Opportunities of E-Business Assurance & Security:  Risks in Assuring Risk

Bob Jensen at Trinity University

Assurance Services Opportunities and Risks 

Large CPA Firm Revenues and Services  

A Special Section on Computer and Networking Security  

External Auditing of Information Security: Perception Versus Reality

External Auditing Combined With Consulting and Other Assurance Services: Audit Independence?

Cookies 

Threads on Firewalls

Bob Jensen's Threads on Accounting Fraud, Forensic Accounting, Securities Fraud, and White Collar Crime

Bob Jensen's Technology Glossary

Internal auditing and fraud investigation site of Mark R. Simmons --- http://www.mrsciacfe.cjb.net/

I created a timeline of major happenings (on a timeline) leading up to the eXtensible Business Reporting Language (XBRL) and On LIne Analytical Process (OLAP) systems.  Overviews of XML, VoiceXML, XLink, XHTML, XBRL, XForm, XSLT, RDF and the Semantic Web are also provided --- http://www.trinity.edu/rjensen/xmlrdf.htm

Assurance Services Opportunities and Risks

You might find some added materials of interest at http://www.trinity.edu/rjensen/ecommerce/assurance.htm 

The AICPA's Assurance Services Website is at http://www.aicpa.org/assurance/index.htm 

November 8, 2002 updates on  electronic commerce and assurance services --- http://www.trinity.edu/rjensen/ecommerce/assurance.htm 

Update on a new education program that appears to not involve CPAs
Seeking to lead the country in higher education to combat cyber crime, the University of Fairfax announced today its first graduates from MS and PhD programs designed to produce information security and information assurance leaders. These graduate programs enable students to earn an MS or PhD in Information Security.
"University Of Fairfax Announces First Graduation," PRWeb, July 24, 2006 --- http://www.prweb.com/releases/2006/7/prweb413757.htm

Jensen Comment
Perhaps CPAs really did not have much comparative advantage in the realm of information security. CPA firms in reality had to hire assurance services experts from outside traditional accounting programs. Even the Masters of Assurance Services introduced by such universities as Notre Dame and the University of Virginia had very non-traditional curricula in terms of accountancy.

Some universities now offer a specialty curriculum (usually at the graduate level) in Assurance Services.  For example, note the E&Y funded programs at Notre Dame and the University of Virginia ---
http://www.ey.com/global/Content.nsf/US/Careers_-_Student_-_Your_Master_Plan

The AICPA's main assurance site of interest --- http://www.aicpa.org/assurance/index.htm 

The Trust Services principles and criteria with links to SysTrust and WebTrust are on the AICPA website at www.aicpa.org/trustservices/  ( http://tinyurl.com/8h4twP ) ..
Also see Privacy materials at http://infotech.aicpa.org/Resources/Privacy/

“E-Commerce And CPA WebTrust,” New Accountant, October 21, 2005 --- http://www.newaccountantusa.com/newsFeat/t2k1/t2k1_cpawebtrust.html

Performance View Services --- http://www.aicpa.org/assurance/view/what.htm

Bob Jensen's threads on performance measurement are at http://www.trinity.edu/rjensen/roi.htm

Question
When are performance evaluation services assurance services as opposed to advisory services?

Answer
It probably doesn't matter much how they are classified, but I like to think of advisory services as being for the direct benefit of the client who pays for the service.  Assurance services tend to be intended for third party benefit such as customers, creditors, investors, employee unions, etc.
 

Risk Advisory Services by CPA Firms ---
http://www.aicpa.org/assurance/risk/index.htm 

What are Risk Advisory Services and Why Should I Get Involved?

Risk Advisory Services Task Force
Learn about the Task Force's mission, its members and highlights of meetings.

How to obtain a free copy of the new thought leadership document on Risk,
MANAGING RISK IN THE NEW ECONOMY  

Download URL --- http://ftp.aicpa.org/public/download/Managing%20Risk.pdf 

Question
When are risk evaluation services assurance services as opposed to advisory services?

