Skip to main content
FromNine
Menu

Advice

Architecture choices your board and auditors can follow.

We help you settle the route before money is committed: a candid view of the systems you run, alternatives laid out with their costs and risks, decisions written down, and a roadmap delivery teams can actually execute.

For leadership teams in Malaysian groups deciding on platforms, AI and cloud for a parent at home and companies in Europe.

Arrange a discussionEU AI Act guide
Architecture & Consulting: the three layersThree layers, read downwards: a roadmap divided into waves; the options and the records of each decision; and, as the base for both, your goals and an understanding of the current estate.01Roadmap, wave by wave02Alternatives and written decisions03Goals and today’s estate
  1. 01Reviews of the current estate that put technical debt and risk on the table
  2. 02Options scored on value, feasibility, risk and lifetime cost, then recorded as ADRs
  3. 03Roadmaps sequenced by what depends on what, then checked while delivery runs

01 Common problems

When leadership wants a second opinion

  1. 01

    A big decision is near, and every option sounds plausible

    Platform A or B, build or buy, one cloud or another, vendor X or Y. Each has an internal sponsor, and nobody has weighed them on one scale.

  2. 02

    Plenty of AI ideas, but no portfolio

    Departments keep sending in AI proposals. No one has ranked them, checked the personal data they touch, or asked which would be high-risk under the EU AI Act if their output were used in the EU.

  3. 03

    Milestones keep slipping without explanation

    Status reports stay green while milestones move, and the steering committee wants an independent assessment.

  4. 04

    The tender date is set; the specification is not

    Your teams can describe the need in business terms, yet struggle to turn it into requirements that suppliers can price and answer properly.

02 Scope of the service

What the service covers

  1. 01 Assessment of the current architecture

    We examine your applications, data, interfaces, infrastructure and contracts in a structured way. Technical debt is surfaced and ranked in a risk register, using ArchiMate and TOGAF if those are already your standards.

    Activities

    • Conversations with architects, system owners and the people who run operations
    • An inventory of applications and interfaces
    • Assessment of technical debt and risk
    • Review of costs and contracts

    What you would receive

    • A description of the current architecture
    • Risk register in which each risk has a named owner
    • A findings session with the decision makers

  2. 02 AI use cases ranked as a portfolio

    AI use cases ranked by value, feasibility and risk, each with a first view on whether the EU AI Act could apply, a check of the personal data involved under Malaysia’s Personal Data Protection Act 2010 (Act 709), and a recommendation to build, buy or partner.

    Activities

    • Collection of use cases across departments
    • Scores for business value, state of the data and risk
    • A first EU AI Act and PDPA check for each use case
    • Analysis of build, buy or partner

    What you would receive

    • A ranked portfolio of use cases
    • Three use cases ready to begin
    • The data and platform prerequisites for each

  3. 03 Target landscape and a roadmap in waves

    Platform decisions across SAP, Odoo, Salesforce and custom software, arranged in waves with their dependencies, total cost of ownership and the organisational change each wave needs. For a Malaysian parent with companies in the EU, that often means one template that handles e-Invoice through MyInvois at home and EU invoicing and data rules abroad.

    Activities

    • A capability map and target principles
    • Analysis of options for each domain
    • Lifetime cost modelled over a multi-year horizon
    • Waves planned around their dependencies

    What you would receive

    • A target architecture
    • A roadmap in waves
    • Business case input for each wave

  4. 04 Hosting and cloud strategy

    Analysis of lock-in, decisions on where data is hosted, and exit plans, so that cloud and SaaS choices stay reversible where it counts. Regulated clients get options they can defend against the RMiT policy document of Bank Negara Malaysia (BNM), the SC Guidelines on Technology Risk Management or DORA, as applicable.

    Activities

    • Analysis of dependencies and lock-in
    • Data classification and hosting options
    • Estimates of exit costs
    • Clauses for procurement to check before signing

    What you would receive

    • Hosting decision recorded per data class
    • Exit routes for each critical service
    • A cloud strategy paper

  5. 05 Support for tenders and procurement

    Market consultation, functional specifications and evaluation criteria for buyers such as government-linked companies, statutory bodies and listed groups. We are open about prior involvement: helping to prepare a tender can affect whether we may respond to it later, and we settle that at the start. In the EU, article 41 of Directive 2014/24/EU governs this for public buyers; elsewhere the buyer’s own procurement rules decide.

