be done, but not everybody does it," he says.

Even though Merrill’s contract with Thomson eventually reached 1,500 pages and covers as much ground as possible, some flexibility is built in. For example, execs decided after the fact that it made more sense to have Thomson deliver alerts to FAs on the desktops rather than Merrill. So, without ruffling any feathers, they changed the contract.


Good Governance in a New Outsourcing Model
Merrill’s decision to put Thomson at the helm of this project over a variety of subcontractors has, according to both Merrill and Thomson and the other vendors, worked well so far. "It’s a very unique model," says Thomson Financial’s Lou Eccleston, president of the banking and brokerage group. "It combines the traditional vendor role and elevates it to a partnership role, includes consultant-type roles, and brings it all into one piece."

He asserts that the development and ongoing support costs turned out to be cheaper here than they would have been in a more traditional outsourcing model. "We’re not general contractors by profession," says Eccleston. "Merrill is getting that service at a far lower price because we’re part of the whole package, including content and applications."

TowerGroup’s Ceru notes that "in the past, I think a lot of outsourcing was done in an almost hands-off, or what I would call a delegate-and-abdicate mentality. It was delegated to a third party, then abdicated in the true sense of ownership. Today, the firm is saying to vendors, You’re in this with us. It’s almost as if you’re a division of our company."

In addition to Thomson, which is managing the online function, the players on this project all have stars on the IT walk of fame: AT&T, managing the network; Cap Gemini Ernst & Young, serving as the systems integrator for Siebel and helping to build the online sites; Dell, supplying the desktops; HP, providing network products and services; IBM, being responsible for the physical rollout of components and branch support; Microsoft, furnishing .Net for the integration framework; and Siebel, creating the CRM application.

The key to keeping the project on track has been the tight alignment between Merrill and Thomson. The two aren’t strangers (Merrill has used Thomson’s ILX market data product for the past five years), so they were already comfortable with each other. Merrill and Thomson each have executive steering committees dedicated to the project that meet monthly. Executives also regularly receive updates: A weekly executive dashboard highlights the status of the project’s many components. And the conversations reach all the way to the top: "Dick Harrington [president and CEO of Thomson Corp.] literally talks to Stan O’Neal," says Eccleston.

On the operational front, some 40 Thomson employees and vendor contractors work onsite with Merrill folks, under the guidance of Greenberg and Ed Berlin, Greenberg’s counterpart as project manager at Thomson. Organizationally, the goal has been to structure as flat as possible. So for the project’s three major areas—desktop, infrastructure and online—teams of peers (as they’re known) were put in place that include representatives from the vendors as well as Merrill and Thomson. "We want everyone to take ownership," Vielehr says.

With all those vendors and a condensed development schedule, "there are plenty of thorny issues on a day-to-day basis," says Vielehr. The main bones of contention revolve around scheduling. "A lot of it is where the mid-level of teams feel like they’re waiting for somebody, or somebody is late in their mind," says Cummings.

Soul of a New Platform
The 25,000 new workstations already rolled out to the U.S. branches and offices are 2.4GHz Dell desktops with a gigabyte of RAM and two 18-inch flat panel monitors: one has a Siebel screen with CRM client data, the other a Thomson screen with financial data, news and wealth management applications. (See "What $1 Billion Buys," Page 51.) But it’s the melding of some 130 old and new applications in an integration framework (IF) that’s the heart and soul of the workstation. Merrill began building the IF last year, before Thomson was chosen, knowing one would be necessary regardless of which vendor it selected. Merrill also wanted to keep control of the IF in-house. "We weren’t about to take all our mainframe systems and turn them over to a vendor and have them figure out how to deliver that data to the vendor applications," says Greenberg.

The workstation connects 18 legacy back ends (running applications such as HR, various accounting systems and the TGA database) to the new platform. The IF is Web services-based, using Microsoft’s .Net, and Vielehr asserts that it’s one of the largest Web services implementations ever. "The volume of data that will blow through is substantial," he says. Vielehr allows that going with Web services was a big decision, but not that hard. The TGA platform, which involved lots of point-to-point connections, was hard to scale and had very little standardization. Using Web services to build the middle tier allowed the back end to integrate smoothly with the desktop and also made it easier to integrate the network, hardware and applications. "If we had done this from a proprietary perspective, we would have perpetuated a lot of the problems we had in the past," says Vielehr.

