The Journal of the British Association of Hospitality Accountants FEBRUARY 2011 In this issue: 4 BAHA Education Programmes 6 Technical updates - VAT Penalties payable to HMRC 7 Hotel FC’s – Top tips for a successful audit 9 How Social Media is Changing Travel 10 From 6 to 2 .....Firmdale’s journey into Virtualisation 11 Payment Card Industry Data Security Standard 12 Reducing the Vulnerability of Hotels to Credit Card Theft 14 HRMC Breakfast Seminar 15 Read of the Month 17 HOTSTATS UK Hotels Review Dec 2010 20 Forthcoming Events bahaTIMES BAHA members meetings Monday 21st February Social Media with Ally Dombey of Revenue By Design To be held at Le Méridien, Piccadilly, London from 6.00pm Ally Dombey will be presenting the preliminary results from the Social Media Monitor—a survey compiled in association with RateGain, conducted across hoteliers internationally to assess the uptake and use of social media in the hotel industry today. Friday 4th March Revenue Management Breakfast Workshop To be held at the Mint Hotel Tower of London, 7 Pepys Street, London from 8.00–10.30am The Hospitality Revenue Management Community of BAHA presents an open workshop in conjunction with Oxford Brookes University to discuss and debate some of the key topics for anyone in a Revenue Management related role. See page 14 for details. Servicing your needs Hospitality & Leisure We provide sale, acquisition, valuation, rating, property and building advice. bahaTIMES sponsored by: To book your place at these members meetings please email [email protected]
Transcript
The Journal of the British Association of Hospitality AccountantsFEBRUARY 2011
In this issue:4 BAHA EducationProgrammes
6 Technical updates - VATPenalties payable toHMRC
7 Hotel FC’s – Top tips for asuccessful audit
9 How Social Media isChanging Travel
10 From 6 to 2 .....Firmdale’sjourney into Virtualisation
11 Payment Card IndustryData Security Standard
12 Reducing the Vulnerabilityof Hotels to Credit CardTheft
14 HRMC Breakfast Seminar
15 Read of the Month
17 HOTSTATS UK HotelsReview Dec 2010
20 Forthcoming Events
bahaTIMESBAHA members meetingsMonday 21st February
Social Mediawith Ally Dombey of Revenue By DesignTo be held at Le Méridien, Piccadilly, Londonfrom 6.00pmAlly Dombey will be presenting the preliminary resultsfrom the Social Media Monitor—a survey compiled inassociation with RateGain, conducted across hoteliersinternationally to assess the uptake and use of socialmedia in the hotel industry today.
Friday 4th March
RevenueManagementBreakfast WorkshopTo be held at the Mint Hotel Tower of London,7 Pepys Street, London from 8.00–10.30amThe Hospitality Revenue Management Community of BAHA presents an openworkshop in conjunction with Oxford Brookes University to discuss and debatesome of the key topics for anyone in a Revenue Management related role.See page 14 for details. Servicing
your needs
Hospitality & Leisure
We provide sale, acquisition, valuation, rating,
property and building advice.
bah
aTIM
ES
spon
sore
db
y:
To book your place at these members meetings please email [email protected]
bahaTIMES
page 2
Dear Members,
Our thanks for the huge response from you for the BAHA Membership benefits survey conducted during December and January. We learnt that whilst many of you are very happy indeed with the benefits offered, we have work to do helping you to take full advantage of all that is available. Many respondents asked for additional benefits which in-clude a discounted room rate scheme and, for many, the need for more regional meetings was clearly a significant aspect for BAHA’s future development. We will be respond-ing in the coming year to your requests where possible. BAHA, as a professional Association, continues to develop with 960 members and students in over 25 countries. Our student members recently sat their examinations in locations across the globe including London, Birmingham, Edinburgh, Dubai, South Africa and Europe. We are now very close to enrolling our one thousandth member—can your company help us reach our target? There is much to look forward to this year with the dates for forthcoming members meetings over the next six months now listed on the BAHA website including the Annual Quiz Night in July – please keep returning to this for all the latest information. The BAHA Education workshop programme is now also available with one and two day courses available in Financial Management and Revenue Management topics with IT to follow. Professional growth and learning remains at the heart of the Association. Whilst Continuing Professional Development is not mandatory for BAHA members clearly making sure we keep up to date is of increasing importance to all professionals. Debra Adams, BAHA Education Programmes [email protected]
A
bahaTIMES
Do you know someone who would benefit from joining BAHA? Help us reach 1,000 members! BAHA offers members a range of services:
Interesting and informative monthly members meeting programme www.baha-uk.org/meetings.aspLetters after your name for Associate and Fellow members
Monthly journal with informative articles and updates on technical issues impacting on financial, IT and revenue management in the hospitality industry
Publications and professional updates www.baha-uk.org/books.aspEducation programmes and vocational training www.baha-uk.org/edtrain1.aspAccess to a range of online services for BAHA members including a database of 3,200 online accounting and management journals plus a range of discussion forums
A range of social events for networking and meeting colleagues www.baha-uk.org/socialevents.aspImproving employability through CPD with discounted rates with the Open University and Cornell University
SUBSCRIPTIONS (BAHA Fees are income tax deductible as Professional Subscriptions)
Joining Fee (one-off) £30 + VAT Ordinary Member £85 + VAT Associate Member (ABHA) £90 + VAT Fellow (FBHA) £105 + VAT Corporate membership for 5 or more colleagues from one organisation Call Wayne Gosden on 01202 889 430 for details
‘Best Green Marketing Initiative’ Honour and Date for Winners’ Presentation Gala Lunch announced by the Considerate Hoteliers Association for its
‘Considerate Hotel of the Year Awards 2010/11’