    Activities

    • Requirements gathering and soundings with the market
    • Specifications covering function, performance and security
    • Award criteria with a scoring model
    • Support with clarification questions during the tender

    What you would receive

    • A specification ready to publish
    • An evaluation framework
    • A written agreement on later participation

  6. 06 Recorded decisions and assurance during delivery

    Decision records, a design authority and independent check-ups on programmes already under way, so each choice is traceable and trouble shows up early.

    Activities

    • An ADR practice with templates
    • Design authority established and facilitated
    • Assurance check-ups at fixed intervals
    • Health checks on programmes in difficulty

    What you would receive

    • A decision log in daily use
    • A charter for the design authority
    • Review reports with concrete recommendations

03 Architecture

How a decision takes shape

Our advisory work follows a single line: from your goals and the current estate, through options compared on agreed criteria, to decision records that your design authority approves, and on to a target architecture and a roadmap in waves.

Constraints run beneath every step: hosting and exit, EU AI Act classification and PDPA requirements, procurement rules, and the capacity of your own teams.

Layers shown

Understand
What the business wants, what limits it, and what today’s systems and their risks look like.
Decide
Agreed criteria, the alternatives, the design authority and its written decisions.
Plan
Target landscape, roadmap waves and check-ups once delivery has started.
Illustrative example

  1. Understand

    • Goals and boundary conditions
    • Review of today’s estate
    • Register of risks

  2. Decide

    • Criteria: value, risk and cost
    • Options
    • Your design authority
    • Written decisions

  3. Plan

    • Target landscape
    • Roadmap, wave by wave
    • Assurance during delivery

  4. Constraints

    • Limits: hosting and exit, EU AI Act class, procurement rules
Goals to roadmap, through decisions on record

A method shown for illustration; not a client engagement.

Read the diagram as text

The path starts at business goals and constraints, passes a review of today’s systems, moves to alternatives and then to written decision records, and ends with a target architecture and a roadmap split into waves.

From the estate review comes a risk register. Criteria fixed in advance (value, feasibility, risk, lifetime cost) frame the alternatives. The design authority, made up of your architects, approves each decision record. Assurance check-ups follow the roadmap into delivery.

Along the bottom, a band of constraints covers hosting and exit, EU AI Act classification and procurement rules.

04 Trade-offs and limits

Trade-offs and limits

  • Independence

    What we do about it

    We also build and operate systems, on SAP, Odoo and Salesforce among others. In advisory work we score options on criteria agreed with you before we look at any vendor, and we write down why each option scored as it did.

    Limits and prerequisites

    If you need advice from a party that will not deliver afterwards, say so. We will agree that at the start, or recommend that you engage a purely advisory firm.

  • Law and regulation

    What we do about it

    We bring working knowledge of the PDPA, the Cyber Security Act 2024 (Act 854), e-Invoice, the EU AI Act, the GDPR and NIS2 into architecture decisions.

    Limits and prerequisites

    Legal advice is outside our remit. How we classify a use case or read a rule is input for your counsel, who reaches the legal conclusion.

  • Plans change once delivery starts

    What we do about it

    Waves follow dependencies and available capacity, and we revisit the plan whenever a wave closes.

    Limits and prerequisites

    No roadmap survives unchanged. Its worth lies in the decisions it makes explicit, so we keep it current through assurance reviews rather than hand it over as a document and leave.

05 Working method

Our working method

Short and evidence-led, and your own architects sit at the table throughout.

  1. 01

    Frame the decision

    The decision itself, its owner, its deadline and the criteria that will count.

    ResultBrief for the decision

  2. 02

    Collect evidence

    Interviews, documentation, system data and cost figures, gathered until the decision is supported and not beyond.

    ResultEvidence base and a view of today’s estate

  3. 03

    Compare the options

    Between two and four credible alternatives, each scored on the agreed criteria, with risk and cost stated.

    ResultComparison of alternatives

  4. 04

    Decide, then write it down

    The decision is taken by your design authority. We draft the record and the roadmap that flows from it.

    ResultWritten decisions plus a roadmap

  5. 05

    Assure the delivery

    Regular reviews check that delivery still matches the decisions, and signal when a decision deserves another look.