The development schedule has been nothing short of hellacious. After the contract was signed in December 2002, the project team was given six months to bring the new platform to life in order to get the FAs out from under the clunky TGA platform as soon as possible. (The compressed schedule also saved Merrill money.) Teams formed in January, then Greenberg—who refers to himself as the hired gun—was brought over from Merrill’s investment management group to manage the project. Greenberg also serves as the Thomson relationship manager, a two-headed role that basically means he eats, breathes and dreams about the new workstation. His umbilical cord to the project extends to happy hour: Greenberg recently took some of his team out for margaritas, but, while sitting with his cohorts at the table, had to phone in from the bar for a conference call.

With all those vendors and a condensed development schedule, "there are plenty of thorny issues on a day-to-day basis," says Vielehr. The main bones of contention revolve around scheduling. "A lot of it is where the mid-level of teams feel like they’re waiting for somebody, or somebody is late in their mind," says Cummings.

Soul of a New Platform
The 25,000 new workstations already rolled out to the U.S. branches and offices are 2.4GHz Dell desktops with a gigabyte of RAM and two 18-inch flat panel monitors: one has a Siebel screen with CRM client data, the other a Thomson screen with financial data, news and wealth management applications. (See "What $1 Billion Buys," Page 51.) But it’s the melding of some 130 old and new applications in an integration framework (IF) that’s the heart and soul of the workstation. Merrill began building the IF last year, before Thomson was chosen, knowing one would be necessary regardless of which vendor it selected. Merrill also wanted to keep control of the IF in-house. "We weren’t about to take all our mainframe systems and turn them over to a vendor and have them figure out how to deliver that data to the vendor applications," says Greenberg.

The workstation connects 18 legacy back ends (running applications such as HR, various accounting systems and the TGA database) to the new platform. The IF is Web services-based, using Microsoft’s .Net, and Vielehr asserts that it’s one of the largest Web services implementations ever. "The volume of data that will blow through is substantial," he says. Vielehr allows that going with Web services was a big decision, but not that hard. The TGA platform, which involved lots of point-to-point connections, was hard to scale and had very little standardization. Using Web services to build the middle tier allowed the back end to integrate smoothly with the desktop and also made it easier to integrate the network, hardware and applications. "If we had done this from a proprietary perspective, we would have perpetuated a lot of the problems we had in the past," says Vielehr.

The development schedule has been nothing short of hellacious. After the contract was signed in December 2002, the project team was given six months to bring the new platform to life in order to get the FAs out from under the clunky TGA platform as soon as possible. (The compressed schedule also saved Merrill money.) Teams formed in January, then Greenberg—who refers to himself as the hired gun—was brought over from Merrill’s investment management group to manage the project. Greenberg also serves as the Thomson relationship manager, a two-headed role that basically means he eats, breathes and dreams about the new workstation. His umbilical cord to the project extends to happy hour: Greenberg recently took some of his team out for margaritas, but, while sitting with his cohorts at the table, had to phone in from the bar for a conference call.

Ahead of the Competition, but for How Long?
It remains to be seen whether Merrill’s billion- dollar investment will produce the competitive advantage it’s hoping for. Unsurprisingly, its executives predict that it will. "[The platform] raises the cost of entry of being a financial advisory firm. There’s increasing consolidation in the industry because the cost of equipping financial advisers is prohibitively expensive for all but a handful of firms," says the GPC’s Gorman.

"I think we’ll be a couple of years ahead of most competitors," says Vielehr. "Most [other] players have point solutions that operate in silos; none are as integrated." And that integration, Vielehr believes, comes with a side benefit: It will help sell new recruits on working at Merrill.

