Many information systems that claim to be Internet-based may not be. To
determine whether a system is truly Web-based, vendors suggest asking these questions:1.
Find out what development language was used and how the risk management information system
is accessed from the Internet.
If it uses Citrix or PC Anywhere, then it's not a Web-based system; it's a Web-enabled
system using software that serves as an intermediary. But if it uses a Web browser such as
Netscape or Microsoft Internet Explorer, it was built for the Internet.
2. Where will the program be hosted? A model with an application service provider, or
ASP, is more likely to be Web-based, because its software tools are hosted offsite and
accommodate multiple users simultaneously. Some browser-based systems, though, can be
hosted internally on intranets and still be Web-enabled.
3. Evaluate who the vendor is and how long it has been in the business. Get references
and ask their other clients how the vendor has responded to their needs.
4. Review your own business process. Will you be able to apply the new technology
readily, or must you change the way you do business in order to adapt to it?
5. Specify your security needs.
6. Make sure all the bugs have been worked out of the product and that the vendor will
provide maintenance and upgrades.
7. Will custom modifications be available or is the system unchangeable? If it can't be
changed, it's probably not Web-based.
8. Find out who the vendor's technology partners are to make sure they will be able to
deliver what they promise.
``Many small vendors don't have the horsepower'' that is necessary to meet all of a
risk manager's needs, explained David Tweedy, national insurance principal at IBM Corp. in
Providence, R.I. ``If a risk manager just wants information and not too many transactions,
they may be OK.''
But risk managers who want to do a lot of number-crunching and other analytical
transactions may be better off sticking with the big players that have established RMIS
track records, Mr. Tweedy said.