Answer
It probably doesn't matter much how they are classified, but I like to think of advisory services as being for the direct benefit of the client who pays for the service.  Assurance services tend to be intended for third party benefit such as customers, creditors, investors, employee unions, etc.

Example of one firm's risk advisory services
KPMG Risk Advisory Services ---
http://www.kpmg.com/services/content.asp?l1id=90&l2id=520

One area of expanded assurance services is in the auditing and analysis of fair values and risk.
E-COMMERCE AND AUDITING FAIR VALUES SUBJECTS OF NEW INTERNATIONAL GUIDANCE
The International Federation of Accountants (IFAC) invites comments on two new exposure drafts (EDs): Auditing Fair Value Measurements and Disclosures and Electronic Commerce: Using the Internet or Other Public Networks - Effect on the Audit of Financial Statements. Comments on both EDs, developed by IFAC's International Auditing Practices Committee (IAPC), are due by January 15, 2002. See http://accountingeducation.com/news/news2213.html  

The IFAC link is at http://www.ifac.org/Guidance/EXD-Download.tmpl?PubID=1003772692151 

The purpose of this International Standard on Auditing (ISA) is to establish standards and provide guidance on auditing fair value measurements and disclosures contained in financial statements. In particular, this ISA addresses audit considerations relating to the valuation, measurement, presentation and disclosure for material assets, liabilities and specific components of equity presented or disclosed at fair value in financial statements. Fair value measurements of assets, liabilities and components of equity may arise from both the initial recording of transactions and later changes in value.

 

Download "Auditing Fair Value Measurements And Disclosures" in MS Word format. File Size: 123 Kbytes Download "Auditing Fair Value Measurements And Disclosures" in Adobe Acrobat format. File Size: 209 Kbytes

Bob Jensen's threads on risk and financial reporting are at
http://www.trinity.edu/rjensen//theory/00overview/theory01.htm

In particular note the threads on risk hedging at
http://www.trinity.edu/rjensen/caseans/000index.htm

SysTrust --- http://www.aicpa.org/assurance/systrust/index.htm 

The AICPA/CICA Trust Services principles and criteria will be released January 1, 2003. The effective date of the new Trust Services principles and criteria became effective for engagements beginning on or after January 2003. Earlier implementation is encouraged.

What are SysTrust Services and Why Should I Get Involved? A Brief Introduction on SysTrust Services FAQs about SysTrust --- http://www.aicpa.org/assurance/systrust/faq.htm SysTrust Principles & Criteria What Skills Do I Need to Provide SysTrust Services? Find out what skills are necessary and what resources are available to enable you to offer SysTrust Services. Getting Started Learn about SysTrust licensing agreement and training opportunities. Marketing and Managing a SysTrust Practice Tips on Marketing and Managing Your SysTrust Practice. What's New with SysTrust Services? New standards, product developments, etc. Systems Reliability Assurance Services Task Force Learn about the Task Force's mission and its members. Frequently Asked Questions about SysTrust Press Room Press Releases, Product News, Fact Sheets, Q&As, Case Studies, Spokesperson Biographies, etc. Contact the AICPA