Some analysts are reserving judgment. "Merrill typically does this stuff earlier than others, but it’s a short window [of advantage]," says Forrester’s Punishill. "We’re not talking about new analytics or different stuff than what others are doing. It’s a better way of putting something together. If it does a better job, FAs are more productive. If they’re more productive, will they generate more business or play more golf?"

Punishill also points out that if the workstation succeeds, Thomson certainly will market it to the rest of the industry, thereby ensuring that Merrill’s putative competitive advantage will immediately begin to spring leaks.

For now Merrill is hoping to improve the lives of its 14,000 FAs by giving them a speedy, more intuitive, hassle-free desktop. And, with Thomson riding shotgun on the project, and all the subcontractors in the backseat, it’s making sure its vendor partners feel—in their pocketbooks—as much responsibility for the success of the platform as it does.


http://www.cio.com/article/29678/IT_Outsourcing_Merrill_Lynch_s_Billion_Dollar_Bet

2003

Merrill Lynch Expands Outsourcing Relationship With BISYS(R) - Agreement Continues BISYS' Growth In Offshore Funds Arena -



NEW YORK, March 12, 2003 /PRNewswire-FirstCall/ -- BISYS, a leading global
provider of business process outsourcing solutions for the financial services
sector, today announced that New York-based Merrill Lynch has expanded its
extensive outsourcing relationship with BISYS. In addition to supporting
approximately 4,000 Merrill Lynch retirement plans with comprehensive
recordkeeping services, and providing analytical research and competitive
intelligence through its Financial Research Corporation (FRC) subsidiary,
BISYS has now been selected to provide transfer agency services, through its
Ireland facility, for Merrill Lynch's recently launched Dublin-based UCITS
umbrella fund.
The fund, Merrill Lynch Global Selects Portfolios plc, was approved by the
Central Bank of Ireland in December 2002, and launched in February 2003. It
initially includes 42 portfolios representing 23 mandate categories, including
equity, fixed income, and short-term securities. The fund is currently being
offered by Merrill Lynch on a limited private offering basis but is in the
process of being registered for public sale in a number of key markets,
principally in Europe and Asia.
BISYS' transfer agency services, which are driven by a state-of-the-art,
real-time recordkeeping platform, support both retail and institutional
accounts, and multiple share classes and pricing structures.
According to Mark DeSario, director of marketing and product development
for Merrill Lynch's International Managed Assets Group, "We believe BISYS
offers the best-of-breed transfer agency services that support our fundamental
commitment to quality. BISYS' ability to support third-party distribution for
us was a key factor in our selection process."
Bill Tomko, president of BISYS Investment Services group, said, "We are
extremely pleased that this world-leading client expanded its outsourcing
relationship based on our proven ability to support its distribution efforts
through our transfer agency services. We focus on both operations and high-
touch distributor support."
George Evans, executive vice president of business development for BISYS
Investment Services group, stated, "The unique ability to leverage our
enterprise solution to expand our relationships with valued clients like
Merrill Lynch is extremely rewarding. As progressive clients like Merrill
Lynch implement the offerings of BISYS' complementary business lines, their
day-to-day experience with our products, services, and professionals provides
a unique level of confidence that BISYS can successfully and seamlessly
perform additional business functions on their behalf."


About BISYS
The BISYS Group, Inc. (NYSE: BSG), headquartered in New York City,
provides business process outsourcing solutions that enable investment firms,
insurance companies, and banks to capitalize on convergence by entering new
segments of the financial services industry. BISYS currently supports more
than 20,000 domestic and international financial institutions and corporate
clients through three business units. Its Investment Services group provides
administration and distribution services for approximately 400 clients,
representing more than 1,950 mutual funds, hedge funds, private equity funds,
and other alternative investment products with more than $560 billion in
assets. BISYS' largest group also provides retirement services to more than
15,000 companies in partnership with 40 of the nation's leading banks and
investment management companies, and offers analytical research and
competitive intelligence through its Financial Research Corporation (FRC)
subsidiary. Through its Insurance and Education Services group, BISYS is the
nation's leading independent distributor of life insurance and the premier
provider of the support services required to sell traditional and variable
life, annuity, long-term care, and disability products. This group also
provides a comprehensive compliance management solution that supports
insurance and investment firms and professionals with more than 225
certification and continuing education training courses, and provides a
sophisticated suite of licensing-related products and services. BISYS'
Information Services group provides information processing and imaging
solutions to more than 1,150 financial institutions. This group also supports
more than 120 insurance companies with a suite of asset retention solutions,
and provides complete program management for corporate-sponsored cash
management accounts. Additional information is available at http://www.bisys.com.

