| Home · Online Publications · Journal of Accountancy · Online Issues · May 1998 · New Assurance Services | |
| | |
| NEW ASSURANCE SERVICES |
| By Glen L. Gray and Roger Debreceny |
Glen L. Gray, CPA, PhD, is a professor of accounting and MIS at the College of Business Administration and Economics, California State University, Northridge. He, with Karl Nagel, CPA, is currently writing the Guide to Electronic Commerce Assurance Services for Harcourt Brace Professional Publishing. URL: www.csun.edu/~vcact00f/; e-mail: glen.gray@csun.edu. Roger Debreceny, FCPA, is professor of accounting in the Nanyang Business School at Nanyang Technological University, Singapore. URL: www.ntu.edu.sg/home/adebreceny/; e-mail: rogerd@netbox.com
| EXECUTIVE SUMMARY |
|
B efore jumping into WebTrust, CPAs should understand not only the problems with consumer online commerce that give rise to programs such as WebTrust, but also the Web logo services from non-CPA competitors. Although electronic commerce offers CPAs a chance to build on their experience, reputation and training, they need to understand some background before they proceed. No one article, or even one book, can explain everything CPAs need to know about online commerce, but this article explores several key areas in the current e-commerce landscape.
LEARN TO TRUST| Exhibit 1: BBBOnline Criteria |
|
Although e-commerce is exploding, both buyers and sellers voice concerns about conducting business on the Internet. Many customers and business owners still distrust the process of e-commerce. They also may have a number of concerns about their potential trading partners—trading partners that they may never have dealt with previously or even communicated with other than by the Web or e-mail. Indeed, research published earlier this year by CommerceNet (www.commerce.net), a not-for-profit industry association that promotes e-commerce, confirms that a lack of trust is one of the top issues identified by market participants as preventing e-commerce from growing as fast as it otherwise could. While e-commerce is increasing, trust concerns, too, have actually risen over the last year, suggesting that this problem will not decline merely as people become more familiar with doing business on the Internet.
Customers are wary because many questions remain unanswered about online stores, such as the following:
CPAs, by virtue of education and experience, are in an excellent position to provide assurance to consumers on these questions and thus remove some of the obstacles hindering further growth of Internet commerce.
LOGO ASSURANCE SERVICES| Exhibit 2: TRUSTe Logos and Meanings |
|
Such services are becoming increasingly common. Some services address fairly narrow issues. For example, in response to widespread public concern about the security of credit card information on the Internet, MasterCard and Visa collaborated on a joint venture called Secure Electronic Transactions (SET). Electronic vendors that meet SET standards for sending credit card information over the Internet can display the logo shown at right. (See www.visa.com for more on SET.)
In a similar vein, the network authentication and digital certificate company VeriSign Inc. (www.verisign.com) introduced the VeriSign Authentic Site logo (above) to assure users that a Web site is capable of transmitting and receiving secure (encrypted) information and that the site and company are real. While the SET and VeriSign logo services address highly specific issues of trust-building, CPA WebTrust addresses a much wider set of issues. The WebTrust logo (see page 38) assures that the seller has met the established WebTrust criteria, which have three major sections: business practices, transaction integrity and information protection. (A one-day seminar for CPAs on WebTrust explains these criteria in detail. For more on CPA WebTrust, see the sidebar on page 38 and "In CPAs We Trust," JofA, Dec.97, page 62.) The CPA's goal is to determine whether a seller meets the WebTrust criteria and can use the WebTrust logo, thereby providing valuable information to buyers while helping sellers gain a competitive edge in an increasingly crowded marketplace.
