CFOs whose finance and accounting functions are built on legacy computer systems got a stark reminder last week from the Colonial pipeline hacking of what’s at stake if their system is breached.
The hack to Colonial’s system led to widespread gas shortages throughout the East and reportedly forced the company to pay $5 million in ransomware to get the instructions for reclaiming its data.
“For finance departments, the cybersecurity risk is huge,” Samir Jaipati, a finance solutions leader with EY Americas, told CFO Dive in an email. “Something built on outdated technology won’t be able to keep hackers out.”
Security specialists generally agree legacy, on-premises systems starting from about 10 years ago typically have solid cybersecurity features built in, but those that are older might require significant upgrades if they’re going to stand a chance against today’s sophisticated hackers.
The risk for CFOs who must manage their processes on an outdated system is they’ll try to get by with short-term fixes that won’t solve the systemic problems they face.
“These temporary fixes aren’t as dependable and in the long-term may cost more,” said Kaipati.
For CFOs who don’t have the time or budget to implement the system overhaul they need or to transfer their processes to a more secure on-premises system or to a cloud-based system, the best step is to do a comprehensive review of their end-to-end finance processes to audit for consistency and reliability, said Steve Adams, Gartner finance director.
He suggested reviewing the organization’s record-to-report process from start to finish to understand where non-secure platforms are used, whether there are audit trails that don’t exist, and if exogenous data is incorporated. By eliminating these and other red flags, CFOs can go a significant way to clean up their processes and reduce risk without making system changes, Adams said.
CFOs taking this approach should first engage their IT business partner and ask for a full audit of the cybersecurity capabilities of the suite of financial applications and to use that review as a starting point to making improvements, he said.
Legacy systems pose a broader problem than just security risk; they can impede company growth because CFOs aren’t generating the data or producing the analytics that can help them identify ways to make more money or reduce costs in the same way they can get from sophisticated cloud-based solutions.
Nor can legacy systems be expected to be as good at integrating data throughout the organization in the same way as cloud systems.
For CFOs who can do it, switching from an old on-premises system to the cloud can be a game-changer, said Manish Sharma, an Accenture operations group executive.
“CFOs that are agile and able to overcome these restrictions by scaling digital and cloud-powered technologies have been able to break down data silos and siloed ways of working to support the ever-evolving business strategy with speed and flexibility,” he said.
The importance of using up-to-date IT was emphasized in a recent Accenture report that found “future-ready” leaders are emerging ahead of the pack with higher efficiency and profitability by scaling digital capabilities in ways to improve operational maturity.
“These leaders use better, more diverse data to inform decision-making as part of a cloud-powered continuous feedback loop,” said Sharma.
Another benefit of moving to the cloud or a hybrid cloud-on-premises arrangement is cost flexibility.
On average, the cost of managing an outdated IT system can cost a business around $3.61 per line of code or over $1 million for an application with 300,000 lines of code, said Kevin Shuler, owner and CEO of the Quandary Consulting Group, a Denver-based IT firm.
“It accounts for customizations, maintenance, reporting, server and hardware, etc.,” he said.
While replacing the old with the new might appear to be prohibitively expensive at first glance, Shuler noted what can put a CFO more at ease is the costs are more transparent than maintaining a legacy system.
“Better, they can be categorized as either an operating expense or a capital expense since a lot of software is classified as a service rather than software,” he said.
This gives flexibility to the CFO’s finances and forecasting. It also means more resources can be available for modernized systems.
“That means you can get superior resources at a lower cost than trying to pull from a pool of highly specialized and competitive contractors who work mainly with legacy systems,” he said.
As President Trump pushes the possibility of a vaccine this year, the C.D.C. has outlined technical scenarios to state public health officials for an unidentified Vaccine A and Vaccine B.
The Centers for Disease Control and Prevention has notified public health officials in all 50 states and five large cities to prepare to distribute a coronavirus vaccine to health care workers and other high-risk groups as soon as late October or early November.
The new C.D.C. guidance is the latest sign of an accelerating race for a vaccine to ease a pandemic that has killed more than 184,000 Americans. The documents were sent out on the same day that President Trump told the nation in his speech to the Republican National Convention that a vaccine might arrive before the end of the year.
