Press Release - AICPA Publishes Guidance on Next Generation of SAS 70

New Reporting Options Respond to Growth in Cloud Computing 

Published February 01, 2011

NEW YORK (Feb. 1, 2011) – Cloud computing providers and healthcare claims processors are among the information system service organizations who will benefit from new CPA reporting options developed by the American Institute of Certified Public Accountants.

“The AICPA developed these new Service Organization Control reports in response to marketplace demand,” said Barry Melancon, AICPA president and CEO. “Service organizations have been vocal about their clients wanting assurance that they have effective controls for all their data – not just financial information. These reporting options will help them build that trust with their clients.”

“As accounting firms and their clients increasingly move to the cloud, greater confidence in data security, confidentiality and privacy is needed,” said Erik Asgeirsson, president and CEO of CPA2Biz, a leading cloud solutions provider and subsidiary of the AICPA. “This is a major evolution from SAS 70 that meets the need in the marketplace and will have a substantial impact on CPAs and their clients.”

The AICPA designed the new, illustrative Service Organization Control (SOC) reports to help companies that outsource tasks or functions to third party information system providers, such as Intacct or Data security risks require greater due diligence to avoid internal control breakdowns. Melancon provides an overview of how the guidance and reports were developed in an online video.

The new SOC reports, formerly called SAS 70 reports, provide a framework for CPAs to examine controls and to help senior management understand the related risks of outsourcing to a service provider.

Companies had misused SAS 70 to issue reports on controls related to outsourced non-financial data rather than the correct attest standard which was in place. The SOC reports clarify which standard needs to be used and how it should be implemented to meet specific user needs.

  • SOC 1 reports are primarily an auditor-to-auditor communication which addresses the controls at a service organization relevant to financial reporting. These reports are restricted use reports and therefore are not designed for promotional purposes.
  • SOC 2 reports are in response to the rapid growth in cloud computing  and data outsourcing, as well as the marketplace need for clarification on how reports on  non-financial controls regarding information, such as data security, confidentiality and privacy should be structured.
  • SOC 3 reports cover the same subject matter as SOC 2, but in a general use, short form format which may be freely distributed.

Service Organizations: New Reporting Options is now available for purchase for $29.00 for AICPA members; $36.25 for non-members.

Increase Your Tax Workflow Through Automation

Here we are again. It’s November, and you are coming to the realization that another tax season is just around the corner. Doesn’t it feel like the 2009 tax season just ended?

Do you remember thinking in the spring that, “Next tax season, my firm isn’t going to …” or “Before next tax season, we better …” Many of those ideas often revolved around investments, such as technology, that would help you, your staff, and your firm to be more efficient, effective, and forward thinking during the 2010 tax season. Anything! As long as it would make the tax season, well…less taxing.

With less than three months until the full-blown tax season gets underway, what can you do at your firm to increase efficiency while continuing to offer the exceptional service your clients have come to expect? Below are some best practices, as well as reference links to tools and resources you still have time to invest in.

Best Practices

  • Process Review and Improvement: Streamlining workflow is an ever-neglected to-do item for many CPA firms, especially as client demands and regulations increase. It may prove valuable to have someone internally or externally document your existing business process and identify tasks that can be eliminated or done more effectively. Preparing a graphical workflow of the steps your team takes to complete the process may enlighten you.

    Edward V. Jennings, CEO of Copanion, Inc., a tax document automation software company in Andover, Mass. and an AICPA Trusted Business Advisor partner, commented that firms that have moved to a paperless tax workflow, the efficiency gains have been phenomenal—some report time savings of up to 45 minutes per return. With the time saved, tax professionals are focusing on higher value activities and delivering better customer service to differentiate and grow their practices. Achieving results such as these is possible, and it's easier than many think.
  • Create a Single Location for Digital File Storage:  Whether you are using a Windows® file folder structure, or a more sophisticated professional document management system, the goal is to keep digital files organized and easy to find for all your staff. Not only does it save time, it increases efficiency among staff members who need to search for client content throughout the tax season and workflow process. It also reduces the loss of a potential “roving” paper file.
  • Invest in Technology/Hardware: Investing in a high-speed scanner and dual monitors may seem trivial, but think about how often you wished you had electronic files to work from versus paper files. And, remember the last time you had to keep switching back and forth from Excel™ file to Excel file to get the information you needed?  

  • Implementing Worflow Tools—Now is the time to add workflow tools, such as a tax document automation tool and/or a workflow management tool, to help you be more efficient during the looming tax season.

Additional Resources

There are many resources to research if you’re considering taking the next step toward automating your tax workflow, including process efficiencies, paperless solutions, and technology investments.


As you contemplate the upcoming tax season, consider what you could accomplish if certain tasks were automated, files were structured electronically, client documents were easily accessible by your staff, and so much more. How much would all of that be worth to you?

There is still time to research and evaluate products. Share your thoughts and experiences here.

