June 2000

AICPA Modifies WebTrust to Respond to Marketplace

Introduces Modules, Redesigns Seal, Launches SysTrust

The AICPA has modified the WebTrust^SM program, its assurance service for Internet sites, to include a repackaging of services, a redesigned seal, and other changes to respond to the marketplace, according to Anthony Pugliese, director of the AICPA assurance services team. In addition, the Institute has launched a new, related SysTrust^SM program that allows CPAs to issue reports on whether management maintained effective system controls for their Internet sites.

At a recent meeting of the NYSSCPA Auditing Standards and Procedures Committee, Pugliese and Ronald Halse, AICPA marketing manager, reported that 30 websites have received registered WebTrust seals since the AICPA launched the service jointly with the Canadian Institute of Chartered Accountants in September 1997. These include organizations such as Etrade, Bell Telephone of Canada, HD Vest, the AICPA, three state CPA societies, and the Puerto Rico Society of CPAs. While in terms of the number of seals issued WebTrust does not yet figure prominently in the Internet marketplace, Pugliese and Halse said that the AICPA remains committed to the program.

The AICPA will break the WebTrust service into a menu of modules--it has proposed seven: privacy, availability, nonrepudiation, customized disclosures, business practices and transaction integrity, and confidentiality--from which enterprises can pick and choose to apply to their specific websites. The AICPA said that dividing the service into modules would make WebTrust more cost-effective to those who do not need to provide assurance in every area. For example, if security is a concern, a CPA firm can perform just the WebTrust security module and design the appropriate report.

The seal redesign will allow CPA firms to display their names and will also stress the seal's international presence. Halse said that market research indicated that some companies saw value in having the name of their audit firm associated with the seal. He and Pugliese reported on the success in getting national accounting institutes around the globe to participate in WebTrust: Institutes in the United Kingdom, Ireland, Australia, New Zealand, and France have joined the program, and the AICPA is negotiating contracts with institutes in a number of other countries.

Pugliese stressed the potential of using WebTrust services as an entrée to performing other technology consulting services. He said companies may want the seal, but may not have adequate policies and procedures in place to permit the CPA to provide the service.

"The idea is to use WebTrust as the framework for assisting companies to develop good website practices," Pugliese said.

Pugliese and Halse pointed out the potential benefit to CPAs of offering WebTrust services at the business-to-business level, and they said that as this market continues to grow, businesses will want assurances about the practices of their suppliers and customers, primarily in the security and privacy areas.

"WebTrust is the only seal that requires a comprehensive examination of practices," Pugliese said. "There is a place in the market for this level of service."

SysTrust Now Available

Pugliese and Halse also discussed SysTrust, a new assurance service the AICPA introduced last December which provides a structure and methodology for CPAs to issue reports on whether management maintained effective controls over a system to enable it to function reliably. AICPA/CICA SysTrust^SM Principles and Criteria for Systems Reliability, the engagement guidelines, and other information are available at www.aicpa.org.

Halse said that as real-time information becomes the basis for investment and business decisions, users will want to know that the system developing the information is functioning reliably; SysTrust is designed to satisfy that market need.

"E-commerce is the future," committee Chair Vincent Love said. "The profession must position itself to facilitate the reliable and secure transmission of data, just as it is doing for the reliability of financial data in support of a fluid capital market. WebTrust has a way to go to fill the market's needs. It is in our best interest to improve WebTrust, and this seems to be a step in the right direction." *