Over the past week, both Dr. Anthony S. Fauci, the country’s top infectious disease expert, and Dr. Stephen Hahn, who heads the Food and Drug Administration, have said in interviews with news organizations that a vaccine may be available for certain groups before clinical trials have been completed, if the data is overwhelmingly positive.
Public health experts agree that agencies at all levels of government should urgently prepare for what will eventually be a vast, complex effort to vaccinate hundreds of millions of Americans. But the possibility of a rollout in late October or early November has heightened concerns that the Trump administration is seeking to rush the distribution of a vaccine — or simply to hype that one is possible — before Election Day on Nov. 3.
For an administration that has struggled with the logistical challenges of containing the coronavirus, the distribution of millions of vaccines that must be stored in subzero temperatures and provided first to high-risk groups through America’s flawed, fragmented health care system would be a daunting challenge. Even the C.D.C.’s guidance acknowledged that its plan was hypothetical and based on the need to immediately begin organizing the gigantic effort that would be required if the F.D.A. were to allow the use of a vaccine or two this year.
The C.D.C. plans lay out technical specifications for two candidates described as Vaccine A and Vaccine B, including requirements for shipping, mixing, storage and administration. The details seem to match the products developed by Pfizer and Moderna, which are the furthest along in late-stage clinical trials. On Aug. 20, Pfizer said it was “on track” for seeking government review “as early as October 2020.”
“This timeline of the initial deployment at the end of October is deeply worrisome for the politicization of public health and the potential safety ramifications,” said Saskia Popescu, an infection prevention epidemiologist based in Arizona. “It’s hard not to see this as a push for a pre-election vaccine.”
Three documents were sent to public health officials in all states and territories as well as officials in New York, Chicago, Philadelphia, Houston and San Antonio on Aug. 27. They outlined detailed scenarios for distributing two unidentified vaccine candidates, each requiring two doses a few weeks apart, at hospitals, mobile clinics and other facilities offering easy access to the first targeted recipients.
The guidance noted that health care professionals, including long-term care employees, would be among the first to receive the product, along with other essential workers and national security employees. People 65 or older, as well as Native Americans and those who are from “racial and ethnic minority populations” or incarcerated — all communities known to be at greater risk of contracting the virus and experiencing severe disease — were also prioritized in the documents.
That’s a positive development, “so it doesn’t just all wind up in high-income, affluent suburbs,” said Dr. Cedric Dark, an emergency medicine physician at Baylor College of Medicine in Texas.
The C.D.C. noted in its guidance that “limited Covid-19 vaccine doses may be available by early November 2020.” The documents were dispatched the same day that Dr. Robert Redfield, director of the C.D.C., sent a letter to governors asking them to prepare vaccine distribution sites by Nov. 1, as McClatchy reported.
The agency also said its plans were as yet hypothetical, noting, “The Covid-19 vaccine landscape is evolving and uncertain, and these scenarios may evolve as more information is available.” A C.D.C. spokeswoman confirmed that the documents were sent but declined to comment further.
Many of the details listed for the two vaccines — including required storage temperature, the number of days needed between doses, and the type of medical center that can accommodate the product’s storage — match what Pfizer and Moderna have said about their products, which are based on so-called mRNA technology. Neither company responded to requests for comment.
The scenarios, which assume that the two vaccines will demonstrate sufficient safety and effectiveness for an emergency authorization from the F.D.A. by the end of October, noted that Vaccine A, which seems to match Pfizer’s, would have about two million doses ready within this time frame, and that Vaccine B, whose description matches Moderna’s, would have about one million doses ready, with tens of millions of doses of each vaccine ready by the end of the year. Although it’s possible that some promising preliminary data may emerge by the end of October, experts are skeptical.
“The timeline that’s reported seems a bit ambitious to me,” Dr. Dark said. “October’s like 30 days away.”
Trials that test a vaccine’s effectiveness can take years to yield reliable results. It’s possible to draw conclusions sooner “if there is an overwhelming effect” in which vaccinated people appear to be far better protected from disease, said Padmini Pillai, a vaccine researcher and immunologist at M.I.T.
But there can be significant risks in approving a vaccine for broad use in the public before Phase 3 clinical trials involving tens of thousand of participants are completed. Rare but dangerous side effects may only surface over time, after such large numbers of people have received the vaccine.