A good source to look at is entitled "SysTrust and WebTrust Technology Assurance Opportunities,"  by Anthony J. Pugliese and Ronald Halse, The CPA Journal, 2000 --- http://www.nysscpa.org/cpajournal/2000/1100/features/f112800a.htm How SysTrust Works SysTrust is designed to offer assurance to a broad audience—management, boards of directors, customers, and business partners—about the information systems that support a business or one of its segments. In a SysTrust engagement, a CPA performs an examination, similar to an audit, to evaluate the system’s reliability. A positive SysTrust report attests to the system’s reliability and ability to operate without material error, flaw, or failure during a stated period of time in a specified environment. Clients would be interested in a systems assurance examination for some of the following reasons: Internal and external users can lose access to essential services because of system failures and crashes. Systems can be vulnerable to viruses and hackers because of unauthorized system access. System failure can result in loss of access to system services or loss of data confidentiality or integrity. Negative publicity in the wake of high-profile system failures can undermine customer and investor confidence. SysTrust can benefit a business’s day-to-day operations in the following scenarios: A company is trying to win a major contract as a supplier to a corporation that uses just-in-time (JIT) inventory management. A SysTrust report that demonstrates the reliability of the company’s systems and shows its capacity to be a dependable partner in the JIT environment enables the company to differentiate itself from its competitors. A company decides to outsource its human resources, payroll, and other employee-related systems. To ensure smooth operations, it insists that any successful bidder maintain unqualified SysTrust reports on the outsourced systems. A retailer qualifies for a discount on business interruption insurance because its SysTrust report attests to the reliability of its inventory management systems. When technology problems at foreign subsidiaries cause trouble for an international company, its audit committee decides to adopt the SysTrust principles and criteria as a minimum standard for key subsidiaries. In a SysTrust engagement, a system is divided into five elements: Infrastructure, such as hardware and facilities Software, including operating systems, utilities, and business applications software n People, who operate and use the system Procedures, which can include information system backup and maintenance or input procedures. Data, or the information that the system uses and supports. Together, these elements form a system that provides the information that the business needs to function and supports management in long-term decision making. Four essential principles comprise a SysTrust engagement: Availability. Does the system operate in accordance with the business requirements? Is it accessible for routine processing and maintenance? Security. Is the system protected against unauthorized access? Integrity. Does the system process information completely, accurately, in a timely manner, and in accord with the required authorization? Maintainability. Can the system be updated to provide continued availability, security, and integrity? SysTrust standards also include 58 underlying criteria that establish the specific control objectives a system must meet to be considered reliable. Under the version 2.0 SysTrust Principles and Criteria for Systems Reliability exposure draft, practitioners can report on any of the SysTrust principles in an individual engagement, depending on the client’s needs. SysTrust version 2.0 also offers guidance on testing systems in the preimplementation stage. In addition, it covers agreed-upon procedures and consulting engagements. SysTrust examination-level attestation engagements are performed in accordance with Statements on Standards for Attestation Engagements No. 1, Attestation Standards (an examination-level engagement must be performed to issue a SysTrust report), and are also covered by the AICPA Code of Professional Conduct. At the conclusion of a SysTrust engagement, the CPA gives the client a reporting package that includes an attestation report, a system description, and an assertion about the effectiveness of controls over the reliability of the system.

October 18, 2005 message from XXXXX

The problem with both Webtrust and Systrust was the volume of recurring work and the associated high fees the client incurred. Also, the products were designed in the audit area of the AICPA when they should have been in the tech area. The zeal in the audit area has traditionally been the core of the organization so it was the 800 pound gorilla. Unfortunately, this gorilla had one answer for all issues, full scope substantive audit procedures. As a result, the products by design are not affordable.

This same inertia occurred when Ev and I tried to change the audit standard to acknowledge that electronic evidence and fully automated systems were very difficult to audit and that substantive audits may not be possible.
That effort took 5 years to gain two small lines in the audit evidence standard. We were at one point told off the record that to put this into the standard was not in the best interest of the profession since auditors were not trained to audit through the computer, only around it. We have come a long way since the early 1990's, but there are still a number of firms that gloss past this change and the standard remains woefully short of what we need.

Digital Certification Services Ohio CPA Journal, October-December 2000 --- http://www.ohioscpa.com/publications/journal/default.asp?article=647-7  