Potential rivals to CPA WebTrust include
WebTrust differs from these other logo services in important ways. First, the WebTrust criteria include a broad variety of e-commerce criteria, well beyond those addressed by BBBOnLine or TRUSTe. Although ICSA goes deeper into technology criteria, in addition to some technology criteria, WebTrust addresses business practices and internal control criteria. For example, WebTrust requires numerous performance disclosures on the Web site such as delivery times, how returns are handled and a phone number for customer services. The WebTrust criteria include specific technology and internal control disclosures relating to processing orders and protecting customer information. In addition to its broad coverage, probably the most significant difference is that CPAs fully pretest—under well-established attestation standards—all the seller's assertions regarding the WebTrust criteria before issuing the logo. BBBOnLine and TRUSTe, in particular, primarily rely on self-reporting and some after-the-fact testing. Finally, recognizing the rapidly changing Internet and e-commerce environments, WebTrust requires that sellers be recertified at least every 90 days. Thus, although CPA WebTrust faces some competition as an assurance service, it has important advantages that should render it attractive to e-commerce participants.
MARKET NICHES FOR ASSURANCE SERVICESThe seller may be a new enterprise that exists only on the Web, such as Amazon.com (www.amazon.com), or an established company opening an electronic store, such as Barnes & Noble. Buyers may be individuals or organizations. Individuals are generally more spontaneous. Business buyers are likely to be more analytical and systematic in their purchasing decisions. Business buyers usually work with signed contracts, purchase orders and a bidding process. They also have access to third-party sources of information, such as Dun & Bradstreet, that retail consumers generally don't consult.
| Exhibit 3: Types of E-commerce Transactions | ||||||||||||||||||||||
| ||||||||||||||||||||||
Perhaps the most obvious market for logo assurance services is in cell I. Unlike traditional businesses, new, Web-based sellers do not have established reputations. Retail consumers might be reluctant to enter into e-commerce transactions with sellers they're unfamiliar with. Individual consumers are generally less likely to locate formal third-party information. Consequently, a third-party assurance logo located on the Web site is a powerful marketing tool for e-commerce sellers, since it may be the only third-party assurance the consumer sees. It is no surprise, then, that WebTrust, BBBOnLine and TRUSTe all seem to be aimed at this market segment.
The other market segments, however, also provide significant opportunities for those offering logo assurance services. Traditional companies (cells III and IV) that are regional, or are established only in specific market niches and are now expanding nationally or even internationally via e-commerce, will benefit from WebTrust. The logo will help them get a jump-start in markets where they have not yet established reputations.
Even though retail e-commerce receives the most coverage in the popular press, the dollar value of business-to-business e-commerce transactions—manufacturing, wholesale trade and services—is significantly larger and the difference is growing. As with other estimates of e-commerce activities, the estimated sizes of these two market segments vary widely. However, Forrester Research estimated that the business-to-business market will grow to be eight times larger than that of retail e-commerce by the year 2000. While business buyers do have access to a broader range of third-party information, it can be expensive to search this information and apply it to particular potential sellers. Assurance logos provide an efficient and cost-effective way to screen potential sellers. Business buyers can then perform more detailed evaluations only on sellers that made it through the first logo-based screening process. This two-step approach will be more important as businesses make general "calls for bids" on the Web rather than the business-as-usual scenario of seeking bids from a small number of established suppliers. Just as some companies and government agencies now require their suppliers to be ISO 9000-compliant, they also may require that they display the WebTrust logo. (It should be noted that currently WebTrust is only a business-to-consumer logo service. The AICPA electronic commerce assurance services task force is developing a business-to-business version of WebTrust.)
CPAs should start recommending the WebTrust logo to clients and employers now and not wait for market pressures to force them to do so later. Businesses displaying the WebTrust logo will have a competitive advantage. WebTrust's ultimate success depends on how well the profession, and its clients, market the logo.
