Most banks use the Internet to provide access to resources and to deliver information, products and services; however, they may be unaware of the Internets inherent security risks. The FDIC has issued a paper to help identify many of those risks, as well as several systems controls that financial institutions can use to manage them.

The paper, Security Risks Associated With the Internet , identifies the FDICs areas of concern relating to transactional and systems security issues, such as data privacy and confidentiality, data integrity and authentication. For example, the paper explains that sniffer programs can be set up to look for and collect data, such as account numbers or passwords, and IP spoofing programs can be used to make one computer actually claim to be another by mimicking its Internet protocol address.

The paper also discusses the primary technologies, standards and controls that manage Internet risks, such as encryption, digital signatures and certificate authoritiestrusted third-parties that verify the identity of a party to a transaction. It also examines other methods of systems security, including the use of firewalls, smart cards and biometric technologies, such as retina scanning.

A copy of the paper (FIL-131-97) is available online at www.fdic.gov (click on banking news) or by calling the FDIC public information center at 800-276-6003.

Regulators Issue Internal Audit Paper
Four federal banking agencies issued a policy statement on internal audits, including information on outsourcing the internal audit function. The statement emphasizes the importance of sound risk-management processes and internal controls, and it warns of certain risks related to outsourcing internal audits to vendors that also perform the financial statement audit or other services requiring independence.

Federal regulators have had concerns over the independence of certain outsourcing arrangements, said Doris L. Marsh, examination specialist in the FDIC Division of Supervision. Marsh said there also were instances when the oversight agencies thought the number of staff was not sufficient to oversee the internal audit function. We consider this a best practices paper, said Marsh.

The statement, Interagency Policy Statement on the Internal Audit Function and Its Outsourcing , was sent to the CEOs of all banks by their respective regulators. It was issued by the FDIC, the board of governors of the Federal Reserve System, the Office of the Comptroller of the Currency and the Office of Thrift Supervision.

The statement focuses on the sound practices necessary to manage effectively the internal audit function of insured depository institutions, bank holding companies and U.S. operations of foreign banking organizations. It also examines how outsourcing arrangements may affect an examiners internal control assessment and discusses how certain outsourcing arrangements could affect the independence of an external auditor that is also providing internal audit services. The statement notes that an entitys board must select an external auditor that will satisfy the independence requirements established by the AICPA and relevant requirements of the SEC.

The statement is available on the FDIC Web site at www.fdic.gov and the Federal Reserve Boards Web site at www.bog.frb.fed.us.

©1998 AICPA

GERALD W. HADDOCK is president and CEO of Crescent Real Estate Equities Co., a publicly held U.S. real estate investment trust specializing in office properties. Headquartered in Fort Worth, Texas, the $6.6 billion REIT owns assets in select markets in the Southwest. Its Web site is www.cei-crescent.com .

Many ordinary investors are still confused about exactly what a real estate investment trust (REIT) is, says Kit Case, senior equity REIT analyst for Southwest Securities, Inc., summing up the calls he receives. On the other hand, Case says more sophisticated institutional investors want to know which ones to buy.

A REIT essentially is a tax-advantaged corporation or business trust that combines the capital of many investors to acquire or finance all forms of real estate. With tax rules similar to mutual funds, REITS are pass-through entities for income tax purposes. Also like mutual funds, REITs give clients the chance to buy shares in a diversified portfolio of professionally managed real estate with the same liquidity as any other publicly traded stock. Since most public REITs are listed on the New York Stock Exchange (74%), the American Stock Exchange (20%) or the NASDAQ national market system (6%), REIT shares can be readily converted into cash. Thus, REITs give clients superior liquidity when compared with direct investments in real estate.

REITs In the 1990s
REITs have just recently come into vogue again. Toward the end of 1995, REITs steady returns helped insulate those mutual funds that invested in them against the technology meltdown. Susan Byrne, president and CEO of Westwood Management Corp. and manager of its balanced fund, says in the last quarter of 1995 we cut our technology position by half and replaced it with REITs. By doing this, we held our gains from the first nine months. The move may have helped make her fund the countrys number-one performing balanced fund for the next seven months, according to Morningstar, Inc.

In 1996, REITs performance drew even more converts. The industry racked up a 35.75% total return, outperforming both the Standard & Poors 500 index and the widely used Lehman Brothers government corporate bond index.

Of course, todays REITs differ radically from their predecessors of 20 years ago. In the early 1970s, REITs were perceived as not much more than the commercial lending arm of several national banks. Numerous REITs leveraged their equity capital for borrowings to make loans to developers. This worked until the mid-1970s recession, when hikes in short-term interest rates and the souring of a number of speculative construction projects depleted REIT equity and led to some bank takeovers. Investors became disenchanted with REITs because of mismanagement, which often was attributed to the conflicts of interest inherent in external management. This structure bred conflicts of interest because management billed management fees whether the REIT made money or not.

Approaching the millennium, REITs are much more fiscally conservative than their progenitors, perhaps because management and REIT shareholders are strongly allied. The majority of REITs no longer depend on risky construction lending. For example, 83.8% of public REITs derive their income from property rents and only 10.1% from interest on mortgage loans. And if any REIT did contemplate incurring excessive debt to make an acquisition, it would risk a severe scolding from the business press and perhaps a fall in stock price.

The Tax Reform Act of 1986 helped dissolve management conflicts. Save for hotel REITs, the majority of REITs no longer were forced to depend on outside managers. They could manage their buildings themselves. The 1986 act allowed most REITs to provide general tenant services customarily furnished by buildings of comparable size in a propertys geographical market and to capture the related income for their shareholders benefit.

