Featured Resources

 

 

 

 

 

Transforming Client Accounting Blog

February 2011

02/14/2011

Several Ways to Protect Your Firm and Your Clients from A/P Fraud using Cloud Computing

Some firms are using cloud computing to offer clients new consulting models. Is this the future of the CPA profession?

According to the 2010 Report to the Nations on Occupational Fraud & Abuse from the Association of Certified Fraud Examiners (ACFE), organizations around the world lose an estimated five percent of their annual revenues to fraud. To that end, it's not surprising there have been so many recently published internal fraud-related articles from well-know resources such as AccountingWeb, CPA Success, and CPA Insider.

Has internal fraud become more commonplace for your clients? Has it simply being talked about more openly through social media channels and with the mainstream media?

Listed are additional resources you may find helpful as you help your clients in preventing fraud.

In a recent interview, Jason Blumer, from Blumer and Associates, suggests small- to mid-size firms leverage the cloud, or web-based solutions, to help mitigate internal fraud with and for their clients. "Small businesses — those who don't have, or can't afford it — are disproportionately affected by fraud and lack the processes in place to prevent fraud," he said. "Preventing fraud on the front end is far less expensive than detection on the back end."

In a recent CPA2Biz webcast, featuring Jason Blumer and co-host Jeff Schultz from Bill.com along with a video clip from Bob Harris, several tips were shared on ways in which a firm can leverage a cloud-based bill pay solution to help reduce fraud within its clients' workplace, including:

  • Establishing prevention procedures: Be aware. Identify key areas where your firm is most vulnerable and know who is accountable for each area. Determine the types of fraud that may occur and how they would likely be concealed. Then establish internal controls to keep these possibilities from becoming realities.
  • Going paperless. By preventing "lost" bills and invoices, you reduce the risk of manipulation and information theft, while maintaining an audit trail of access.
  • Enforcing separation of duties & payment control: Clearly define user access to the data, ensuring one single user does not authorize, process, and record financial transactions within the business. For example, an employee who enters bills into the accounting package should not have the ability to authorize payments for those bills. By segmenting role-based controls, you make sure that no one person has access to information and the ability to edit accounting data (vendor addresses, etc.).
  • Automating work processes: Enable different members of your staff to access client bill workflow, from data entry to verifying amounts to collaborating and providing transparency to the client. By automating payment deadline reminders and an audit trail, you ensure that nothing falls through the cracks.
  • Eliminating checks (incoming and outgoing): A single check contains every piece of information needed to access your money. By doing away with paper checks entirely, you protect client and firm account numbers, eliminate risk of lost, stolen or manipulated checks, and can access archived checks securely on Bill.com instead of via email.
  • Performing more regular internal audits: Automated systems make regular audits much easier, creating an online audit trail with full remittance data, cleared check images and approval confirmations.

What are you doing to help your clients prevent fraud within their small- to mid-sized business?

Share your success stories here.

Posted by AICPA on 02/14/2011 in Client Accounting, Cloud Financials, Data Security, Workflow Solutions  |  Permalink  |  Comments (26) Technorati Tags: , , , ,
02/02/2011

Press Release - AICPA Publishes Guidance on Next Generation of SAS 70

New Reporting Options Respond to Growth in Cloud Computing 

Published February 01, 2011 

NEW YORK (Feb. 1, 2011) – Cloud computing providers and healthcare claims processors are among the information system service organizations who will benefit from new CPA reporting options developed by the American Institute of Certified Public Accountants.

“The AICPA developed these new Service Organization Control reports in response to marketplace demand,” said Barry Melancon, AICPA president and CEO. “Service organizations have been vocal about their clients wanting assurance that they have effective controls for all their data – not just financial information. These reporting options will help them build that trust with their clients.”

“As accounting firms and their clients increasingly move to the cloud, greater confidence in data security, confidentiality and privacy is needed,” said Erik Asgeirsson, president and CEO of CPA2Biz, a leading cloud solutions provider and subsidiary of the AICPA. “This is a major evolution from SAS 70 that meets the need in the marketplace and will have a substantial impact on CPAs and their clients.”

The AICPA designed the new, illustrative Service Organization Control (SOC) reports to help companies that outsource tasks or functions to third party information system providers, such as Intacct or Salesforce.com. Data security risks require greater due diligence to avoid internal control breakdowns. Melancon provides an overview of how the guidance and reports were developed in an online video.

The new SOC reports, formerly called SAS 70 reports, provide a framework for CPAs to examine controls and to help senior management understand the related risks of outsourcing to a service provider.

Companies had misused SAS 70 to issue reports on controls related to outsourced non-financial data rather than the correct attest standard which was in place. The SOC reports clarify which standard needs to be used and how it should be implemented to meet specific user needs.

  • SOC 1 reports are primarily an auditor-to-auditor communication which addresses the controls at a service organization relevant to financial reporting. These reports are restricted use reports and therefore are not designed for promotional purposes.
  • SOC 2 reports are in response to the rapid growth in cloud computing  and data outsourcing, as well as the marketplace need for clarification on how reports on  non-financial controls regarding information, such as data security, confidentiality and privacy should be structured.
  • SOC 3 reports cover the same subject matter as SOC 2, but in a general use, short form format which may be freely distributed.

Service Organizations: New Reporting Options is now available for purchase for $29.00 for AICPA members; $36.25 for non-members.

Posted by AICPA on 02/ 2/2011 in Client Accounting, Cloud Financials, Data Security, Resources, Video Blog  |  Permalink  |  Comments (0) Technorati Tags: , , , , , , , , , , , , , ,