    ResultCheck-up reports

06 Human oversight

Who takes the decisions

We advise. The decisions belong to the people accountable for them.

  • Approval sits with your design authority

    Every decision record needs the signature of your design authority or of an owner you name. We never approve one alone.

  • Criteria are fixed before options

    Criteria and their weights are agreed by you before scoring begins, which prevents anyone from tuning the outcome later.

  • Disagreement is recorded

    Where views differ, the record keeps the rejected alternatives and the reasons for rejecting them.

07 Scenario

An illustrative scenario

Illustrative example

One ERP template for a Malaysian parent and its EU subsidiaries

01Starting point
A Malaysian manufacturing group runs one ERP at home and two others at subsidiaries it acquired in the EU. Group finance closes the month from spreadsheets, and each system handles invoicing rules on its own.
02What we would deliver
An option analysis comparing one global ERP template, a two-tier model with a group core and lighter systems in the subsidiaries, and integration only, each with costs, risks, the handling of e-Invoice through MyInvois and EU e-invoicing, and a roadmap in waves.
03Decisions that stay with people
Criteria and the final decision belong to the group design authority; each subsidiary’s managing director reviews the operational impact before it is approved.
04How results would be tracked
Lifetime cost across the planning period, days needed for the consolidated month-end close, and how many interfaces remain to be maintained.

08 By industry

By industry

  • Public Sector & Government

    Target architectures for federal agencies and statutory bodies, specifications buyers can put to tender, and designs that plan for MyDigital ID login. Read more about our view of the public sector.

  • Financial Services

    Architecture decisions written up for supervisors such as Bank Negara Malaysia (BNM) and the Securities Commission Malaysia (SC), with third-party technology risk and exit strategies included.

  • Manufacturing & Industry

    Rationalised ERP and plant systems across factories, sequenced so that production calendars and export shipments are not disrupted.

Malaysia

One template for a Malaysian parent and its EU companies

A Malaysian group with subsidiaries in the EU answers to two sets of rules at once. At home, the Personal Data Protection Act 2010 (Act 709) as amended by Act A1727, with amendments in force since 2025, e-Invoice through MyInvois, and for some organisations the Cyber Security Act 2024 (Act 854). In the EU, the GDPR, the EU AI Act and national laws that implement NIS2.

We turn those rules into explicit criteria in every option analysis and record how each decision meets them. One ERP template or platform design can then serve the parent and the subsidiaries, and the same reasoning can be shown to a board, an auditor or a regulator in either jurisdiction.

Questions on architecture and consulting

What does an architecture assessment take in time?

Scope decides. Reviewing a single domain or one pending decision is a matter of weeks; a review of your entire estate needs more. Scope, questions and schedule are fixed in a decision brief before work starts.

Can advice be impartial from a firm that also delivers?

By making our reasoning visible: criteria agreed before the options, scores written down, alternatives recorded. If you need full separation between advice and delivery, we agree at the start that we will not bid for the delivery, or we advise you to choose another adviser.

Do you prefer SAP, Odoo or Salesforce?

We are a partner of all three (Salesforce Summit Partner, SAP Gold Partner, Odoo Gold Partner), and we also write custom software, so we have no single platform to promote. Each suits different situations, and sometimes the right answer combines them, for example SAP for the Malaysian parent and Odoo in smaller subsidiaries.

If you help us write a tender, can you then bid?

Possibly, but not by default. For public buyers in the EU, Directive 2014/24/EU allows prior involvement only when the contracting authority makes sure competition is not distorted, for example by sharing the information we produced. For other buyers, your own procurement rules apply. We raise the question openly before we start, and the buyer decides.

How should we begin with AI?

Start from a portfolio, not a lone pilot. Collect the candidates, rate each one on value, data readiness and risk, and launch the two or three that promise most, can be built and carry a risk you can learn from. Our AI Engineering & GenAI teams then deliver them, with tests running ahead of the first release.

Who would we work with?

Senior architects with delivery experience, supported where a question calls for it by specialists drawn from 2,400+ colleagues: security, data, AI or a particular platform.

Tell us which decision is on your desk

Our reply will cover how to frame it, what evidence it calls for and how much time a sound answer needs.

Arrange a discussionPublic sector