Archive for October, 2010

Curing the Big Four Bias

Imagine, for a moment, that you are sick and require a major operation.  Among the many thoughts that would immediately cross your mind would be the need to find “the best” doctor available.  What criteria would you use when selecting the best doctor?  I bet that the following attributes would weigh heavily in your decision:

  • Experience – You want someone that has been around the block with your disease.  You can’t afford to be the training ground for a new doctor that has never actually performed this type of operation.
  • Expertise – A general practitioner could technically perform the operation, but you demand someone that has the specialized credentials for your illness.
  • Cost – Not as important as the other decision points, but clearly you do not want to be wasteful in obtaining your treatment.

You see, when it comes to virtually any professional services, it logically boils down to experience, expertise and cost.  Selecting a builder for your dream home?  First time builders probably won’t be on your short list.  Interviewing an attorney to represent you in a major legal dispute?  A recent college graduate charging $1,000 would be unacceptable.

What if you were choosing a CPA firm to perform your SAS 70 audit?   You would want a project team comprised of certified experts with significant audit experience and deep references, right?  Well, that depends on your company.  Unfortunately, many companies use “Big 4” firms for such services simply because they are “Big 4” firms.  While these same decision makers would not allow a doctor to perform their brain surgery simply because they work at a well-known hospital, they make decisions about their audit firm based primarily on the size of the entity.  In other words, certain companies make the Big Four firms their default “short list” of vendors.  Such an approach short fuses the importance of experience, expertise and cost that would normally be associated with such decisions.

This “Big Four Bias”, as Jeremy Newman, chief executive of BDO, describes it is causing growing concern around the world.  In October, the New York Times published an article highlighting increasing concern within the European Union over the market dominance of the “Big Four” global accounting firms.  It reported that 70% percent of all European audits are performed by these firms, with 99 percent of Britain’s FTSE 100 companies using them.  A European Commission even studied this problem and concluded, in short, that Europe needs more diversity and competition and that legislation compelling the use of other accounting firms may be prudent.

Personally, I am not an advocate for using legislation to influence the selection of professional services providers.  However, I am a relentless supporter of using common sense when selecting a vendor, no matter what the service.  As it relates to the accounting industry, requiring firms to provide the following basic information about each of their proposed project team members would go a long way to removing much of the puffery that can pervade the proposal process:

  • Years of professional experience – Does the vendor intend to assigned seasoned professionals or inexperienced personnel to your project?
  • Years employed by the vendor – How familiar are the project team members with the vendor and its methodology?
  • Professional certifications – Do the team members have the credentials to support claims about their expertise (e.g., CPA, CISSP, CISA, and CIA certifications, among others)?
  • Previously Completed Projects – Does the vendor intend to assign personnel with significant experience, or more junior staff with little or no relevant experience?
  • References – Can the vendor produce relevant references for each proposed project team member?
  • Level of involvement – How much time do the vendor’s personnel intend to spend working on your project, especially performing on-site procedures?
  • Hourly rate – Is the cost for the person reasonable given their experience and expertise?

I hope that you pick the best provider for your needs, whether it’s a Big Four global provider or a local CPA firm.  For some companies, that will mean reevaluating a bias for the Big Four firms.  Many Fortune 1000 and publicly traded companies that previously had such a bias used the approach above and selected SAS 70 Solutions.  These companies put the focus on the project team rather than the size of the entity, and for them, it made all the difference.

For those that are considering such a decision, check out this tool.  Consider sending it to all of your potential vendors and requesting that the data be provided in this standard format.  In my opinion, there is no better way to get comparable about the team of people that will actually provide the professional services.

SocialTwist Tell-a-Friend

“Materiality Loses Relevance in SSAE 16″ – WebCPA

WebCPA has just published an article by Chris Schellman, President and Shareholder of SAS 70 Solutions.

The article, titled “Materiality Losses Relevance in SSAE 16″ covers an important yet not widely discussed nuance in the new SSAE 16 standard.

Click here to view the article.

As always, visit our SSAE 16 Resource Center for the latest information on the standard.

SocialTwist Tell-a-Friend

SAS 70 Solutions to Present on SAS 70 to SSAE 16 Transition Webinar

Please join  SAS 70 Solutions Founder, Chris Schellman, and other industry leaders for a presentation about the new SSAE16 standard that will replace the SAS 70 standard in 2011. This hour LIVE webcast will review the fundamentals of SSAE 16 and explore the similarities and difference between the new standard and old standard.

The use of alternative international and domestic reporting standards, such as ISAE 3402, AT 101, and SysTrust, will be addressed. The webcast will also include a discussion of the activities service organizations new to perform as they prepare to transition to the new standard. The webcast will conclude with a Q&A session.

Attendees are invited to utilized a SAS 70 Solutions only rate.  Please click here for more information and registration details.