Celebrating the Best in Environmental, Sustainable and Socially Responsible Performance and open to All Ho-tels and Small Accommodation Operations in the UK, the ‘Considerate Hotel of the Year Awards 2010/11’ will be
presented at a Gala Lunch on Monday, 23 May 2011 at The Savoy, London
With less than two months to go to the deadline for entries on Thursday, 31 March 2011, the Considerate Hotel-iers Association (CHA) has great pleasure in announcing details of a special ‘Best Green Marketing Initiative’ award to be added to the Asso-ciation’s six prestigious ‘Considerate Hotel of the Year Awards 2010/11’ – launched in November 2010. Celebrating the best in environmental, sustainable and socially responsible performance, the CHA awards are open to all UK hotels; and small accommodation operations – ranging from B&Bs and Guest-Houses, to pubs/inns/restaurants with rooms. The ‘Best Green Marketing Initiative Award 2010/11’ will be presented to the hotel/accommodation operator whose award category entry includes the most outstanding green marketing initiative. “Our judges will be trawling (sustainably) through the entries for the CHA hotel/accommodation operator award categories and identifying the hotel/accommodation provider who has thought up and implemented the best green marketing initiative for 2010/11,” explained Considerate Hoteliers Association Director and Secretary John Firrell. “Last year, we hon-oured the Lancaster London – located alongside Hyde Park – for the innovative nature, quality and effectiveness of its green marketing. This included the introduction in July 2009 of half-a-million honey bees which checked in at the Lancaster London – making it the first central Lon-don hotel to install beehives on its roof! This is a great example of the type of outstanding green marketing initiative the 2010/11 CHA award judges will be looking for, whilst scrutinizing the following award entry categories: ‘The Considerate Hotel of the Year 2010/11’; ‘The Con-siderate Small Accommodation Provider of the Year Award 2010/11’; ‘The Considerate Sustainable Food 2010/11 Award’; ‘The Con-siderate Green Team of the Year 2010/11’; and ‘The Considerate Green Champion of the Year 2010/11’.” About the Considerate Hoteliers AssociationConsiderate Hoteliers is an association of like-minded hoteliers, whose purpose it is to encourage, assist, cajole and motivate fellow hoteliers to adopt sustainable, environmentally friendly and socially responsible practices. A list of current members can be found at www.consideratehoteliers.com
page 3
page 4bahaTIMES
The course is intended for finance personnel aiming to gain the skills and knowledge required to become an Assistant Financial Controller or FC managing their own finance division in the future and aiming to qualify to Chartered status. The full course is a 3-stage programme, studied over 18 months through blended-learning, which has been designed by experi-enced finance educators and industry professionals. Flexible, part-time study allows students to fit their learning around their busy working day and the use of industry examples means students can relate their learning to their own working environment. Components of the course can also be studied individually. The course is supported by the BAHA World of Learning Classroom hosted by award winning software - Moodle. For more details regarding the syllabus and course content just click to: http://www.baha-uk.org/edtrain4.asp
The course also provides the first step towards gaining a professional chartered accounting qualification with CIMA (Chartered Institute of Management Accountants) as successful completion of BAHA gives exemptions in papers 1 & 2 of their Certificate in Business Accounting. The Open University has also assigned a credit value to the learning undertaken on the programme. This is an endorsement of the quality, amount and level of the learning within the Framework for Higher Education Qualifications in England, Wales and Northern Ireland (FHEQ). Credits awarded for each Stage can be offset against degree-level study with the OU. There are no formal entry requirements although learners should be already working in finance roles. Costs are £550 ex VAT per Stage with two start dates each year - March and September. The last date for March enrolment is 28th February 2011. Individual components of the programme can be used to add content and value to existing in house programmes to complement Corporate Academies and Professional Development Activities within your own business. Please contact Debra Adams ([email protected]) for more details on how to implement this in your business and add value to your current profes-sional development programmes. For more details regarding the syllabus and course content, please visit the BAHA website at www.baha-uk.org or call on 01202 889430 for an informal discussion or email [email protected] example students on the BAHA ETP benefit from:
These benefits can add value to your own in house programmes. Please contact Debra Adams for more details on how to implement this in your business and add value to your current professional development programmes. We are enrolling now for the February 2011 programme. For further information, details of exemptions or to enrol online, please visit www.baha-uk.org/etpfinance.asp or contact the education office direct on 01202 889430; email: [email protected].
Work based assignments to enable learners to investigate and solve problems in the workplace
Completion of a Learning Plan which helps learners to record their learning in an organised way
Industry based mentoring scheme to support learners in their studies
Access to the BAHA World of Learning online classroom hosted by award winning educational software MOODLE with tutor support and resources to support learning
Access to EBSCO's Business Source Corporate - the premier online source of business research information for companies seeking to remain competitive in their particular markets. Business Source Corporate contains full text articles from more than 2,700 quality magazines and journals, including sources ranging from the top management
journals to general business periodicals and trade publications.