Options for Providing Consumer Assurances CPAs and their clients have three basic options to provide Web-based privacy, reliability, and security assurances to customers. Self-Reported Assurances. Online businesses can devise policies, implement security measures, and then, if their managers so desire, inform consumers about these actions. Government Regulation. Government agencies might recommend or regulate Web-based business actions under the guise of consumer protection. Third-Party Assurance Services. A Web-based business can support online industry self-regulation via third-party certification of Web sites. In fact, some firms or organizations are actively pursuing each of these options, and each option is associated with costs and benefits. . . . A Comparison of Third-Party Assurance Services A number of third-party assurance seals are appearing on various Web sites today. CPAs actively participate in several such programs by offering either the assurance service or by providing dispute resolution services. Commonly found seals offering some level of assurance for customers include WebTrust, TRUSTe, BBBOnline, and BetterWeb. Other seal programs exist but have not yet achieved the recognition for assurance associated with these four. WebTrust <www.cpaWebtrust.org> The American Institute of Certified Public Accountants (AICPA) and the Canadian Institute of Chartered Accountants developed one of the older and strongest assurance programs for online businesses, WebTrust, in 1997. This program is the only one that requires the certifier to be a specially trained and licensed reviewing agent. The AICPA has licensed approximately 175 firms in the United States and an additional 75 firms in other countries to perform WebTrust services. WebTrust has an alliance with VeriSign, a company that provides digital identification and a seal for Web sites that have passed the review of the WebTrust agent. VeriSign lists all the firms that have received WebTrust seals on its Web site; as of May 2000, 27 Web sites have been WebTrust certified. The WebTrust review process is very comprehensive and correspondingly expensive compared to the other assurance seal programs. The cost of obtaining a WebTrust seal can range from thousands to millions of dollars, depending on the number of transactions audited, the complexity of the Web site, and other factors. Under the WebTrust process, a CPA reviews the Web site's technology, security, and business practices. Business practices encompass, for example, the online business' policies for sales returns, shipping costs, transit time, and so on. The WebTrust agent examines transaction integrity to be sure that the firm actually processes and bills its electronic orders or handles its electronic messages appropriately. Effective controls to provide reasonable assurance of sound business practices are to be in place and are examined. In addition, the Web site must protect consumer information via methods such as encryption, firewalls, physical facility safeguards, and other appropriate controls. Web sites must offer choices to customers about use of their personal information. Either opt-in (e.g., the use of check-off boxes for activities in which the consumer wants to be included) or opt-out (e.g., the use of check-off boxes for activities in which the consumer does not want to be included) choices must be available on the Web site. Further, Web sites must give consumers opportunities to review and contest personal data. Thus, a WebTrust-certified site discloses its actual business practices; it has internal controls that assure satisfactory handling of customer transactions; and, it maintains controls that provide reasonable assurance that confidential consumer information is protected from uses that are not related to the entity's business. Undergoing a WebTrust certification process helps businesses by enhancing consumer confidence, which should lead to increased revenue. The process also provides a WebTrust-licensed CPA with a basis for providing sound advice for strengthening a client's online business activities. WebTrust seals involve an ongoing review process to ensure that the seal-holder's online business practices continue to meet WebTrust standards. Webtrust CPAs update the certification reports at least once every 90 days. A Web site user who is interested in knowing details about the firm's policies can read the most recent report online. If consumers have complaints about a WebTrust certified business, they can contact the issuing CPA directly, who will act as a liaison to the certified firm. TRUSTe <www.TRUSTe.org> Also founded in 1997, TRUSTe's developers were the Electronic Frontier Foundation and the CommerceNet Consortium. TRUSTe is an independent, nonprofit organization whose mission is to build users' trust and confidence in the Internet. To accomplish this mission, TRUSTe is involved with educational efforts, assurance services, and oversight activities. TRUSTe is probably the best known assurance seal service; it issued its 1000th seal in January 2000. Cost is based on the online business' annual revenues, and ranges from $299 to $6,999. TRUSTe's assurance certifications are focused primarily on the privacy of consumer information. However, TRUSTe defines privacy to include selected security aspects. The organization's procedures assume that no one privacy policy will work for all firms. Thus, TRUSTe requires disclosure of each certified business' particular policies, typically displayed when a site visitor clicks on the "trustmark" or seal. If a firm needs help in creating its privacy policy, TRUSTe has made wizards available to help generate a customized privacy statement for that firm. TRUSTe's review process examines whether the firm's privacy policies are in line with fair information practices and are posted. TRUSTe expects the site to disclose the information that is being gathered about the consumer, how it will be used, with whom it will be shared, and how to verify, update, or correct personal data. TRUSTe Web sites must allow consumers to opt-out of internal secondary uses of their data and third-party distribution of their data for secondary uses. Further, procedures must be in place to protect a user's information from loss or misuse. After issuing a seal, TRUSTe monitors the seal-holding Web site on a quarterly basis. The organization plants identifiable records on Web sites and observes the consequences to see if the Web site is violating its policies. All TRUSTe members have agreed to comply with its dispute resolution process, and TRUSTe will act as a liaison between the consumer and the licensed firm in case of consumer complaint. Suspected