    • AICPA Trusted Business Advisor™ Solutions

What the PCAOB’s Proposed Standard Means for Audit Confirmations

In July, the PCAOB (the Board) issued a proposed revision to AU 330, The Confirmation Process, that if approved will modernize and expand the requirements of audit confirmations. Today, auditors use audit confirmations to obtain reliable audit evidence from third parties, which is an important part of the audit process. Since the current standard AU 330 was written more than 15 years ago, the Board agreed that the standard needed to reflect advances in technology—acknowledging that while technology can improve efficiency, it can also be used to perpetrate fraud, such as intercept confirmation requests and change confirmation responses before they reach the auditor.   

The proposed standard also addresses the continued deficiencies seen within the confirmation process itself by defining what a confirmation response is and isn’t, and expanding the types of accounts that are confirmed during an audit. Here are some key changes that will take place if the proposed standard is adopted by the Board:

1.      Expands Receivables Requirement expands the requirement of confirmation procedures to receivables that arise from credit sales, loans, or other transactions.

2.      Requires Confirmation for Cash requires auditors to perform confirmation procedures for cash and other relationships with financial institutions, such as:

a.      Lines of credit;

b.      Other indebtedness;

c.       Compensating balance; and

d.      Contingent liabilities including guarantees.

3.      Definition of Confirmation Responses—a confirmation response is audit evidence obtained as a direct communication to the auditor from a third party, either in paper form or by electronic or other medium.

4.      Confirm Validity of Addresses—requires an auditor to determine the validity of addresses in confirmation requests.

5.      Oral Confirmation Responses—An oral response to a confirmation request is audit evidence, but it does NOT meet the definition of a confirmation response.

6.      Internal Auditors Cannot Send Confirmations—To evaluate audit evidence obtained, auditors cannot use internal auditors to send confirmation requests, receive confirmation responses, or evaluate the audit evidence obtained from performing confirmation procedures.

7.      Negative Confirmations may be used to reduce audit risk to an acceptable level when:

a.      The combined assessed level of inherent and control risk is low;

b.      A large number of small balances is involved;

c.       The auditor reasonably expects a low exception rate;

d.      Auditor has no reason to believe that the recipients of the requests are unlikely to give them consideration.


An auditor should  perform other substantive procedures to supplement the use of negative confirmations.

8.      Alternative Procedures for Non-Responses requires the auditor to perform appropriate alternative procedures for all non-responses to positive confirmation requests.

9.      Investigate All Exceptions requires the auditor to investigate all exceptions in confirmation responses to determine why each exception occurred and whether any exceptions, individually or in the aggregate, are indicative of a misstatement or of a previously unidentified risk of material misstatement.

10.  Reliability of Electronic Confirmations—In assessing the reliability of electronic confirmation responses, the auditor should take into account the following risks:

  • Process might not be secure or properly controlled;
  • Not from a proper source; and
  • Integrity of the data may have been compromised.

11.  Direct Access—If account access codes are given to the auditor by management of the company and not the confirming party, evidence obtained by the auditor does NOT meet the definition of a confirmation response. It’s only considered audit evidence. If access codes are given to the auditor by the confirming party, the confirming party must also represent its acknowledgement of the use of the direct access by the auditor and that the files to be accessed are responsive to the auditor’s request.

12.  Disclaimer or Restrictive Language—If a disclaimer or restrictive language causes doubts about the reliability of a confirmation response, the auditor should obtain additional appropriate audit evidence.

To learn more about the PCAOB, AICPA and IAASB  proposed/new standards for audit confirmations, listen to our September 27 recorded webinar “Understanding the New Standards for Audit Confirmations” with speaker Brian Fox, CPA.


For more about standardizing your firm’s audit confirmation process, reducing your exposure to fraud, and increasing efficiency visit today.

What does being a Trusted Business Advisor really mean?

Recently a discussion topic was posted on the AICPA Trusted Business Advisor Solution LinkedIn group about what it means to be a trusted business advisor and how to best keep an open communication stream with clients.

When thinking about marketing strategies for trusted business advisors, one of the LinkedIn group members said, “It’s all about positioning yourself as not only your client’s trusted financial advisor, but also as their trusted business advisor.” He went on to say that advisors need to focus on general management issues, not just tax and accounting matters, and to visit with clients at least once quarterly to ensure you are kept abreast of what’s happening in their business.

Another member concurred that one of the most valuable techniques a trusted business advisor can employ is the “human touch” method of checking in regularly, outside of the service cycle.  She wrote, “Nothing says I’m thinking about you and I care about your success more than an outbound e-mail or phone call out of cycle.”

“Avoid being on the wrong side of the price/value curve,” commented another member. “Now more than ever, we need to communicate value.”

Some of the marketing strategies several people mentioned included:

  • Webinars to communicate legislative/regulatory changes and how those changes may impact your clients’ business;
  • Client newsletters and white papers on broader, general management topics demonstrating your command of not only the profession, but of the business world overall;
  • Speaking engagements aimed at value-added services and issues clients face  in the current economic climate; and
  • Hiring marketing, communication, and/or public relation staff to assist the firm in establishing its position as a trusted business advisor.