Reap the benefits of our Education Programme in Financial Management The BAHA Education & Training Programme in Finan-cial Management (ETP FM) is widely recognised within the industry as providing a firm foundation for develop-ing aspiring hospitality accountants.
page 5bahaTIMES
New short courses for 2011 Our one and two day courses are designed to help you develop your knowledge on the latest topics and boost your career. If you have five or more staff requiring training for the same course, or are unable to find the course you need, our experi-enced training partners will be very happy to develop in-house training for you. Please contact Debra Adams for details [email protected]
Financial management topics These courses are suitable for finance professionals, senior managers and business advisors working in the hospitality industry who require an update on these techniques with case studies and examples based on the specific issues relating to the hospitality industry.
11 May Better Forecasting and Budgeting
18 May Performance Measurement and Bench Marking
25 May Financial Measurement and Reporting of Green Issues
8 June Strategies for optimising Working Capital
22 June Capital Budgeting and Investment Appraisal
29 June Introducing the Balanced ScoreCard
6 July Management Accounting - a Strategic perspective All financial topic courses are one day in length and include a 3 course lunch, course materials and follow up discussions and resources in the BAHA World of Learning Classroom. Courses are delivered by a range of speakers and experts from the hospitality industry. For details regarding each course contact [email protected] Non-members £350+VAT per workshop, BAHA members: £275+VAT per workshop. To book your place email [email protected]
Membership Survey For the last twenty years I have, with the aid of BAHA, been conducting a series of surveys into the role and responsibilities of the hospitality financial controller and many of you have been kind enough to participate in the past. This has helped us under-
stand more about the diversity of the job and allowed controllers to compare themselves against their peers. We are undertaking a further version of the survey, updated to include both revenue managers and IT managers as well as current trends and responsibilities. Participation is anonymous, confidential and en-tirely voluntary but we would be very grateful if you would take the time to complete it as the data will help build our knowledge even further. Please follow the link below to the new edition of the survey which should take you no more than twenty minutes to complete. The results will be published in summary form in the BAHA Times, and a fuller report will be available via the website. If you have any questions regarding this survey, please call me on 01865 483828 or email me [email protected]
To access the survey please go to http://www.surveymonkey.com/s/RPDD7MLCathy Burgess (BAHA Council Member) Department of Hospitality, Leisure and Tourism Management, Oxford Brookes University, Gipsy Lane, Oxford OX3 0BP
page 6bahaTIMES
Prevention is always better than cure. You can help to avoid incurring any penalties by reviewing your records and systems now and making any improvements that might be needed. Going forward, if you find that you have made an inaccuracy in any tax return, you should disclose it to HMRC as soon as pos-sible – this might be the only way to avoid or reduce a penalty.
By Diana Mountain, BAHA Technical Committee Jan 2011
Technical updates From the BAHA Technical Committee, chaired by Diana Mountain ([email protected])
VAT Penalties payable to HMRC Following the VAT Rate change to 20% on 4th January 2011 it is worth taking extra care with your next VAT Return, as the penalties for VAT errors (and indeed all other taxes payable to HMRC) in-creased substantially in April 2009. The bad news
Where tax is understated as a result of a careless or deliberate inaccuracy, fixed penalties will be charged, based on a percentage of the tax lost (100 per cent in the worst cases)
A minimum penalty will be charged in almost all cases Directors or other responsible persons may be liable to pay part or all of a penalty for a deliberate inaccuracy in a company's return, if the inaccuracy was down to them The good news
No penalty will be charged for an inaccuracy if the taxpayer has taken reasonable care. (The standard of care expected will vary ac-cording to the person, their abilities and the particular circumstances)
Penalties will be reduced if a taxpayer makes unprompted dis-closure of inaccuracies to HMRC. (A disclosure is unprompted if it is made at a time when the person making it has no reason to believe that HMRC have discovered or are about to discover the wrongdo-ing) Penalties for careless inaccuracies can be suspended for up to two years, after which they may be cancelled The penalty is based on the amount shown as VAT on an unauthor-ised invoice, or the amount of Excise Duty unpaid because of the wrongdoing. This unpaid tax or duty is the potential lost revenue. The penalty is calculated by applying an appropriate percentage to the potential lost revenue. HMRC can give further reductions based on the quality of the disclo-sure. To calculate the reduction HMRC consider three elements of disclosure and to what degree the person has:
told HMRC about the wrongdoing helped work out what extra tax is due given access to their records to check their figures
Reason for wrongdoing Disclosure Minimum penalty Maximum penalty
Reasonable excuse - No penalty No penalty
Careless Unprompted 10 % 30 %
- Prompted 20 % 30 %
Deliberate Unprompted 20 % 70 %
- Prompted 35 % 70 %
Deliberate & concealed Unprompted 30 % 100 %
Prompted 50 % 100 %
Hotel FC’s – Top tips for a successful audit by Debbie King, Senior Manager, PKF (UK) LLP It was put to us that financial controllers might find an article helpful on 'how to get rid of the auditors as quickly as possible', or as an auditor I prefer to think of this slightly differently, as ‘providing top tips for a suc-cessful audit’! What makes an audit successful? I believe it is the same for both parties: that the audit process should be as quick and painless as possible, with the least disruption caused to the business. Here are our recommendations for best practice: Plan to succeed Have a pre-planning meeting a month or so before year end to discuss and agree in detail the timetable and audit approach. Dates should be agreed for the main fieldwork and meetings, deadlines for the completion of the audit and ultimately the sign-ing of the accounts. Follow this up with a formal planning meeting at year end to discuss the performance of the business and perform early audit tasks eg. attendance at stock takes, documentation and walkthrough of systems and controls, and prelimi-nary analytical review of the draft figures for the year. Information sharing It is important to consider at an early stage what information the auditors will need and when. For an efficient audit the FC should provide a file and/or electronic documents on day one of the audit, containing all of the information requested. This enables the audit team to get on with their work with the least disruption to the hotel staff. And by providing copies of documents the auditors will not waste time photocopying, or worse, writing on the originals! Drawing on our past experience, here are some Top Tips which will speed up the audit process:
