What CPAs need to know about Cloud security

By Jeff Onesto

No computing environment is completely secure. However, some environments are more secure than others.
 
The American Institute of Certified Public Accountants' (AICPA) 2010 Top Technology Initiatives (TTI) survey ranks data security as the topconsideration driving businesses today. What is most interesting about the survey is the scope now includes both internal firm and external client technology initiatives. CPAs might want to brush up on security basics specifically as they relate to "Cloud" applications as many clients are turning to their trusted business advisor for guidance.
 
Frameworks
 
Thanks to our friends at Enron, many companies must now comply with Section 404 of The U.S. Sarbanes-Oxley (SOX) Act. The act requires annual assessment of internal controls over financial reporting.  Both the Committee of Sponsoring Organizations (COSO) and Information System Auditor and Control Association (COBIT) frameworks are supposed to enable clear policy development and good practice for financial reporting and information technology controls.
  
When it comes to Cloud security, the testing of financial reporting controls provides little assurance in regard to availability, reliability, confidentiality, and integrity of data. The COBIT Framework, built in part upon the COSO Framework provides management some additional tools to assess and measure the performance of 34 information technology processes.
 
Both frameworks are non-specific by design and do not compete with each other. The newest framework on the block comes from the International Organization for Standardization (ISO) and the International Electro-technical Commission (IEC). The ISO27001 framework specifically addresses information security, however, no framework as of yet is specific to Cloud environments.
 
Independent reports
 
The most popular independent audit reports for Cloud environments is the Statement of Auditing Standards No. 70 (SAS70), which, as of this April, has been replaced by Statement on Standards for Attestation Engagements (SSAE) No. 16, Reporting on Controls at a Service Organization. SSAE 16 is effective for service auditor's reports for periods ending on or after June 15, 2011. In the SAS70 audit engagement, the auditor provides assurance to users and specifically users’ auditors, in respect to the service organization's internal controls. The SAS70 audit addresses whether internal controls and procedures were suitably and properly designed, put into operation, and are operating effectively.
 
The SAS70 audit does not rate a company's internal controls against a particular set of defined security best practices. In matter of fact, if a company designed poor controls that work as designed, the report would state just that without calling attention to the fact the controls were indeed poorly designed.  
 
The new Trust Services audit engagement from the AICPA is gaining popularity. In the Trust Services audit engagement, the auditor provides assurance that an organization's systems controls meet one or more of the Trust Services principles and related criteria. In a Trust Services audit engagement, the auditor tests and evaluates as to whether a particular system is reliable when evaluated against the essential principles of availability, integrity, security, privacy, and confidentiality.
 
The Trust Services audit provides a report of the system reliability and, unlike the SAS70, uses a predefined set of criteria and principles for all types of audit engagements. The Trust Services audit report is intended to offer assurance to a broad audience – management, boards of directors, customers, and business partners.
 
Bottom line
 
The chief information security officer (CISO) has various frameworks and independent reporting options from which to select. As any great chef knows, a good recipe doesn’t always guarantee a good meal. The fact that Salesforce.com became one of the first Software-as-a-Service (SaaS) applications to become certified under the ISO27001 should highlight the fact that the market is changing.
 
It is up to trusted business advisors such as CPAs to help educate users of SaaS applications which combination of frameworks and independent audit engagements are needed to address concerns around security, privacy, availability, or confidentiality.
 
About the author:
Jeff Onesto, CPA, is director of product management for a SaaS accounting solution provider. His prior experience consists of Big Six consulting, enterprise software sales and delivery, product marketing, and bringing Web 2.0 solutions to the mid-market.
 
Related articles:

You may like these other stories...

Event Date: August 28, 2014, 2 pm ET Excel spreadsheets are often akin to the American Wild West, where users can input anything they want into any worksheet cell. Excel's Data Validation feature allows you to...
When you’re running an accounting office, it's easy to become inundated with paper, forms, and email attachments, especially when tax season rolls around. To prevent your office from becoming completely overwhelmed...
It's not a reality—yet—but accounting software is poised to eliminate accountants. We are at a tipping point for many similar professions: online education replacing professors, legal software replacing...

Upcoming CPE Webinars

Aug 5
This webcast will focus on accounting and disclosure policies for various types of consolidations and business combinations.
Aug 20
In this session we'll review best practices for how to generate interest in your firm’s services.
Aug 21
Meet budgets and client expectations using project management skills geared toward the unique challenges faced by CPAs. Kristen Rampe will share how knowing the keys to structuring and executing a successful project can make the difference between success and repeated failures.
Aug 28
Excel spreadsheets are often akin to the American Wild West, where users can input anything they want into any worksheet cell. Excel's Data Validation feature allows you to restrict user inputs to selected choices, but there are many nuances to the feature that often trip users up.