policy violation investigations may trigger an onsite compliance review. Currently, TRUSTe arranges for PricewaterhouseCoopers or KPMG to conduct the compliance reviews. In addition, TRUSTe is currently working with Ernst & Young on an enhanced verification approach. BBBOnline <www.bbbonline.org> Founded in 1998 with its first seals issued in 1999, BBBOnline is a subsidiary of the Better Business Bureau (BBB). BBBOnline's assurance services benefit from the aura of the BBB, which has nearly ninety years of experience in voluntary self-regulation and consumer-dispute resolution. As with other seal programs, BBBOnline provides an online, searchable database of businesses that it has deemed trustworthy. BBBOnline offers two different seals for Web sites: a Privacy seal and a Reliability seal. In general, the Reliability seal relates to the "bricks-and-mortar" BBB program. To receive a reliability seal, a firm must be a BBB member. Thus, this seal identifies online businesses that are associated with honest advertising and fair treatment of customers. An online business must not have an unsatisfactory record with the BBB to be considered for a separate Privacy seal. Then, the review process focuses on the privacy policies of the Web site. An organization's privacy policies must meet BBBOnline's core principles for disclosure, choice, and data security, and the organization must post its policies on its Web site with clear links on Web site pages. Sites must undergo annual self-assessments of their security policies, and BBBOnline monitors sites on a random basis. Certified sites agree to the mandatory dispute resolution procedures of BBBOnline. Annual cost for this assurance service is inexpensive; ranging from $150 to $5,000 based on annual revenue. BBBOnline gives a 50 percent discount to businesses that also participate in the BBB Reliability program. Currently, BBBOnline has granted more than 500 Privacy seals and more than 5,000 Reliability seals. BBBOnline offers opportunities to professional organizations for co-marketing of the BBBOnline seal. The partnered organization must commit to promoting good privacy practices and to educating their members about the Privacy seal program. Association members then receive discounts on the annual Privacy seal fee, making it even less costly to some online businesses. BetterWeb <www.betterWeb.com> PricewaterhouseCoopers has recently developed an assurance seal program called BetterWeb. This program offers certification to firms whose policies are disclosed according to the BetterWeb standards. PricewaterhouseCoopers officially launched BetterWeb in December 1999 and has certified eight sites as of May 2000. BetterWeb is a relatively costly service with an annual fee of approximately $15,000 per site. The BetterWeb program examines policies regarding sales terms (if applicable to the online business), privacy and security of consumer information, and customer complaints. If a site is certified, BetterWeb assures that policies in these areas exist and are readily accessible to the site visitor. BetterWeb does not provide consumers any assurances about the effectiveness of a firm's internal controls or adherence to its posted policies. With respect to consumer complaints, the online business must post contact information and provide a timely confirmation of complaint receipt to the correspondent. BetterWeb does not act as an intermediary in the dispute process. Table 3 provides a summary of the services and features of the major third party assurance seals discussed above. Other Third-Party Efforts Initiated in December 1999, the Secure Assure model is quite different from the previously discussed programs. While these other seal programs all require posting of firm-specific policies, SecureAssure does not permit its affiliates to have independent policies in areas covered by its seal. All seal holders must agree to follow the SecureAssure standards for accountability, security, dependability, and legitimacy in addition to limitations on collection, use, and distribution of personal information. Many CPA firms also offer online business reviews leading to opinions on the adequacy and reliability of controls related to operational and privacy issues. Except for PricewaterhouseCoopers' BetterWeb Seal, these efforts have not been directed at branding a specifically identifiable emblem. Also, a number of other seals are available that do not include reviews of policies, compliance reviews, or dispute-resolution processes. Some are free, and some require a minimal fee for listing a Web site in what is essentially an online database of members. Examples include Multicheck, PublicEye, and Netcheck Commerce Bureau. Enonymous.com is a Web site that offers related but somewhat different services to consumers. Enonymous rates online sites on the comprehensiveness of their stated privacy policies. Sites do not have to be members and compliance with stated policies is not examined. Enonymous provides free software that resides on the consumer's computer and places an icon on the computer screen. When the consumer is visiting an online business, a click on the Enonymous icon provides a rating of the online business's privacy policies. Enonymous assigns an online business's privacy policies from one to four stars. As net-businesses grow, consumers should expect additional seal-branding efforts. Conclusion Consumer concerns about the legitimacy and operational aspects of online businesses and the use of personal information certainly are warranted. Assurances range from comprehensive to very narrow just as the cost of being certified ranges from inexpensive to costly. At the present time, the more costly assurance services, WebTrust and BetterWeb; have the fewest certified Web sites. Because BetterWeb is relatively new, its market potential is difficult to assess. WebTrust, on the other hand, is one of the oldest Web site assurance services. Evidently, the marketplace does not perceive that the extra value associated with WebTrust is worth the additional cost. The AICPA and WebTrust licensed CPAs need to promote the advantages of WebTrust's more comprehensive assurance services if this program is to grow. CPAs, with their understanding of assurance services, are in a unique position to assist clients in choosing among competing Web site certification programs. In addition, CPAs can aid clients in developing policies that are appropriate for the assurance seal required. In the event that legislation is passed requiring compliance with online privacy practices, CPAs must be ready to help clients meet the requirements. Also see http://www.msnainc.com/publications/archive/webtrust.pdf