Send the year’s monthly management accounts to the auditors to review before they arrive onsite
Similarly, if other information is ready (and reliable!) then the auditors may be able to start work on this too. e.g. if a trial balance of expenses or details of fixed asset additions are available, then they may be able to select samples for you to locate the relevant invoices in advance
Stock counts – ensure that the auditor attending is provided with the date, time, location(s), details (liquor, consumables etc.), and documentation. More than one visit might be necessary
Bank letter – an accurate list of bank account details should be provided as early as possible
Ensure that the statutory accounts are drafted and provided on Day 1 of the fieldwork – it is much easier and quicker to deal with them now, not weeks later!
Ensure that adequate time is booked in and that you are available for queries during the process – auditors can only leave once they have resolved all their queries
Book a closing meeting at the end of the fieldwork to resolve issues quickly, identify any work outstanding and agree a timetable for completion
Intercompany reconciliations – reconcile intercompany balances throughout the year to flush out any issues early when time is available to resolve them – don’t leave these until year end!
Include tax deadlines in the timetable (for the prompt completion of statutory accounts)
If possible be flexible on dates as it is more efficient to wait for audit staff who have worked with you before Much of this article should be familiar to you. Ultimately the audit process is a necessity but it need not be unpleasant or overly disruptive if you plan carefully and work together. In my experience, hotel audits are interesting and enjoyable, and the staff are professional and friendly. Establishing and maintaining a good working relationship with your auditors will help to ensure that the process runs smoothly and that your time spent together is minimised (in the nicest possible sense!) Here is a suggested checklist of audit schedules and documents. It is worth noting that some systems cannot backdate cer-tain reports (such as aged debtors and creditors) and therefore these need to be printed off at Y/E close. It is helpful to have an index at the front of your audit file.
page 7bahaTIMES
page 8bahaTIMES
Topic Information Required Y/N
Accounts Year end trial balance and details of year end journals
Accounts Draft statutory accounts, including supporting analysis for all notes & consolidation workings (if group accounts)
Accounts Monthly management accounts for each month of the year under audit
Accounts Post year end management accounts as they become available
P&L Analysis Legal and professional fees
P&L Analysis Repairs and renewals
P&L Analysis Directors’ remuneration
P&L Analysis Leases and hire purchase payments
P&L Analysis Details of interest receivable and interest payable
P&L Analysis Access to breakdowns of nominal ledger expense codes
P&L Analysis Selection (dates tbc) of night audit reports with supporting packs/dockets etc
Payroll Monthly payroll summaries
Payroll Reconciliations of payroll summaries to management accts & statutory accts as at Y/E, & documentation to support payroll disclosure notes (e.g. staff numbers)
Payroll Details of any PAYE/NI visits or relevant correspondence
Cash & Bank Reconciliations of all bank accounts at Y/E including a list of all outstanding items
Cash & Bank Bank statements for all accounts open in the year (incl. statements issued after Y/E)
Stock Schedules of stock held at Y/E
Stock Copies of any external and internal stock valuations and stock records
Stock Results of stock counts during the year & copies of stock take count sheets at Y/E
Stock Details of any write offs
Stock Breakdown of any provisions
Fixed assets Fixed asset register, with details of additions and disposals
Fixed assets A reconciliation of the fixed asset register to the nominal ledger as at Y/E
Fixed assets Details of any retentions in place re refurbishment/building projects in progress
Fixed assets Details of the external valuations of the hotel property carried out
Fixed assets Details of any capital commitments at Y/E
Fixed assets Impairment review calculations and any supporting papers (if prepared)
Debtors Aged debtors listing as at Y/E and reconciliation to the nominal ledger
Debtors Breakdown of any bad debt provision as at Y/E
Debtors Breakdown of any debts written off during the year
Debtors Breakdown of the guest ledger as at Y/E
Debtors Supporting schedules for prepayments & accrued income, incl. copies of relevant invoices
Creditors Aged creditors listing as at Y/E and reconciliation to the nominal ledger
Creditors Reconciliation of inter-company accounts at Y/E (provision of intercompany matrix)
Creditors Documentation to support any bank loans
Creditors Documentation of testing of loan covenants (at Y/E date and any post year end)
Creditors Listing of payments in advance (deposits)
Creditors Supporting schedule for accruals & deferred income, incl. copies of relevant invoices
Creditors Reconciliation of PAYE/NI creditor to the payroll records at Y/E
Creditors Details of any provisions in place
VAT VAT returns for the four quarters & any supporting schedules
VAT Reconciliation of annual turnover & expenditure per the accounts to the totals as per the VAT returns
VAT Copies of any correspondence with HMRC during the year
Statutory records Minutes of directors’ meetings held during the year & up to the audit completion date
Statutory records Statutory registers
Statutory records Annual returns
Statutory records Supporting documentation for any movements in shares during the year
Regulatory Copies of any correspondence with regulatory bodies during the year or post Y/E
Regulatory Access to the hotel accident book
Regulatory Results of any internal and external third party inspections in the year or post Y/E
Sundry List of all related parties of the entity
Sundry Schedules of related party transactions during the year (in the P&L) and at Y/E (balance sheet), and supporting documentation
Sundry Monthly budget/forecast for at least the following 12 months, longer if available
Sundry Monthly cashflow forecast, covering the period up to at least 12 months from the date of signing of the accounts, longer if available
Sundry Latest management accounts, just before the accounts are signed
