Many of your current or prospective clients may need to expand into e-commerce to ensure continued growth and profitability. But e-commerce also introduces vulnerability and the need to protect data that must remain private. CPA firms can help their clients assess and acquire privacy protection. The following article discusses the services that can be provided by firms and why firms should offer them. Finally, this article considers the cost to firms of entering into providing privacy protection, and the probable amounts of billable time arising from providing these services. Resources to support these services are also provided.

In a joint effort, the AICPA and the CICA (Canadian Institute of Chartered Accountants) recently published Generally Accepted Privacy Principles (GAPP)—A Global Privacy Framework (the Framework). Originally published in 2003, the Framework is regularly updated to address marketplace trends such as outsourcing and the growing international focus on privacy. The Framework also includes a new section that provides step-by-step guidance on how businesses and other entities can use the document.

Practitioners will want to pay special attention to a second document, Building a Privacy Practice In Small and Medium-Sized CPA Firms, published to accompany GAPP and written for firms to help them provide privacy services to their clients. Although GAPP is intended primarily for medium and large firms, Building a Privacy Practice is designed for firms with 10 or fewer professionals/staff. In fact, Building a Privacy Practice in Small and Medium-Sized CPA Firms was written by the small firm members of the AICPA/CICA Privacy Task Force. Practitioners can help their business clients address privacy issues by offering a full range of value-added privacy advisory services, including:

• Developing a privacy strategic and business plan
• Providing a privacy gap and risk analysis
• Providing privacy advice, recommendations, and training
• Designing privacy policies and procedures
• Benchmarking and performance measurement
• Providing independent verification of privacy controls

Three reasons to offer privacy services
There are three main reasons for firms to consider offering privacy services:

1. The role of firms is changing—It’s time for firms to distinguish themselves. Competitors are chipping away at the services typically offered by CPAs. Clients are turning to financial planners, financial analysts, financial consultants, lawyers, insurance advisers, and real estate professionals for the advice that is also provided by CPAs.

Current and future clients recognize that taking advantage of the opportunities for business growth, cost savings, and operational efficiencies may require expanding into e-commerce. In addition, recurrent data security breaches, some global in scope, have triggered consumer demands for better protection of their personal information.

By offering forward-looking/proactive risk management services, firms can help clients avoid these dangers.

2. Firm practice is changing—It’s time to think ahead. Practices of all sizes, especially small firms, find it increasingly difficult to attract and retain well-trained, experienced, motivated, innovative professionals—in other words, true leaders—who will actively help build the practice.

3. Firm services are changing—It’s time to expand beyond the “commodity box.” With the goal of securing more profitable work, practices often compete on price for time-intensive, unprofitable work. By competing on price, are firms sending the message that their services are easily replaced commodities? New services, such as privacy advisory services, enable CPAs to stretch beyond the commodity box with work that can be priced to reflect that CPAs bring unique skills, technical competence, refined judgment, and valuable discipline to address the business challenges faced by clients.

What is this going to cost?
As with any new service offering, the greatest share of costs is at startup and involves learning how to adapt current skills and apply new ones.

To start out initially, you must become familiar with all the privacy resources available through the AICPA Web site (staging.aicpa.org/privacy) and the reference material listed in the sidebar, “Publications, Tools, and Practice Aids,” on this page. Most of these documents are available for free or at a minimal cost.

The cost to firms of developing and maintaining these skills will depend on the privacy needs of clients’ businesses and the variety of services offered. For example, if your firm has a number of clients in the medical industry, you may decide to become a specialist on Health Insurance Portability and Accountability Act (HIPAA) requirements and how they affect your clients.

Other than the time required to research the privacy resources, costs for the materials to offer privacy advisory services should be less than $500.

How much billable time can you expect?
Initially, you will find that your clients may not recognize the value or the cost/benefit of these services to them. It may be difficult to illustrate the value of these services by drawing parallels to other services; much of the research for privacy protection is carried out to assess customers’ preferences and the potential losses that can be avoided by averting a breach of privacy.

However, CPAs have always maintained positive relationships with their clients by demonstrating their capabilities as they relate to services and industries. For example, clients in the medical or financial industries who are affected by privacy legislation may need help in ensuring the compliance of their privacy programs with all pertinent regulations. For clients in other industries, CPA firms can help ensure that adequate privacy programs are in place to protect the personal information of both customers and employees.

Broaching the privacy issue
The initial approach should be to offer a presentation on why privacy is important to the clients’ businesses. This may not result in immediate billable hours, but, along with raising awareness, gives you an opportunity to demonstrate your knowledge and interest in assisting your clients in this area.

As a result, you may spend some time convincing your client to let you do a privacy assessment. You should understand that an initial privacy assessment may only be a two- to three-hour engagement for a small client with a potential fee of approximately $500 to $750. However, this initial assessment provides a great opportunity to recommend the additional privacy services your client may need.

Privacy—A service for the small firm
Still not convinced? Then consider that the market for privacy services is red hot. Small firms should examine how they cross-sell services and create a plan to add privacy services to their mix. Perhaps now more than at any other time, there is an opportunity to demonstrate your acumen and ability to provide assistance by helping a client understand and implement privacy protection. GAPP is a good start, and, along with Building a Privacy Practice in Small and Medium-Sized CPA Firms, can help interested firms get a leg-up on their competition by pursuing this in-demand service.