Bob Jensen's threads on assurance services --- - http://www.trinity.edu/rjensen/ecommerce/assurance.htm  

Some sample questions

Question 1.1
What is the WebTrust^SM Electronic Commerce Seal that is now offered by an increasing number of public accounting firms who provide assurance services? What are the three broad categories of WebTrust^SM (referred to in the case as LogoTrust, TransTrust, and DataTrust)? How did WebTrust^SM come about and what is the AICPA/CICA relationship with VeriSign?

[Hint: Start your search at the AICPA web site http://www.aicpa.org/assurance/index.htm  and then go to the VeriSign web site at http://www.verisign.com ]

Verifying that the company or person on the other end of the line is truly that company or that person has become known as authentication. The best-known web authentication service is VeriSign. In a single press release on September 16, 1997, the American Association of CPAs and the Canadian Institute of Chartered Accountants announced the public/chartered accountant WebTrust^SM Electronic Commerce Seal. The Seal was to be used by member firms that offer assurance services in the broad areas of the following:

1. Business Practice Disclosures
2. Transaction Integrity
3. Information Protection

Employees engaged in WebTrust activities are required to meet training standards set by the AICPA and the Canadian CICA.

In the area of authentication services, the best-known current provider is VeriSign at the URL shown in the "hint" above. VeriSign provided the expertise to make the WebTrust^SM online Seal difficult to forge.

Question 1.2
How do the logo assurance services of the BBB Online program at http://www.bbb.com and the TRUSTe DataTrust assurance services at http://www.TRUSTe.com differ? What comparative advantages do public accounting firms have vis-à-vis these two competitors who are not public accounting firms?
[Hint: See G.G. Gray and R. Debreceny, "The Electronic Frontier," Journal of Accountancy, May 1998, 32-38.]

The Better Business Bureau offers an online LogoTrust service that is somewhat unique. The BBB Online logo appears at registered company web sites. At those sites, the BBB Online Logo is hyperlinked to the BBB Online site which verifies that the link came from a legitimate site. This LogoTrust service is similar to WebTrust^SM services from VeriSign. However, VeriSign is better known in the digital signatures industry to date.

TRUSTe at http://www.TRUSTe.com is a DataTrust service aimed at protecting privacy rights and privacy agreements of companies and individuals that have shared information for an authorized purpose. For example, DataTrust is analogous to having an unlisted phone number. Telephone companies agree not to give out names, addresses, and phone numbers of persons who pay for unlisted numbers. In the case of listed phone numbers, however, telephone companies traditionally sell that data to anyone willing to pay the price for the data. Persons with listed phone numbers thereby find themselves deluged with telemarketers, junk mail solicitations, etc.

