Something (else) To Lose Sleep Over:
Going Paperless, Is your Client's Data Secure?
by Tom C. Davis, CPA (July 20, 2004) 

CPA firms all over the country are rapidly moving to a paperless environment. There is a tremendous amount of interest in software, hardware, and work processes that will move firms to a fully-digital environment.  The advantages are huge:  faster access to information, the ability to more effectively “re-use” work on similar engagements, better work processes, and reduction in storage and retrieval costs.  The benefits list goes on and on and it translates into better client service, lower costs, and higher firm profits. 

Whenever a firm implements something new, the impact of the tools will fall into two categories: efficiency benefits and effectiveness benefits.  Efficiency benefits are the easiest ones to achieve since the involve performing tasks the firm has already been doing, in less time.  The outcome, product, format, etc. is already known.  The only thing new is using new software, hardware, and processes to do it faster. 

Effectiveness benefits are much harder to anticipate and achieve.  These relate to doing something new that the firm has never been able to do.  Here the ‘something” is usually not completely defined and costs ands benefits much harder to project.  Examples would be the benefits many firms hoped to obtain by selling technology services to their clients or being able to control audit engagements using on-demand budget information tools.  Results of these efforts are rarely what firms have expected.

There is a similarity between benefits and “dangers” of new technologies.  The chance of stumbling when you are improving efficiencies is really pretty slim.  Since the outcome and components are typically known, they typically do not (completely) surprise us.   However, when we do not have experience in some areas, or when familiar processes radically change, it is much harder to plan and implement the new.

So how does this all relate to a move to paperless?  Well, so far, the focus has been on planning the paperless environment and getting team members the skills they need to operate in this environment.  Most firm leaders feel the biggest dangers are in not adequately planning the digital environment and not being able to get all firm members to fully use the new tools.  However, there are a couple of other areas that firms need to consider that are not so easy identified and dealt with.

Faster Means Less Control
One of the biggest benefits of moving to a digital environment is ability to communicate with others much faster.  Email communications, central access of information on the firm’s server, and other similar capabilities have certainly increased the velocity of information.  As firm members become more skilled with these digital information tools, communication speeds will increase even more.

This is not all good news.  One of the most bothersome aspects of easy communications is that much more is being communicated with less and less review and permanent retention.  In a paper environment, the slower velocity of information made it easier to get consistent review and storage of data.  Firms should be very concerned about the amount of professional advice that is being given without the benefit of adequate review and approvals.

Another issue is the lack of structure for organizing digital documents and communications to make it easy or even possible to access at some later date.  Most firms have no idea how much important information is contained in the each firm member’s email box.  Typically it is almost impossible for other team members to access this information.  If the emails get deleted or the person is not available or leaves the firm, all this information is lost.

One way to overcome this is to invest in paperless solutions that have features that automate the processes or provide a reviewable trail.  Workpaper applications such as CCH Engagement, Creative Solutions Engagement Solutions, Caseware Working Papers, and PPC’s Electronic Engagement Manager have feature that will standardize workpaper storage and control and document the flow of workpapers into and out of the application.

Another type of tool just beginning to be adopted by accounting firms is document management software.  These tools such as GoFileRoom, Domino Doc, Worldox,  Document Locator, and others, have features that can control the organization and distribution of any type of electronic document or file.

Oops, Wrong Number
The convenience of electronic communications and using electronic documents works as well for our clients as it does for us.  Firms are sending out a huge amount of information electronically and clients and others are sending it to us as well.

So how can this possibly be a problem?  How do you know the communication was sent to the right address?  Did someone else besides the person the communication was intended for read it?

Many partners don’t feel that this is a problem worth addressing.  There are almost no horror stories involving accounting firms in this area.  However, on reflection, I would not expect to see a firm or practitioner voluntarily come forward and talk about occurrences of this type of mistake.

Digital security could become the next big issue of cyber law, especially as more CPA’s and accounting firms adopt technologies that enable a paperless office.  It is estimated that identity theft and corporate espionage costs US businesses and consumers over $50B annually.  Additionally, consumer privacy groups continue to push for additional government regulations including GLB, HIPAA, and the CA Breach Disclosure Act to protect an individual’s right to privacy.

Accounting firms must protect their clients’ information that is deemed confidential or proprietary from data loss, theft, or misuse.  Valuable information may include financial statements, audit reports, tax returns, company valuations, merger and acquisition data, and customer information.  As more firms communicate with clients via electronic means, this information becomes more at risk.

Protective measures should include implementing technical solutions as well as establishing clear corporate policies.  Many firms have implemented standard technical solutions such as a network firewall, anti-virus software, and a secure VPN.  However, few firms have taken the additional corrective action to encrypt confidential documents.

One solution our firm has been experimenting with is SmartSoftKey’s Advanced Media Protection (AMP) solution (www.smartsoftkey.com).  AMP provides document encryption so only the intended reader may open the document – regardless of whether they are emailed externally or stored on a network server.  This type of security is easy to implement and reasonably priced. 

Conclusion
With any new process or technology, there will be opportunities for substantial gain and substantial pain.  The digital environment is no exception.  However, making an effort to identify the pitfalls and the emerging tools for avoiding them is not hard to do and will make digital life much more pleasant.

Tom Davis CPA is owner of TC Davis CPA and president of Knowledge Concepts, Inc., the developers of the FirmWorks practice information application.  Contact him at tdavis@knowledge.org and at 888.832.4823.

<Back to Home Page    ^Back to Vision Alert Index

 © 2004 InfoTech Partners North America, Inc....your technology partner  (480) 706-1728