POTENTIAL PITFALLS| Case Study: Dollars, Marks and Beer |
| Money makes the world go around, as the song goes, and today the Internet makes money go around the world. Sonnet Financial has gone into the business of selling money over the Web-all over the world-quickly, cheaply and securely. If you have to purchase $100,000 in supplies in Paris tomorrow, Sonnet will convert the dollars to francs. All you need is a modem. Sonnet, founded in 1992 to provide discount currency exchanges for companies, introduced a new product this year called FXWeb (www.sonnet-financial.com). No new software is necessary. Once you sign up with Sonnet, you can enter a password-protected page and set up one or more source accounts-such as your company's bank account in New York-and destination accounts-such as a parts supplier in Tokyo or your company's branch office in Oslo. You type in the amount and the type of currency and hit "OK." You're done. FXWeb follows up with an online confirmation and organizes all your transactions into a report you can download into a general ledger or spreadsheet program. Sonnet is not a credit company-its clients must send the actual transaction funds the same day-and it does not speculate in the currency markets. Its business is organizing the transactions and it makes its money entirely from fees it charges its customers. "Think of us as the air traffic controllers of currency exchange," said Sonnet Senior Vice-President Daniel A. Carmel. Hassle-free environment Customers don't have to keep banker's hours. "We have a client who buys beer wholesale in Germany for export to Canada," said Carmel. "At the end of the day, he plugs his laptop into a jack in his hotel room and posts all his transfers." Sonnet performs the transfers three times a day and charges fixed fees ranging from $40 to $150, depending on the size of the transaction. Security For the small business people who want their piece of the global market, the Internet is simplifying the business of doing business. —Richard J. Koreto |
From a functional point of view, companies are justifiably concerned about the new and modified internal controls needed to support e-commerce. For example, the fact that outsiders now have access to their online systems is justifiably a matter of considerable concern. Traditional businesses often have to integrate their new e-commerce systems with their existing sales, inventory and accounting systems. WebTrust criteria do address internal controls but primarily from a narrow focus of protecting customer information and order entry accuracy. However, these are just a small part of the many internal control issues associated with e-commerce. Supplying more in-depth internal control assurance services could provide many new opportunities for CPAs.
Also, sellers may have concerns about buyers. Sellers want some form of nonrepudiation, meaning a buyer cannot deny sending an order request. Sellers may eventually require buyers—especially business buyers making very large purchases—to have some form of assured authentication controls in place, suggesting that another realm of opportunities for CPAs to sell assurance services may be forthcoming.
ACTION PLANWebTrust and other assurance services described in this article build on existing CPA skills. Although CPAs do not need to be technological experts, they do need to understand e-commerce to help determine how to apply their existing skills to this new domain. (For profiles of practitioners performing WebTrust engagements, see "WebTrust Rolls On," JofA, Feb.98, page 98, and "WebTrust Isn't Just for Stores," JofA, Apr.98, page 81.) The following is a broad action plan to help CPAs move into e-commerce.
Obtain an overview. A number of books and articles provide information about e-commerce concepts, terminology and technology without becoming bogged down in technical details:
Several magazines such as Electronic Commerce World and Internet Computing also are available. Key Web sites include CommerceNet (www.commerce.net) and Emmerce (www.computerworld.com/emmerce/) and the Institute's dedicated WebTrust site (www.cpawebtrust.org).
Learn about logo services. Visit BBBOnline (www.bbbonline.org), TRUSTe (www.etrust.org) and ICSA (www. ncsa.com) sites to learn more about them and understand how they differ from WebTrust. Visit the AICPA site (www.aicpa.org/webtrust/index.htm) to read and download detailed information about WebTrust.
Tailor CPA services. After a CPA talks to a prospective client, he or she should look at exhibit 3 to properly classify the entity. The CPA can then customize the assurance services.
A frontier is a wild and unpredictable place. The online business community will likely wrestle with a number of solutions to e-commerce problems before reaching satisfactory answers. But strip away the technology issues and e-commerce isn't really all that new: Consumers want assurance on online purchases the same way that they want assurance on traditional financial statements. CPAs who understand the online problems will find many solutions from their years of audit experience. The combination is hard to beat.