Unless web users have set their browser options not to accept cookies, companies build up information (e.g., names, addresses, phone numbers, product interests, browsing patterns, payment histories, etc.) that can be used and abused by companies such as DARE. For example, DARE may willingly or accidentally share cookie data (recipes?) with outsiders.

Definition of Cookies from Bob Jensen's Technology Glossary at http://www.trinity.edu/~rjensen/245glossf..htm :
Cookies= Applets that enable a web site to collect information about each user for later reference (as in finding cookies in the cookie jar). Web Browsers like Netscape Navigator set aside a small amount of space on the users hard drive to record detected preferences. Many times when you browse a web site, your browser checks to see if you have any pre-defined preferences (cookie) for that server if you do it sends the cookie to the server along with the request for a web page. Sometimes cookies are used to collect items of an order as the user places things in a shopping cart and has not yet submitted the full order. A cookie allows WWW customers to fill their orders (shopping carts) and then be billed based upon the cookie payment information. Cookies retain information about a users browsing patterns at a web site. A good place to find out more about cookies is at http://www.illuminatus.com/cookie.fcgi . Also see http://www.doubleclick.net/ and http://www.ipro.com/. Cookies perform storage on the client side that might otherwise have to be stored in a generic-state or database server on the server side. Cookies can be used to collect information for consumer profile databases. Browsers can be set to refuse cookies. Other ways of controlling cookies or deleting selected cookies can be obtained from http://www.privnet.com/ and http://www.wizvax.net/kevinmca/. Source of definition: http://www.trinity.edu/~rjensen/245glossf.htm#Cookies1

Under the WebTrust^SM program, accounting firms may offer DataTrust services similar to that of TRUSTe at http://www.TRUSTe.com. In fact TRUSTe uses PwC and KPMG Peat Marwick accounting firms to conduct surprise investigations of possible misuse of the TRUSTe logo by its clients.

Question 1.3
What are the risks to consider when providing LogoTrust assurance services to an online company?
[Hint: See G.G. Gray and R. Debreceny, "The Electronic Frontier," Journal of Accountancy, May 1998, 32-38.]

LogoTrust has less risk than DataTrust because it guards against fewer things that can go wrong. LogoTrust assures users that the logo is being used legitimately. There are, of course, potential lawsuits if damages ensue from its misuse. Restraints such as limits to the dollar amount of a transaction are not much protection since any person or company using a logo for fraudulent purposes may also change the transaction restraints.

Risks are somewhat reduced following legislation in the U.S. Congress regarding joint and several liability of CPAs. The risk of being the deep pocket defendant left to bear all of the damages in failures that are only partly attributable to CPA firm negligence has been greatly reduced. CPAs, however, are still subject to having to pay whatever share of the damages that courts attribute to those CPAs.

Apart from lawsuit risks, there are risks of bad publicity and tarnished reputation for failed assurances. CPAs have a competitive advantage at the moment because of public perception of CPAs as honest and diligent. Entering into more risky services such as information security assurances might tarnish both the reputation of a particular CPA firm and the CPA profession in general.

Question 1.4
What are the risks to consider when providing DataTrust assurance services regarding confidentiality?
[Hint: Cookies are explained at http://www.trinity.edu/~rjensen/245glosf.htm#Cookies1 ]

WebTrust assurances cover a broader range of electronic commerce transactions in addition to logo assurances. WebTrust can cover business practices and internal control. It requires more testing and professional competence in electronic commerce. Whereas some logo assurance services like TRUSTe require only after-the-fact self reporting, WebTrust service providers require client recertification every 90 days.