And data gathered early in a trial might not hold true months down the line. Researchers also need time to test large numbers of people from a variety of backgrounds to determine how well the vaccine works in different populations — including the vulnerable communities identified in the guidelines.
Should any of these snags occur, Dr. Pillai said, “all of this together could diminish public trust in the vaccine.”
James S. Blumenstock, senior vice president of pandemic response and recovery at the Association of State and Territorial Health Officials, confirmed that the three C.D.C. documents were sent to all state and territorial health departments last week. “It is now the time to enhance organizational structure and involve all partners in this planning process going forward,” he said.
Lisa Stromme, a spokeswoman for the Washington State Department of Health, said that her state’s health officials were still at “a very early stage in a planning process,” but were already working toward developing infrastructure that would accommodate the assumptions laid out by the C.D.C.
The C.D.C. documents said that public health administrators should review lessons learned from the 2009 H1N1 pandemic vaccination campaign, which did not have enough doses at the beginning to meet demand.
“It’s good to have a plan out for hospitals and health care systems to prepare” for a potential rollout, said Dr. Taison Bell, a pulmonary and critical care physician at the University of Virginia. But Dr. Bell added that he was concerned that the timeline outlined in the documents “is incredibly ambitious and makes me worry that the administration will prioritize this arbitrary deadline rather than maintaining diligence with following the science.”
The technical comparison of Vaccine A and Vaccine B has some echoes of what was discussed at an Aug. 26 meeting of the Advisory Committee on Immunization Practices of the C.D.C. At the meeting, Dr. Kathleen Dooling, a C.D.C. medical officer, laid out three scenarios: Vaccine A, or the Pfizer vaccine, is approved, Vaccine B, the Moderna vaccine, is approved, or both. The requirement that Pfizer’s vaccine be stored at minus 70 degrees Celsius would mean that it couldn’t be administered at most small sites, she said. The C.D.C. documents noted that orders of Vaccine A would go “to large administration sites only.” The Moderna vaccine requires storage at minus 20 degrees Celsius.
The C.D.C. documents said the vaccine would be free to patients, but that providers might not be reimbursed for administrative costs if the vaccine was given an emergency authorization, rather than a standard approval.
Experts worry that the process is unlikely to go off without a hitch, given the last-minute scramble and the mixed messaging so far. “I think distribution is going to be very tricky for the vaccine, particularly if there is a cold storage requirement,” Dr. Bell said.
There are also likely to be challenges administering both doses of the proposed vaccines, which must be given weeks apart, Dr. Dark said. “How are you going to make sure people get both?”
A mere six months after identifying the SARS-CoV-2 virus as the cause of Covid-19, scientists are on the precipice of a having a vaccine to fight it. Moderna and the National Institutes of Health recently announced the start of a Phase 3 clinical trial, joining several others in a constructive rivalry that could save millions of lives.
It’s a truly impressive a feat and a testament to the power of basic and applied medical sciences. Under normal circumstances, vaccine approvals are measured in decades. Milestones that once took months or years have been achieved in days or weeks. If these efforts are successful, the Covid-19 vaccine could take a place alongside the Apollo missions as one of history’s greatest scientific achievements.
I’m optimistic. And yet, as someone who studies drug development, I want to temper expectations with a dose of realism and perhaps a bit of angst. Behind the proud declarations, many science and medical professionals have been whispering concerns. These whispers have escalated into a murmur. It’s time to cry them loudly:
Hey, Food and Drug Administration: Don’t be rash! Premature approval of a sub-standard Covid-19 vaccine could have dire implications, and not just for this pandemic. It could harm public health for years, if not generations, to come.
Unfortunately, elements now in place make such a disastrous outcome not only possible but in fact quite likely. Specifically, the FDA and its staff of chronically overworked and underappreciated regulators will face enormous public and political pressure to approve a vaccine. Whether or not one worries about an “October surprise” aimed at the upcoming election, regulators will be pressed hard. Some will stand firm. Some may resign in protest. But others could break and allow a bad vaccine to be released.
What makes a “bad vaccine”? Insufficient protection against the disease it is designed for, unwanted side effects, or some combination of the two. If an approved Covid-19 vaccine turns out to be ineffective, this could unintentionally promote wider spread of the disease by individuals who presume they were protected from it. Likewise, a negative experience with one vaccine might discourage the use of other vaccines that are far more safe and effective, whether they are for Covid-19 or other vaccine-preventable diseases.