You might consider joining the AICPA Trusted Business Advisor Solutions LinkedIn group to learn more about best practices in the profession, to share advice, to ask questions, and to become a member of a 1,000+-person group of professionals like you.

Additionally, “Becoming a Trusted Business Advisor: How to Add Value, Improve Client Loyalty, and Increase Profits” was recently released. Find out how to uncover critical client needs in ten minutes or less; how to help your clients prioritize their wish lists; and how to help them quantify the value of addressing each of the issues that keep them awake at night!

Further, CPA2Biz is also here to help you build your Trusted Business Advisor brand and relationship with your clients by offering several marketing programs to help keep your firm’s trusted business advisor status prominently in the marketplace, including:

  • CPA Client Bulletin is a monthly newsletter designed by the AICPA as a marketing and communications tool for your practice. Choose to send as an email newsletter, print newsletter or as a pdf file you can post to your site. Your firm stays top of mind, and your clients and prospects will appreciate the tax, business, and financial planning ideas. Build your reputation as a trusted business advisor with CPA Client Bulletin.
  • Google AdWords provide you with expert Search Engine Marketing (SEM) and consulting services to help you target local, regional, or national clients in a cost-effective way with your own customized online Google advertising campaigns.
  •  Ready-to-use and customizable emails, flyers, and web site content and PowerPoint slides that you can download and share to help explain the benefits of cloud-based accounting services directly to your clients.

If you have trusted business advisor tips and marketing techniques, please share your thoughts and comments here.

CPA Marketing Tips – Fast and Easy Ways to be found on the Web

CPA Marketing Tips – Fast and Easy Ways to be found on the Web
As a CPA firm, it’s critical that people in your state, county, and city know how to find your firm and the services it provides.

Below are some fast and easy marketing tips to help your firm be found on the Internet, particularly on GoogleÔ, one of the world’s most-used search engines.

You or someone in your firm can do each of these in minutes to help spread the word about your firm and increase your search results in Google.

  1. Natural search results using keywords
  2. Google Places
  3. Advertising on Google

Let’s begin by talking about natural search results. Natural search results are the results a user retrieves when he/she inputs a search term into a browser, such as Google.  For example, let’s say a person is looking for a CPA in Cincinnati. They might enter a search term, such as “CPAs in Cincinnati”. If you practice in Cincinnati, your firm’s name should appear on the first page of the browser results—in this case Google, but only if you’re using online marketing to its fullest.

What are keywords?
Keywords are terms you use to identify your web site, specialties, office location(s), key partner names, firm name, and services your firm provides.

Let’s take an example from our “CPAs in Cincinnati” exercise. When searching for CPAs in Cincinnati, you can see the results on the left of the map. Those results were provided using keywords such as “cpas in Cincinnati,” and “Cincinnati CPA,” on their web site keywords meta tag. For example, one site uses <meta NAME="Keywords" Content="cincinnati CPA, accounting firm, tax, accounting, cincinnati, Ohio, [your company name]">.

Another way to ensure your listing shows up on the front page of Google is through the use of Google Places.

Google Places is a way to mention your firm’s web site and services by location (local area or region). It’s a simple process to set up, and takes little-to-no maintenance to sustain. You can add as little or as much information about your firm into the profile account. Note: You must have a Google account in order to set up a Google Places profile.

With Google Places you receive a dashboard to easily see who is clicking on your profile, and how often people are searching for CPAs in your area. You will also be able to discern the impressions, or views, your site is getting, along with the actions people took to become more familiar with your firm.

Notice on the graphic above, that the two firms with reviews are highlighted. Reviews are a very helpful way for potential clients to learn more about your firm from those who are already clients. Once the firm’s profile is established, encourage your clients to write and post positive reviews.

Additionally, to help you with your marketing campaign on Google, CPA2Biz offers another option that encompasses the items above and more into one, low-cost option. It’s called Advertising on Google. This program helps to promote your practice and services to new customers through the powerful algorithm from Google.


With the Advertising on Google services you can:

  • Drive more traffic to your web site;
  • Promote a specialized service; and
  • Reach more prospective customers in your local community.

Further, you will also receive:

  • Multiple custom online ads;
  • Relevant keywords lists;
  • Active campaign management;
  • Bi-monthly status reports; and
  • Web site review.

This service takes marketing to the next level. In addition to helping your natural search results increase, this program also provides you with advertising about your firm on Google’s site. The image at the right shows an ad placement for a firm in Mason, OH. It also helps to take the guesswork out of determining keywords and campaign management.

Placing your firm's name and creating profiles on these sites not only increases your firm’s exposure, but also amplifies your natural search engine results through the use of multiple listings on various sites. The more your firm’s name appears on the web, the more relevant it will be in the Google algorithm, or with any search engine.

Most important, though, is to ensure that your clients and potential clients find your firm’s name when they are searching for the services they need, when they need them.

Is your firm easy to find on the web? If not, you may want to employ some or all of these approaches.