The AICPA's Assurance Services Website is at http://www.aicpa.org/assurance/index.htm 

Return to Starting Page

August 8, 2002 message from Miklos

I have posted on the Web pieces of my e-commerce course about hr + of clips,, .... be my guest to use them

http://raw.rutgers.edu/miklos/baxtermovies/baxter.html

they can be used (not tightly coupled) with my e-commerce slides

http://raw.rutgers.edu/ecommerce2

Miklos A. Vasarhelyi
KPMG Professor of AIS
Rutgers University Director, Rutgers Accounting Research Center
315 Ackerson Hall, 180 University Ave. Newark, NJ 07102
tel: 973-353 5002 fax 973-353 1283 miklosv@andromeda.rutgers.edu

Large CPA Firm Revenues and Services

Auditing Firm Revenues and Services (I think the data are suspect in this article) ---
http://www.usubscribe.com/order.cfm?tid=12560&gtse=goog&GTKW=Accounting+Today

August 26, 2005 message from Jim Borden

I was wondering if anyone might be able to help me respond to the following question I received from a student:

"I had a quick question concerning Chapter 1. The text states that consulting is the area of highest growth for public accounting firms. Isn't that misleading considering that most firms gave up their consulting business to conform with SOX?"

I was trying to look for some up to date stats on what percentage of the Big 4's revenues are audit versus non-audit, and how that percentage has changed over the past 2-3 years. Any suggestions? Thanks,

Jim Borden
Villanova University

August 26, 2005 reply from Bob Jensen

Hi Jim,

I’m not a whole lot of help on this, and I would appreciate it if you would let me know what you find out.  You might put this one out to the AECM.

I currently do not have great free sources of this information.  It is likely to be available to subscribers at http://www.auditanalytics.com/

PwC has a helpful table at http://www.pwc.com/extweb/aboutus.nsf/docid/8f6f5cb458a82d4c85256f350064cd9d
I suspect PwC will share prior-year tables with you.

Aggregated Revenues of PricewaterhouseCoopers Firms by Service Line Service Line At FY04 exchange rates (USD Millions) FY04 FY03 % Change % Change Assurance 8,713 7,433 17.2% 9.6% Advisory 3.077 2,709 13.6% 6.3% Tax 4.464 4,197 6.4% -0.2% Net Revenue from Continuing Professional Services 16,254 14,339 13.4% 6.1% Expenses Billed to Clients 1,317 1,137 15.8% 6.3% Gross Revenue from Continuing Operations 17,571 15,476 13.5% 6.1% Discontinued Operations 29 344 -91.5% -92.3% Total Gross Revenues 17,600 15,820 11.3% 3.9% FY04 revenues are expressed in US dollars at average FY04 exchange rates. FY03 revenues are shown as originally reported last year at average FY03 exchange rates. Fiscal year ends 30 June. FY03 Service Line revenues have been reclassified to reflect the new Service Line structure, which came into effect in 2004. Tax figures include correspondent law firms where regulations permit. Discontinued operations represent businesses disposed of during the year, principally affecting Tax services revenues of firms in Europe.

 

Whereas E&Y and PwC sold their consulting divisions to Cap Gemini and IBM respectively, KPMG went public with KPMG Consulting in an IPO.  The company's symbol is KCIN on NASDAQ.  It experienced huge cash flow difficulties in 2001 following the IPO --- http://www.businessweek.com/magazine/content/01_21/b3733096.htm 
  You can get current information in KCIN at http://biz.yahoo.com/ipo/p/kcin.html

As of February 8, 2001, KPMG Consulting, Inc. is an independent consulting company and no longer affiliated with KPMG LLP.  Hence, KPMG's subsequent non-tax advisory services exclude consulting revenues of KCIN. 

You can download KPMG’s 2004 Annual Report from http://www.us.kpmg.com/microsite/attachments/IAR_04.pdf
On Page 43 of that report, I'm a bit surprised that audit revenues in 2004 slipped to only 48% of total revenue whereas non-tax advisory services hit 29% of the $13.44 billion in revenue after selling off its consulting division.

Similarly, KPMG reported its 2003 non-tax advisory revenues as 27% of its $$11.16 billion in total revenues.  The Accounting Today article reports zero KPMG consulting revenues such that I find it hard to reconcile the 27% versus 0%.  Since the Accounting Today article reports KPMG's revenue as 67% for audit and 33% from tax