page 9bahaTIMES
How Social Media is Changing Travel Social Media is Here to Stay (And It’s Growing in Importance) By Michelle Wohl, VP of Marketing at Revinate With so many ways to easily share information online today, user-generated content has be-come the go-to source for recommendations. In fact, recommendations from personal ac-quaintances and consumer opinions posted online are the most trusted forms of advertis-ing, according to the latest Nielsen Global Online Consumer Survey. The Changing Landscape for Hoteliers It’s no surprise that social media is dramatically changing every aspect of a hotelier’s operation. For one, booking pros-pects will visit a review site before they go to a hotel’s site. Even if they intend to visit your site, they will see guest re-views on search engines before they arrive. Review sites con-tinue to grow at an exponential rate. The largest review site, TripAdvisor, has 40 million monthly visitors and more than 40 million reviews and opinions. Reviews have become increas-ingly important on OTAs (Online travel Agencies) and they are driving bookings. PhoCusWright research shows that OTA shoppers who visit hotel review pages in TAs are twice as likely to convert. Regaining Control The solution is not to throw up your hands and leave market-ing to the review writing masses. Hotels need to embrace the new channels and use them to drive incremental revenue, create stronger guest relationships and gain market share. Online reviews and social media have now become the most important measure of guest satisfaction. The feedback is im-mediate, free-form and public. In this way, reviews and com-ments about your hotel immediately and directly impact your bookings. Harnessing this explosion of social media content is impossible to do manually, given the amount of content, but the right technology solution makes it easy.
From 6 to 2.. Firmdale's Journey into Virtualisation of its Servers Our journey started when a routine server replacement had been due. The cost of the server had been budgeted for along with a certain amount of money for the supplier to re-install their application and transfer the data across to the new server. We also began discussing the best time with the Business function to agree when this should take place. In reviewing the project with the supplier it became clear that their costs just did not add up, and more importantly they wanted to do the work between normal working hour - unac-ceptable for the business impact. It was at this point we considered Virtualisation for the first time and having done some research it seemed an achiev-able way to go. We then chose VM Ware as a partner as they could give us the support we needed, 24/7. We spoke to the supplier. Unsurprisingly they said that they did not support virtualisa-tion and after several conversations it seemed that really they did not have the knowledge to know if this would or would not work with their software. We offered to work with them but when it came down to it their costs would increase to perform this 'test'. We thought about it and we rang back the Company's MD and said that we were just going to try it anyway as we had not been given a convincing technical argument as to why we could not. He said "Good Luck" and put the phone down! The next weekend, we built the new server and installed VM Ware on the box and tried to Virtualise the software applica-tion. While the process went fine, when we tried to access the application it error'd. We tried the process a further 3 times with the same result. Noting we had 24/7 cover with the sup-plier, we reported the problem to helpdesk. After 30 minutes the Helpdesk called back to say they had fixed the problem and the application was now working correctly. We tried, and it really did work! We tried everything we could think of to test that all the fea-tures prior to the virtualisation still worked and they did. We took the decision to put the system in to the production envi-ronment on the Monday morning. We made the department aware that we were trying some-thing new and any errors/issues needed to be reported to us immediately. By lunch time nothing had been reported, so I actually went and sat in the department to check out all was
indeed well!! The process in-fact had just worked and to the end users, nothing had slowed, or error'd and the system just worked as before. That was over a year ago and there has not been a single issue. In fact, the team had no idea what changes we had made and more importantly their work had not impacted by the suppliers insistence to do the work in the team's normal working hours! The next opportunity came when the business started to look to reduce the residual electrical consumption at the Hotels. As the IT servers and associated equipment run 24/7 they became a focus of attention and we then reviewed all of the equipment in the IT Cabinets. We picked the first project by the supplier with the most equipment in the IT cabinet and asked if they supported Virtualisation of their applications, to which you guessed it; the answer was a resounding 'NO'. Again we asked for the technical detail as to why, and these were not forthcoming. One of our Hotels in Knightsbridge was the ideal candidate for the project, where they had a large IT Cabinet within their Back Office. We felt with virtualisation we could remove the
entire cabinet from this area, returning the space back to the operation and re-ducing the noise and heat generated in this area from the cabinet and its equip-ment. As with the first project we pur-chased a new server and started the project to Virtualise the applications one by one. Each application worked without
issues after Virtualising. Slowly the Servers and pcs were removed from the cabinet. We then came to virtualise the last application, the voicemail and call logging application, we rang the supplier and asked if they would support their application if we Virtualised it. The MD of the company said he would be delighted to support this and had been waiting for one of his customers to suggest this. Finally a supplier working with us! When we Virtualised the Voicemail application hit problems for the first time. However having the supplier (at no charge!!) work with us to prove it could be done, we nailed all of them, and, more importantly, together. The result is that we have managed to pull out 35 servers and over 20 pcs from the business, resulting in small power and HVAC savings for each of 7 hotels. And the Hotel where we pulled the out IT Cabinet? Well they now use the space for storing Guest luggage closer to their reception area, increas-ing guest satisfaction.... From Mark Rupert Read and Mark Jelley BAHA IT Committee
The result is that we have managed to pull out 35
servers and over 20 pc's from the business, resulting in small power and HVAC
savings for each of 7 hotels.