SocialTwist Tell-a-Friend

SAS 70 Solutions to Speak at the RSA Europe Conference This Week

Doug Barbin, PCI-QSA and director of assurance and compliance solutions at SAS 70 Solutions, will be presenting at the RSA Security Conference in London on October 12th.  The session, titled “Comprehensive Perspective of Virtualization Security and Compliance” is a panel discussion with other experts including the CTO of HyTrust, Sr. Director from CA, Chief Governance Officer for EMC, and the former Sr. Solutions Architect for Visa Europe.

For more information about the conference, click here.  A detailed agenda including this session (STAR-104 ) can be found here.

SocialTwist Tell-a-Friend

SAS 70 Solutions Quoted in CSO Magazine Online

Chris Schellman, President and Shareholder at SAS 70 Solutions, was quoted in Bill Brenner’s article in CSO Magazine.

The article, “Replacing SAS 70,” which can be found at http://www.csoonline.com/article/622277/sas-70-replacement- provides a review of how the SAS 70 audit standard has helped organizations as well as the challenges it has faced.

The SAS 70 audit standard is currently transitioning to Statement on Standards for Attestation Engagements (SSAE) 16 which will replace SAS 70 in June of 2011.

SocialTwist Tell-a-Friend

Attestation Beyond SAS 70

My colleague recently blogged about the challenges facing service providers when responding to requests for their SAS 70 audit report or “certification.” This request is too often based on a procurement agent’s mistaken assumption that SAS 70 audits are a “one-size-fits-all” way to fulfill due diligence requirements when contracting with technology service providers. This misguided approach is a source of frustration for service providers and CPA firms that provide attestation and review services to technology companies. The requests for a SAS 70 report, commonly surfacing in RFPs, have grown far beyond the limited scope and purpose for which the reports were intended.

Since SAS 70 will soon be replaced by SSAE 16 and ISAE 3402, it’s a good time to review why a third party service provider and their customer might request an attestation report and how to decide which type of report is appropriate.

The AICPA recently issued FAQs with direction to service providers, their customers and, most importantly, the auditors, on alternatives now available to provide reporting that meets both internal management needs and the reporting needs of users and prospective users. Within the FAQs, the AICPA makes it clear that SSAE 16 or Reporting on Controls at a Service Organization, is an attestation standard for services which impact the financial reporting controls of user organizations.

That said, the AICPA recognizes that a service organization’s services affect not only financial statement risks but also the operational and compliance related risks of their users. Examples may include:

  • A service organization management may engage a CPA to report on the effectiveness of its controls over privacy utilized Generally Accepted Privacy Principles (GAPP).
  • An entity may be required to demonstrate its compliance with a specific regulation, such as the DEA’s regulations for “Electronic Prescriptions of Controlled Substances.”
  • A service provider may wish to show adherence to and alignment with industry standards such as the framework developed by the Cloud Security Alliance

CPA firms are armed with a broad set of alternatives for responding to such needs. They are contained in the AICPA’s Codification of Statements on Standards for Attestation Engagements. Within these standards, AT Section 101 – “Attest Engagement” sets forth the framework under which all attestation engagements must operate. The following types of attestation engagements that should be considered when reporting on non-ICFR (internal controls over financial reporting) topics:

The AICPA’s SysTrust and WebTrust are two of the better known examples of attestation engagements developed in accordance with AT Section 101. SysTrust is a family of assurance services that are applied to various aspects of a B2B systems, while WebTrust is a family of assurance services that are applied to e-commerce based systems. Both result in attestations and seals that may be displayed on a client’s website following a successfully completed assessment.

AT Section 201 – Agreed Upon Procedures Engagements – This type of engagement is performed when a client and one or more third parties want a CPA firm to independently evaluate a topic and issue a report of finding based on specific procedures performed by the CPA firm. The procedures to be performed by the CPA firm are typically agreed to in advance. The resulting report describes these procedures and the results of those procedures. A client might use an agreed upon procedures engagement when a specific end customer wants evidence regarding an instance of an application hosted only for that customer.

AT Section 601 – Compliance Attestation – This type of engagement provides third party attestation regarding an entity’s compliance with requirements of specified laws, regulations, rules, contracts, or grants; and/or, the effectiveness of an entity’s internal control over compliance with the specified requirements. This may include the DEA regulations stated above but could also apply to the recent amendment to SEC Rule 206(4)-2 of the Investment Advisers Act of 1940, which refers to custody over client assets by a registered investment advisor.

When all else fails, AT Section 101 serves as the “catch all” assessment for topics that aren’t candidates for a service audit or any of the examinations described above. Through AT Section 101, an organization can obtain an assessment that is very similar in form and function to an SSAE 16 assessment, but for non-ICFR topics. That makes it a great mechanism for performing assessments of technology topics, including cloud computing and virtualized environments.

The AICPA is planning to publish a guide titled, Reporting on Controls at a Service Provider Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy, that addresses reporting on a service provider’s controls over subject matter other than financial reporting. This guide is expected to be available by early 2011 and is to reference work being done by the Cloud Security Alliance other related groups.

Most importantly, I strongly advise all service organizations to work collaboratively with their customers. In the end, all attestations for the service providers emanate from the audit and compliance needs of their customers!

SocialTwist Tell-a-Friend