http://www.prnewswire.com/cgi-bin/stories.pl?ACCT=104&STORY=/www/story/03-12-2003/0001906895&EDATE=

Read regarding outsourcing of security management to verisign

http://www.internap.com/product/datacenter/firewall/files/Verisign_Merrill_Lynch_Interview.pdf.pdf


Merrill Lynch Takes Aim at Maximizing IT Return

January 1, 2003
by Steven Marlin This coverage originally appeared on Bank Systems & Technology Online:

In November, Merrill Lynch announced one of its biggest IT initiatives to date: the replacement of 28,000 workstations used by its retail brokers, or financial advisers, with a new Wealth Management Workstation built by Thomson Financial. The new workstations feature quick and easy access to market data, news and account information; online collaboration with clients and between financial advisers; and CRM and portfolio management tools.

The deal shapes up as one of the largest outsourcing projects ever undertaken by the financial services giant.

"The existing environment is Merrill-owned desktops, servers, networks and content," said Marvin Balliet, chief financial officer at Merrill Lynch's global technology and services group. "The new environment is a Thomson desktop that's owned by Thomson, running a Thomson application."

Based on Microsoft's Windows XP enterprise computing platform, the new workstations are also faster and more reliable than the current ones, which are based on Windows NT and Windows 2000. "The jump from NT to XP is huge in terms of reliability and capability," said John McKinley, chief technology officer at Merrill Lynch.

To help ensure a smooth transition, Merrill has turned to VMware, a Palo Alto, Calif.-based manufacturer of "virtual machine" software, which enables multiple copies of an operating system to run on the same hardware platform.

"Seventy percent of our initial use of VMware is to support a graceful transition within our retail base," McKinley said.

By creating a stable, uniform platform for managing operating system and application updates, VMware is projected to save Merrill millions in hardware and software costs.

"VMware enables us to solve a variety of challenging IT issues in a quick, cost-effective manner," said McKinley.

"By embracing virtualization technology and standardizing on VMware, Merrill Lynch has seen a 40-50% cost savings," he added.

During the transition, financial advisers are being provided with dual-system access, enabling them to toggle between the older and newer systems. "We're using VMware to manage risk in transition," said McKinley. "VMware is running on each financial adviser's desktop."

Once the transition is completed, VMware will play an even larger role at Merrill.

"Once we go to full deployment [of the Wealth Management Workstation], we'll focus on using VMware more as a server-side infrastructure rather than a desktop," said McKinley. "The more strategic role is in reengineering our server infrastructure."

By consolidating the workloads of multiple servers, VMware is expected to save Merrill $2 million in hardware costs alone over the next five years. "We're looking to take out a couple of hundred servers through more effective utilization," said McKinley.

The product will also streamline development and testing, he said. "[VMware] will enable better utilization of our disparate software development and quality assurance environment."

By harnessing large farms of Intel servers, Merrill is aiming to hike utilization.

"Our goal," said McKinley, "is to knit together commodity four-and eight-way Intel boxes into a single logical metaserver." The idea is analogous to storage-area networks, or SANs, he added. "Storage was running at 15 to 20 percent utilization. After SANs, they're running at 55 to 60 percent."

A Better Image

The concept of running multiple images of an operating system on a single platform dates from the mainframe era.

"IBM championed the virtual machine concept two decades ago with its VM operating system," said McKinley. "They continued on that path with Linux on the zSeries."

VMware applies the same concept to today's smaller Windows-based machines. "The approach that's compelling to us, instead of relying on a large metaserver, is knitting together a fabric of cheaper Intel boxes into a logical mainframe," said McKinley.