page 11bahaTIMES
PCI DSS – Payment Card Industry Data Security Standard from a Finance Manager Perspective The members’ meeting on Monday 24th January was kindly hosted by Adolf Schauer, Financial Con-troller at the Cavendish Hotel, London. Over 50 members attended the presentation by Phil Jones, Payment Security Manager, Barclaycard and Richard Hollis, CEO of BAHA’s newest patron, Orthus. PCI DSS specifies 12 requirements entailing many security technologies and business processes, and reflects most of the usual best practices for securing sensitive information. As Phil explained, the resulting scope is comprehensive but also may seem daunting, particularly for an industry where credit card payments are part of the everyday workings of the business. PCI DSS is required by your merchant card partner and penalties can be imposed if credit card data is found to be breached and your company is the source of the breach; it is interesting that a breach can be for as few as ten card details, let alone thousands. Companies will be classified in up to four tiers, depending on the number of transactions processed. Can I opt out? No this is a requirement and it is here to stay. The deadline to be compliant was September 30th 2010. An annual revalidation is required similar to an MOT. So let’s deal with the numbers:
6 goals (something to aim for = a goal) 12 requirements (required = necessary to reach a goal) 264 control points (control = y/n)
As was outlined, due to the nature of our business it is unlikely that we will meet all the control points but there is a “get out of jail” option. This is called a compensating control issue (phew!) So maybe I can continue to take payment via a faxed copy of the credit card, front and back including CSV code, even if it belongs to the uncle twice removed of the guests who is staying. Just make sure that it is a dedicated fax, not storing previous transmission and is only accessible by vetted, trained persons. Shred the fax after it is entered in the “compliant” PMS system, and ensure that the card details are not kept for more then 120 days. Systems: If you have any PMS/POS, F&B tills, fax, scanner, servers, copiers, till receipts, i.e. anything that can store transmit or hold card detail data then you must start talking to your providers: are they compliant? Does the contract refer to what would happen in terms of a breach? Would you happily give your card details to your company? What about passwords to access the network, are they unique? (i.e. not admin, administrator, 1234, password, letmein, man-ager, syscon, or any other easy ones) IT Project & costs This is – but cannot just be – an IT project, as it is a process involving all levels in the business. Sure somebody needs to lead it and take ownership, but it can not be an isolated project, as it is ongoing. The cost depends of course on the size of the op-eration, but bear in mind that the fines can be prohibitive, and the reputation, if breached, can cause long term damage. Being compliant does not prevent a breach; it just reduces the cost of potential fines. A QSAC (Quality Security Assessor Company) can help in the process becoming compliant, but clearly there is a cost attached to this. Richard Hollis compared PCI DSS in a presentation to the song “Hotel California“ by the Eagles – let’s hope it does not turn into Chris Rea’s “Road to Hell”! Article written by Uwe Haring, Finance Manager Operations, Rocco Forte Hotels Both presenters have provided BAHA with a wealth of information on this very important topic. The presentations, case studies and handy hints and tips can be downloaded from the Members area of the BAHA website.
