·         The Privacy Service will encompass the protection of personal information, in any format, as it being collected, processed, used, and maintained. Thus, it provides guidance in the protection of all forms of electronically and paper-based data collection, storage, and use.

·         The Privacy Service will include the protection of employee data in addition to customer data.

·         The Privacy Service provides guidance on data retention and data destruction policies.

·         Damage to the organization's reputation and business relationships

·         Legal liability and industry sanctions

·         Charges of deceptive business practices

·         Customer and employee distrust

·         Denial of consent to use personal information for business purposes

·         Lost business and consequential reduction in profits and market share

Assurance practitioners can provide a number of value-added services, for example:

·         Developing a privacy philosophy and strategy

·         Providing privacy advice and training

·         Preparing and reviewing privacy policies

·         Assessing and managing privacy risk

·         Facilitating the development and implementation of privacy compliance programs, such as the existing WebTrust Seal of Assurance, to help protect online privacy

·         Providing assurance on the effectiveness of privacy control systems

·         Maintenance of security procedures to protect personal data;
  

·         Release of personal data not made to third parties without consumer consent;

·         Collection and sharing of personal information in conformance with the company's privacy policy; and

·         Maintenance of internal controls to limit access to personal information to authorized users.

By definition, independent verification requires that each of these actions must be verified against a set of standards for performance. The CPA profession is the only one that uses a set of standards for the examination and reporting on controls, ethical standards for the conduct of the work, and requirements for independence in appearance and fact from the entity for which they issue the report. These examination standards are expanding to include specific criteria for practitioners to evaluate new trust issues, such as privacy.

Back to top

How long have CPA firms been doing privacy examinations?

It varies among firms. Privacy has been a trust issue on which CPAs have been advising clients for many years. CPAs have been contributing to the privacy debate, standards organizations, and thought leadership since its inception. It is a natural fit for CPAs to provide advice to clients about their internal controls and data protection. Personally identifiable information is just another data set with which CPAs have worked to help clients manage and control more effectively.

Back to top

Why are CPAs performing privacy examinations? What are the benefits to businesses? What are the benefits to consumers?

CPAs are in the business of helping build trust-around financial statements, and now issues like privacy-and this is a natural evolution of the services they provide to clients. In the normal course of financial statement audits, CPAs examine the controls over the processing and protection of financial data. CPAs have developed the skills necessary to evaluate these information management processes. Clients are asking CPAs to examine other data management processes such as those supporting privacy policies.

Benefits to businesses are that they can establish trust with consumers, build their brand, and manage risks associated with privacy.

Benefits to consumers are that they have increased confidence and trust in a company that has had its privacy practices independently verified.

Back to top

Are privacy examinations part of a CPA's responsibility to a client or employer? Are they qualified to perform them?

The examination of privacy policies is not typically included in the examination of financial statements. In the normal course of the financial statement audit, CPAs often examine the controls over the processing and protection of financial data. CPAs have developed the skills necessary to effectively examine these information management processes. Organizations are asking CPAs to examine other data management processes such as those supporting privacy policies.

Back to top

Why is it better for a CPA firm to examine a company's privacy practices than for the company to self-declare that it complies with its privacy policies?

One of the key issues for consumers is that they do not trust a company's stated privacy practices. They are concerned about privacy breaches or inappropriate use of personal information and are skeptical that organizations are upholding their processes. It is important for a company to make declarations of its practices to its consumers, but the consumer trust issue is not fully addressed until the company can get the customer to believe it is following the process.

A CPA firm can provide assurance through independent verification that a company complies with acceptable privacy standards and does what it says it does with private information.

Back to top

Can't laws or regulations get companies to comply with their privacy policies? Isn't this sufficient for consumers to trust the company?

A recent study conducted by Harris Interactive for Privacy and American Business and sponsored by the AICPA and Ernst and Young has shown that existing efforts by companies have not done enough in alleviating the public's privacy concerns, including their compliance with privacy laws or regulations. Consumers indicated that they are most trusting of companies that have also undergone independent verification of their privacy practices.

Laws to date have not been effective in building trust and confidence among consumers, and the survey reinforces this point. Leading companies and those seeking to be winners in the economic recovery are taking a proactive, robust, and holistic approach to privacy. Leaders treat the personally identifiable information collected from consumers and employees as a strategic asset.

Forward-thinking companies invest in and maintain the processes for this data's collection, protection, and destruction as critical infrastructure processes. Leaders are active in their communication of their privacy policies and practices and are focused on communicating their trustworthiness to their stakeholders as a matter of brand image and demonstrated leadership.

Leading companies develop privacy policies that reflect their corporate philosophies, business models, and the needs of their target market. They understand what kinds of information they are collecting, how they use such information, how they share it, and whether they really need it. They benchmark these policies not only against industry-specific laws but also against accepted fair information principles and any self-regulation programs that the company has pledged to meet. Leaders design their policies and practices to attract and retain consumers, not just to meet minimum compliance requirements. Laws will continue to change to try to address the greatest concerns of the public. Leading organizations do not wait for the issues that prevent the active participation of their consumers to get to the point of requiring regulated responses.

Back to top