For Merrill, the server consolidation project is part of a larger movement to improve IT efficiency. "In aggregate, we've reached the era of austerity," said McKinley.

The successful project also provides a welcome respite in a year in which Merrill has been hit from all sides with bad publicity. In May, it agreed to pay $100 million to settle charges by the New York State attorney general that it had pressured analysts into issuing rosy projections about Internet companies in order to win their investment banking business. As part of the agreement, Merrill had to issue a public apology in which it promised to keep its investment banking and research divisions separate.

In June, two Merrill employees-Peter Bacanovic, a financial adviser, and Douglas Faneuil, a client associate-were placed on administrative leave after an internal investigation turned up irregularities in stock transactions performed on behalf of Martha Stewart. And in September, Merrill fired two executives-Thomas Davis, vice chairman, and Schuyler Tilney, a managing director in investment banking-after they had refused to testify in an investigation by the Securities and Exchange Commission and the U.S. Department of Justice into financial transactions initiated by Enron in 1999.

In addition to having its reputation sullied, Merrill has had to endure one of the worst downturns in the post-war economy, which has affected Wall Street no less than other industries. Here, though, the cloud has a silver lining: by shedding unproductive businesses and projects, firms will be in a stronger position once the economy rebounds.

The downturn has induced Merrill to curtail spending on "strategic" initiatives, noted Balliet. "In this market downturn, business people have taken an active interest in 'lights-on' applications, and have stopped a lot of enhancements."

"In a good marketplace," he continued, "business people can spend more on strategic opportunities. In a tight marketplace, you want to manage only what you need to do. A lot of the projects today are cost and expense reduction initiatives."

Some initiatives have to be continued whether they're profitable or not. "Some projects you have to do to stay in business because it's a regulatory requirement," said Balliet. An example is the USA PATRIOT Act. "All that reporting around anti-money laundering you have to do or you're not in business."

Trimming the Fat

To help manage its IT projects, Merrill has turned to Business Engine, a Web-based budgeting and project management tool from a San Francisco company by the same name.

Business Engine provides Merrill CTOs and CFOs with a real-time view of budget components, enabling them to balance IT assets between value, risk and cost.

The product, noted Balliet, provides a picture of all four major project components: cost to build, cost to maintain, benefits and risk.

"Business Engine is the place where everyone can view the technology status of their projects at the same time," said Balliet. "They can go into Business Engine and see all of their lights-on costs."

Business Engine is intended to track IT projects and subprojects, such as integrating the Thomson workstation into Merrill's clearing and settlement system.

"Where Business Engine is critical is during the implementation phase of developing a software interface to Nasdaq or clearing and settlement, or a data center upgrade," said Balliet.

Merrill has expanded the product to 8,000 users: developers, technology managers, project managers, business people, and members of Balliet's technology finance team.

By enabling managers to track projects, resources, budgets and actual expenses, Business Engine helps promote efficiency.

"Since we've put [Business Engine] in place, the number of projects that have run over budget has dropped from 35 percent to 10-15 percent," said Balliet.

More importantly, Business Engine gives managers insights into why a project is failing, and allows them to kill it off faster. "Projects fail for two reasons," said Balliet. "Either the deliverables aren't being met or the marketplace is changing."

Changing market conditions led to project cancellations at one business group, said Balliet.

"They canceled some projects in equity trading where margins had evaporated, and redirected their portfolio to other initiatives, where business was growing and margins were strong", he said.

Other evidence abounds of Business Engine's effectiveness. One CTO, who had been skeptical of the Business Engine initiative, discovered that he was able to redirect resources more quickly than in the past.

"He wasn't wasting time on initiatives that they'd already canceled," said Balliet. "A year before it would have taken two months to make [such] a decision. Now it takes two weeks."

Another group found that by scaling back unproductive activities it was able to free up resources for much-needed system improvements.

"They needed $6 million," said Balliet. "They went through all their lights-on activities, and found that $4 million a year was being spent pricing out enhancements to existing applications. Not coding. Not testing. Pricing. They took that $4 million and applied it toward the $6 million they were looking for."