page 12bahaTIMES
Reducing the Vulnerabil-ity of Hotels to Credit Card Theft By Douglas Rice, Executive Vice President and CEO, Hotel Technology Next Generation Hotels need to be better at network security. Worldwide, breaches have affected hundreds of hotels. Some of the larger ones in the US have made front-page national news, but many more are handled quietly. However, Verizon Business and Trustwave have been able to get an indication of the severity of the problem in separate studies. The Trustwave report indicated that an astonishing 38% of breaches they investigated in 2009 were at hotels and resorts—making hospitality the most-hacked industry. This number is high because a very sophisticated organized crime ring has discovered that it is often easy and lucrative to steal credit card information from hotel systems. The criminals are specifically targeting hotels because many hotels have a large volume of credit card transac-tions and often weak or nonexistent security. You cannot hide from the thieves: if your hotel is connected to the Internet, it’s a target – even if your systems have been validated to the PCI Council’s Payment Application Data Security Standard (PA-DSS). If you do not already have a PCI compliance program in place, you need to get started immediately. There is no doubt that PCI compliance will help protect your customers’ data. However, the PCI standards are complex, and compliance can be time consuming and expensive. Many hoteliers ask what they can do now, quickly and at modest expense, to better protect their systems now, while they work separately to meet the full set of PCI compliance requirements. To answer this question, it helps if hoteliers understand how hackers are breaking into their systems. Fortunately, security experts at many of the major brands, along with forensic specialists from the major security companies who investigate breaches, agree on how most of the breaches are perpetrated. These experts have worked alongside law enforcement investigators and police agencies around the world including the U.S. Secret Ser-vice, the Royal Canadian Mounted Police, and Scotland Yard. The experts have detailed a thorough understand-ing of how the attacks work, and how attacks have con-tinued to evolve even as many hotels have implemented more stringent security measures. As a neutral trade association, Hotel Technology Next Generation (HTNG) has also facilitated information shar-ing on this issue through conference calls attended by dozens of brand security and senior IT executives, some of whose hotels have suffered admitted breaches. This article summarizes what we have learned from members and other security experts and suggests three measures that you can take very quickly to make your hotel less vulnerable. Be sure that you understand that these are not meant as a substitute for full compliance with the PCI Data Security Standards, but rather as three easy steps you can take to reduce your risk while you work on the more difficult aspects of PCI. These three practices are
comparatively simple to implement, are required by PCI anyway, and can be done by even small hotels at minimal cost. Forensic evidence suggests that, had they been in place, they would have thwarted the vast majority the suc-cessful attacks on hotels. Indeed, while the hackers’ tech-niques are complex, the Verizon Business/US Secret Ser-vice report shows that simple or intermediate controls could have prevented 96% of the breaches. But first, it is impor-tant that you understand more about the attacks them-selves. The Nature of the Breaches While many criminals try to steal credit card data, there is one particular organized crime ring that appears to be re-sponsible for a large portion of the activity targeting hotels. Originating in Eastern Europe, it typically uses a computer program to “troll” the Internet, querying each Internet ad-dress and whatever connected machine is located there. Trolling for vulnerable machines is a common hacker strat-egy: a recent experiment by the University of Maryland counted more than 2200 hacking attempts on an average Internet connected computer per day—that’s one attack every 39 seconds. In this case, the trolling program tries very basic hacks, often based on default passwords for firewalls, unprotected servers, or common remote access programs. (If you think a list of default passwords is going to be hard to come by, try an Internet search for “default passwords” – you’ll be surprised what you find!) If the hack succeeds, the program drills down further and looks at the systems on the network. If the hack fails – and this is the important point –the program simply moves on to the next Internet address. However, if it gets inside your network, then it looks at all the machines and software that are con-nected. It recognizes many common systems that are used to process credit cards, and particularly those—such as property management (PMS) and point of-sale (POS) sys-tems—used by hotels. If again it finds nothing, it simply moves on. If it finds something interesting, it then uses a number of very sophisticated and continually evolving) techniques to get the credit card data. In some cases it steals data as the hotel employee swipes the cards, before the information even reaches the PMS or POS (where the data typically gets immediately encrypted). It also installs malware that helps the thieves continue to steal data even if the hotel takes new security measures. It leaves very little evidence of its presence; in fact, the Verizon report re-vealed that 61% of hotels learn of their breach through a third party, typically their merchant bank. At that point, they face tens or even hundreds of thousands of dollars in costs for forensic analysis, investigation, fines and potential legal recourse from victims. The unfortunate and frightening truth is that if your network is vulnerable, and you process credit cards through your PMS or POS, then your hotel will sooner or later be hacked – if it hasn’t already been. The thieves are not looking through hotel directories for attrac-tive hotels to target; they are using a “brute force” approach of looking at everything on the internet, and stopping only when they find something interesting, like a hotel system that’s not fully protected. You need to prevent your hotel from looking interesting to them. Protective Actions To help protect your systems while you are working toward PCI compliance, and even afterward, experts recommend three actions that could have prevented the vast majority of external attacks on hotel systems. All three are actions that the hotel can do quickly and at minimal or no cost by an IT manager or local computer support company. These are steps that the hotel, not its PMS or POS vendor, needs to take. They are by no means the only actions you should take, but they are an excellent place to start.
page 13bahaTIMES
BAHA Goes to HOSTEC
2011
During January, members of the BAHA Team spent time at HOSTEC, this year held at the Birmingham NEC. At the event members and Patrons were able to drop in at the BAHA Lounge and enjoy a peaceful cup of coffee and pastries away from the hustle and bustle of the show. BAHA’s CEO Carl Weldon, Membership Officer, Rob Maloney and Events and Member-ship Administrator, Wayne Gosden were on hand to meet members and discuss BAHA with potential new members. During the event BAHA organised three Masterclasses for both members and the show attendees with topics including: Finance Masterclass “UK Industry Update” by Mark Dickens of TRI HOTSTATS A Tri HOTSTATS Presentation on the latest UK Hotel Industry Statistics reviewing the latest full year data and trends for London and the Prov-inces from over 500 Hotels – plus a view of the future with the latest forecast! IT Masterclass “PCI Compliance” by Richard Hollis of Orthus A presentation on the unique challenges of PCI Compliance in the Hospitality Industry. An over-view of the standard, terminology, strategy, com-pensating controls and the Eagles’ approach to information security risk management. Revenue Management Masterclass “Roadmap to Revenue Management Automation” by Ally Dombey of Revenue By Design This workshop looked at the development of reve-nue management skills in hotels and the improve-ments in Revenue Management key performance indicators that can be obtained without putting in a system. We look at the criteria that hotels have used to make decisions about automating their revenue management processes and what you can expect to achieve with and without automation. If you didn’t manage to join us in Birmingham you can still view the presentations by visiting the members area on the BAHA website.