Some things take time. Under normal circumstances, ensuring that a vaccine’s effects are safe and durable requires years of study and monitoring. And there is some evidence that natural immune responses to SARS-CoV-2 infection could be transient, making sustained investigation all the more necessary. A merely short-term effect could encourage vaccinated individuals to resume risky behaviors, which would all but guarantee that the epidemic endures. And if unintended side effects turn out to include, for instance, chronic inflammatory or autoimmune disease, a bad vaccine could impart lifelong damage.
But wait, there’s worse! A bad Covid-19 vaccine could further undermine confidence in the many safe, reliable vaccines already in our public health arsenal. Vaccine skepticism and anti-science bias, propagated by B-list celebrities and Russian troll farms, have been gaining strength all year. Combined with disappointing Covid-19 outcomes, such malign forces could facilitate the reemergence of once-vanquished foes — polio, measles, mumps, rubella, diphtheria, whooping cough, and tetanus — that once killed multitudes of children each year.
These are enormous risks. Placing all of our bets on a small set of untried vaccine technologies would be gobsmackingly foolish. Yet this is exactly what we are now doing. Most of the high-profile names capturing headlines are pursuing comparatively minor variations on a theme of genetic vaccines (those delivered via DNA or RNA). If one approach happens to work, the odds are higher the others will work as well. Disappointing results from one candidate, though, might presage failure across the board.
Rather than investing in a balanced portfolio of vaccines with different approaches — not to mention different therapies, devices, and diagnostics for treating Covid-19 — too many observers, too many companies, and too many governmental officials seem to be narrowly focused on hopes for a “savior” vaccine. Were that savior to fail, our national morale, already low, could plummet even further.
Don’t get me wrong. I, along with millions of Americans, want a Covid-19 vaccine. But we deserve one that’s been proven to be safe and effective.
It’s not too late to take a deep breath and devise a strategy to balance short- and long-term goals, including vaccination, improved diagnostics, and existing and novel treatments. We must support the FDA and hope that its scientists and physicians retain the strength and conviction to resist approving a substandard vaccine.
For encouragement, we should look to Frances Oldham Kelsey, a veritable patron saint of the FDA. In 1960, during her first month working for the agency, Kelsey was asked to approve a sedative called Kevadon, which had the potential to generate billions in revenue. Despite enormous pressure, Kelsey spotted a risk for toxicity and dug in her heels. She refused to rubber stamp the approval. Her actions saved the lives of countless babies. Kevadon, better known as thalidomide, proved to be one of the most dangerous and disfiguring drugs in history.
Kelsey passed away in 2015 at the age of 101. We must pray that her spirit inspires a new generation of FDA leaders with the courage to say, “No.”
The plan, which is co-led by the WHO, the Coalition for Epidemic Preparedness Innovations and Gavi, the vaccine alliance, was of interest to some members of the Trump administration and is backed by traditional U.S. allies, including Japan, Germany and the European Commission, the executive arm of the European Union.
But the United States will not participate, in part because the White House does not want to work with the WHO, which President Trump has criticized over what he characterized as its “China-centric” response to the pandemic.
“The United States will continue to engage our international partners to ensure we defeat this virus, but we will not be constrained by multilateral organizations influenced by the corrupt World Health Organization and China,” said Judd Deere, a spokesman for the White House.
The Covax decision, which has not been previously reported, is effectively a doubling down by the administration on its bet that the United States will win the vaccine race. It eliminates the chance to secure doses from a pool of promising vaccine candidates — a potentially risky strategy.
“America is taking a huge gamble by taking a go-it-alone strategy,” said Lawrence Gostin, a professor of global health law at Georgetown University.
Kendall Hoyt, an assistant professor at Dartmouth’s Geisel School of Medicine, said it was akin to opting out of an insurance policy.
The United States could be pursuing bilateral deals with drug companies and simultaneously participating in Covax, she said, increasing its odds of getting some doses of the first safe vaccine. “Just from a simple risk management perspective, this [Covax decision] is shortsighted, she said.
The U.S. move will also shape what happens elsewhere. The idea behind Covax is to discourage hoarding and focus on vaccinating high-risk people in every country first, a strategy that could lead to better health outcomes and lower costs, experts said.