Business Engine also enables projects to be charged back to Merrill's three major business lines: investment banking, retail brokerage and asset management.

"We're doing a better job of identifying costs charged to businesses," said Balliet. "[We've] isolated work between lights-on applications and new development."

That, in turn, is part of an effort to boost accountability. "When we started this organization [Global Technology and Services], we had one-third of the costs aligned with the business, and two-thirds in infrastructure," Balliet said. "Today, we have 80 percent aligned with the business, and 20 percent in infrastructure."

Greater accountability means, for example, taking advantage of lower costs for offshore testing and development work.

"You're going to own your own technology portfolio," said Balliet. "If the work's being done in India, you're going to pay less than if it's done in the U.S."

Another Business Engine user, Horizon Blue Cross Blue Shield of N.J., has installed Business Engine to support a wide range of business applications, including the processing of approximately 25 million health claims each year. "With Business Engine, we'll have real-time information about our return on investment, our information technology spending, and our resource conflicts," said Pamela Miller, vice president of enterprise strategy and quality at Horizon Blue Cross Blue Shield of N.J.



http://www.vmware.com/company/news/articles/banktech_1.html

Merrill Lynch Hands Off Network Security To VeriSign
From the May 22, 2003 issue of CRN

Business is getting riskier. Digital attacks on businesses, such as the Slammer worm earlier this year, are unleashing their destruction at ever-increasing speeds. Hackers are constantly poking and prodding, trying to breach the security defenses of American companies. There's also the growing stack of federal and state legislation requiring businesses to prove they're being diligent at securing their data.
David Bauer, chief information security and privacy officer for Merrill Lynch & Co. wants to increase his company's ability to focus on these risks. He says he can better achieve that goal for the $2.83 billion brokerage firm by outsourcing a good chunk of the company's network security to VeriSign Inc., a relative newcomer to the growing managed security services provider market.

Terms of the global, multiyear contract were not disclosed, but InformationWeek has learned VeriSign will manage more than 300 of Merrill Lynch's firewall and intrusion-detection network security devices.

"It's all about being the best that you possibly can be," Bauer says. "On the intrusion-detection piece, we have a lot of network activities, as a lot of companies do, but now we're going to get analysis of all our activity in context with what else is going on in the world. It's not just about data, it's about intelligence. And with intelligence, you can make better decisions."

That intelligence, Bauer says, comes from VeriSign's ability, acquired by managing network security devices for hundreds of companies, to see attacks occurring elsewhere on the Internet and within its customers' networks. Bauer says Merrill will benefit from VeriSign's ability to see things his security team can't, and that will help them better decide where to focus their security resources. "Is it a random attack, or is it targeted? Is it a sophisticated attack or not a sophisticated attack? Well, now we can get answers to those questions," Bauer says.

Bauer isn't the only security officer looking for answers. Analyst firm Gartner estimates that managed security services will be the fastest-growing service type across all vertical markets, growing annually at 19.3% from $547.8 million in 2002 to $1.2 billion in 2006.

"We're definitely seeing increasing outsourcing of 'commoditized' security functions, such as policy changes on firewalls, reviewing firewall and IDS logs, and all the other repetitive tasks involved in perimeter security," Gartner analyst John Pescatore says. "By outsourcing the grunt work, their existing security folks can respond to the new issues, like securing the ERP system connection to suppliers or what to do about wireless LANs or Web services.

VeriSign CEO Stratton Sclavos says regulations such as the Health Information Portability and Accountability Act, Sarbanes-Oxley, and the USA Patriot Act are helping to drive demand for managed security services. Managed security "allows companies to focus on the process optimization required to reduce the overall risks to their organizations," he says.

Bauer agrees. "It lets us worry about the evaluation of the data as opposed to the monitoring of the data," he says. "I'm a big fan of this risk managed approach. Now we can take the data and do risk analysis against it, and act on it--as opposed to having to do the day-to-day stuff."

http://www.crn.com/security/18830221