Book of the month An Introduction to Revenue Management for the Hospitality Industry
by Kimberly A. Tranter, Trevor Stuart-Hill, and Juston Parker published in 2008 by Pearson Prentice Hall remains the best selling text book in Revenue Management according to the Amazon best sellers list. Described in the foreword as a journey into an exciting new dimension in the field of hospitality management, this text book includes chapters on Customer Knowledge and consumer behavior, Market segmentation, Competitive analysis, Economic principles and forecasting, Channel management, Dynamic Value Based pricing as well details on how to structure the RM team and legal and ethical issues. The final chapters consider RM applications across the sector with particular reference to lodging, event management and , golf, gaming, theme parks and spa management. This text provides a good overview of the topics with each chapter providing discussion questions, internet exercises and references to further reading. Fore readers requiring more detail on how to apply the techniques in practice with a revenue management system a more detailed approach will be required but nevertheless this text provides a good summary of the key areas.
Article of the month
The journal the Harvard Business Review is written for an upper level management audience. Articles and comment are designed to present an analysis of management problems and helpful commentary on advanced thinking and practice in all fields of management and administration. BAHA members have access to this journal and over 2,000 others via EBSCO—the link to which is located in the BAHA members area—in fact members have access to full text copy of every publication of the HBR since 1922! The Jan / Feb 2011 edition of the HBR is packed with articles, observation and insight. The centre piece of this edition is an article by Michael E. Porter,
Bishop William Lawrence University Professor at Harvard University. He is a frequent contributor to Harvard Business Re-view and a six-time McKinsey Award winner. The article entitled, ‘Creating Shared Value’, considers how companies could bring business and society back together if they redefined their purpose as creating "shared value"--generating economic value in a way that also produces value for society by addressing its challenges. A shared value approach reconnects company success with social progress. Firms can do this in three distinct ways: by reconceiving products and markets, redefining productivity in the value chain, and building supportive industry clusters at the company's locations. Other articles in this edition include: Reinvent Your Business Before It's Too Late, Are You A Good Boss—Or a Great One?, How to Make the Most of Your Company's Strategy and Investing in the Post-Recession World. All articles can be downloaded to read or alternatively an audio version is available – with the choice of English, American or Australian accent!
Click to MY BAHA at www.baha-uk.org for details. Written by Debra Adams, BAHA Education [email protected]
bahaTIMES
BAHA Recommended Practice Guide: “Developing Customer Profitability Analysis for Hotels”
Prof Peter Harris and Dr Vira Krakhmal
The industry-funded BAHA guide that adds value to hotel management accounting information by providing an industry standard for the system-atic development and implementation of Customer Profitability Analysis (CPA) in the international hotel sector. CPA is a powerful strategic tool which complements revenue manage-ment by providing an insight into the (uneven) distribution of costs and profits across hotel customer groups and enabling managers to: Gain an overall impression of the subsidising and dependence of
profitable and unprofitable customer groups Assess the ‘risk’ scenario from customer profiles Analyse cost structures of customer groups to determine ‘added value’
versus ‘added cost’ Greater transparency in reviewing current and new business
development negotiations with key clients Manage marketing resources and making strategic repositioning decisions Review pricing strategies
The cost of the BAHA practice guide is £35 (exclusive of postage and packaging)
To order contact: BAHA Administration Office, Email: [email protected]
“I now know more about my business than I have ever known before” “The bottom line is the system has paid for itself in weeks and there are numerous tangible benefits”
You are invited to find out how at a Seminar on Wednesday 13th April at 2.30pm to 5.00pm
Strand Palace Hotel, London
The seminar will cover Revenue Management, Business Intelligence and a ‘live’ case study, and will be of particular interest to GMs, RMs, and consultants.
To find out more or to register please send an email to [email protected]
The BAHA Meetings Programme is sponsored by Fourth Hospitality
a leading supplier of on-demand business intelligence solutions for the Hospitality industry
21st February BAHA Members Meeting - Social Media presented by Ally Dombey of Revenue By Design, Le Méridien, Piccadilly, London
4th March HRMC Revenue Management workshop, Mint Hotel, Tower of London starts at 8.00am for 8.30am
4th April BAHA Members Meeting - Latest Forecast presentation by PwC, London
13th April Revenue Management workshop, Strand Palace Hotel from 2.30 - 5.00pm with EasyRMS
Patrons are valued members of the British Association of Hospitality Accountants, providing the Association and its members with a wide range of services and technical advice. Visit www.baha-uk.org/sponsorsandpatrons.asp to view links to all our patrons.
Gold sponsors include:
Agilysys Best Western Hotels
Clarity Hospitality Fourth Hospitality
Global Blue IDeaS - A SAS Company
KPMG
FORTHCOMING EVENTS AT A GLANCE
The British Association of Hospitality AccountantsBAHA Administration Office, Suite 6, Merley House Business Centre,