U.S. nonparticipation makes that harder. “When the U.S. says it is not going to participate in any sort of multilateral effort to secure vaccines, it’s a real blow,” said Suerie Moon, co-director of the Global Health Center at the Graduate Institute of International and Development Studies in Geneva.
“The behavior of countries when it comes to vaccines in this pandemic will have political repercussions beyond public health,” she added. “It’s about, are you a reliable partner, or, at the end of the day, are you going to keep all your toys for yourself?”
Some members of the Trump administration were interested in a more cooperative approach but were ultimately overruled.
Health and Human Services Secretary Alex Azar and Deputy Secretary of State Stephen Biegun had interest in exploring some type of role in Covax, a senior administration official said, speaking on the condition of anonymity because they were not authorized to discuss the decision-making.
But there was resistance in some corners of the government and a belief that the United States has enough coronavirus vaccine candidates in advanced clinical trials that it can go it alone, according to the official and a former senior administration official who learned about it in private discussions.
The question of who wins the race for a safe vaccine will largely influence how the administration’s “America first” approach to the issue plays out.
An unlikely worst-case scenario, experts said, is that none of the U.S. vaccine candidates are viable, leaving the United States with no option since it has shunned the Covax effort.
Another possibility is that a U.S. vaccine does pan out, but the country hoards doses, vaccinating a large number of Americans, including those at low risk, while leaving other countries without.
Experts in health security see at least two problems with this strategy: The first is that a new vaccine is unlikely to offer complete protection to all people, meaning that a portion of the U.S. population will still be vulnerable to imported cases — especially as tourism and trade resume.
The second, related problem is that a U.S. recovery depends on economic recovery elsewhere. If large parts of the world are still in lockdown, the global economy is smarting and supply chains are disrupted, the United States will not be able to bounce back.
“We will continue to suffer the economic consequences — lost U.S. jobs — if the pandemic rages unabated in allies and trading partners,” said Thomas J. Bollyky, a senior fellow at the Council on Foreign Relations and the director of its global health program.
Proponents of a multilateral approach to global public health would like to see all countries coordinate through Covax. Perhaps unsurprisingly, interest is strongest from poor countries, while some larger economies are cutting deals directly with drugmakers.
WHO officials have argued that countries need not choose — they can pursue both strategies by signing bilateral deals and also joining Covax.
“By joining the facility at the same time that you do bilateral deals, you’re actually betting on a larger number of vaccine candidates,” Mariângela Simao, a WHO assistant director for drug and vaccine access, said at an Aug. 17 briefing.
If nothing else, the United States could pledge surplus vaccine doses to Covax to ensure they are distributed in a rational and equitable way, experts said.
Some cautioned against a focus on “winning” the race. Given the complexity of supply chains, vaccine development will necessarily be a global effort, regardless of whether countries want to cooperate.
The decision to steer clear of Covax comes at a time of tremendous change for health diplomacy.
The United States has long been the biggest donor to the WHO and a major funder of vaccine initiatives.
In the early days of the coronavirus pandemic, Trump praised both China and the WHO for their handling of the outbreak. But as the crisis intensified in the United States, he turned on the U.N. health agency.
In April, he announced a freeze on new U.S. funding. Not long after, the State Department started stripping references to the WHO from fact sheets and rerouting funds to other programs.
By July, the administration had sent a letter signaling its intent to withdraw from the WHO.
But untangling the United States from the agency it helped found and shape is not simple — and the terms of the separation are still being assessed.
It is not yet clear, for instance, whether a U.S. withdrawal means the United States will just stop its contributions to the WHO or whether it will stop funding any initiative linked to the agency in any way.
For instance, the White House no longer wants to work with the WHO, but the United States is a major supporter of Gavi, which co-leads the Covax project.
Asked to comment on the Covax decision, a State Department spokeswoman pointed to U.S. funding for Gavi, as well as money for such programs as UNICEF and the Global Fund to Fight AIDS, Tuberculosis and Malaria.
J. Stephen Morrison, director of the Global Health Policy Center at the Center for Strategic and International Studies, said the White House could still reverse course and join Covax, or at least let the Senate fund through Gavi — a political workaround.
“This just shows how awkward, contradictory and self-defeating all of this,” he said. “For the U.S. to terminate its relationship with the WHO in the middle of a pandemic is going to create an endless stream of self-defeating moments.”