Additionally, managements interests are heavily aligned with those of shareholders because Wall Street prefers that a REITs top executives invest in the company they manage. Most REITs follow this guideline. For example, I have dedicated 80% of my own net worth to the success of Crescent Real Estate Equities Co. These reforms in REIT income, debt levels and management structure have greatly improved REITs approval rating in the public markets.

Today, there are also a far greater variety of REITs for investors to choose from. Roughly 22% of public REITs specialize in retail properties; another 21%, in residential. Others favor diversification (15%) or industrial/office properties (14%) and an even smaller portion, areas such as self-storage (7%) or health care facilities (6%).

Who Needs REITs?
REITs are appropriate for many portfolios, particularly in those of investors with a low risk tolerance who seek income from their equity positions. Historically, REITs are more stable performers than other types of stocks. During last falls Asian crisis, when the Dow Jones industrial average dropped about 7% in one day, the Morgan Stanley REIT index fell only half as much.

According to Southwests REIT specialist Case, The risk-averse investor may be more comfortable buying in sectors that display more stable share prices, such as multifamily, retail or industrial REITs. He explains that retail REITs, for example, usually have more large diversified malls with several long-term anchor tenants in their portfolios. Rents of multifamily REITs turn over yearly regardless of the local economy, but their lease increases or decreases are in small increments. Both sectors typically exhibit the type of less volatile share prices that may suit low-risk investors.

REITs also are a match for clients who want reliable cash dividends. According to the National Association of Real Estate Investment Trusts, as of the end of the third quarter of 1997, the yearly dividend of public equity REITs averaged 5.45%. However, some investors may deem bonds a better vehicle for cash dividends. After all, bond interest rates average 6% to 8%.

But REITs provide an extra financial incentive that bonds lack. With REITs, investors have the opportunity for both share appreciation and increased dividends. Dividends have tended to grow at a rate of 5% to 10% a year. Most investors wont get that cash boost with bonds. Even though interest rates rise and fall, most bondholders are locked into the fixed rate at which they purchased their bonds because most buy and hold to maturity. Despite these potential financial bonuses, REITs shouldnt take the place of bonds in a portfolio. Rather, they should be an important component in diversifying a portfolio.

REITs have an edge on other stocks as well. Because there is no double taxation, they have a larger pool of profits from which to pay shareholder dividends than do corporations of similar size. As long as a REIT maintains its tax-qualified status by paying out 95% of its net income to common shareholders, it is not required to pay federal income taxes. Without a tax bite to reduce profits, shareholders derive more of the REITs earnings because only the shareholder pays taxes on a REITs distributions.

Moreover, REIT investors concerned about taxes receive another benefit. Depending on each REITs distribution policy and annual earnings, a portion of the dividend may be deemed a nontaxable return of capital. Not only does the investor not have to pay taxes on that part of the dividend in the year it is distributed but also that amount is not taxable until the stock is sold. So the return of capital not only defers taxes but also lowers an investors taxable income during the time the REIT stock is held, thereby increasing the aftertax dividend yield.

Selecting A REIT
CPAs should advise investors who are keen on adding REITs to their portfolios to evaluate them by their multiples, growth potential, management and debt levels. A REITs multiple is defined as its share price divided by its funds from operations (FFO) per share, or P/FFO. In its simplest form, FFO is equivalent to bottom line earnings before depreciation, according to GAAP. Depreciation is not included in this computation because it is irrelevant to income-producing real estate, which generally appreciates over time. By contrast, most other corporations physical assets depreciate with use and age; therefore, this cost is appropriately reflected in their earnings. In essence, FFO captures a REITs operating cash flow produced by its properties, less administrative and financing costs.

Depending on its investment criteria, a REITs multiple will resonate differently with different investors. A risk-averse investor may prefer a lower multiple with less downside risk. Conversely, an investor who wants an aggressive, fast-growing REIT may crave a higher multiple but will likely pay a higher price. In the current real estate market, office and hotel REITs are the most growth-oriented. In particular, as office leases turn over, such REITs will realize the growth embedded in their portfolios from recent rental spikes. This growth will support greater potential for share price appreciation in office REITs.

Before placing an order, though, investors also should assess the projected growth rate of FFO carefully for indications of the REITs earnings growth potential. In addition, investors should examine the management teams history and real estate experience. Finally, investors should scrutinize a REITs debt level. Wall Street may accept debt comparable to 50% or below a REITs total market capitalization, but most REITs currently operate at much lower levels.

Once the real estate market reaches its equilibrium and buildings can be sold at or near their replacement costs, the lower debt levels prevalent among todays REITs may protect investors against a return to the fire sale mentality of the 1980s. REITs wont be forced to sell quickly, because the discipline imposed on them by Wall Street has encouraged management to make solid, long-term decisions.

Solid, Long-Term Investments
The United States has never seen a REIT market of the current size. Yet REITs own only a small percentage of the nations total institutional-quality commercial real estate. That percentage is likely to rise significantly over the next five years, thereby strengthening the opportunities for REITs earnings to grow from external acquisitions. As a result, the expected expansion of REIT portfolios will enhance REITS as solid, long-term investments. As always, before making any decisions, investors may wish to consult their CPAs or other financial advisers.

©1998 AICPA

A CPAs Skills, an Agents Badge
The office belonging to the head of the FBIs Washington field office sports a memento of one of his past jobs: a sign identifying Tom Green as the controller of the Olympic Construction Co. However, Tom Green was the nom de guerre of FBI special agent Thomas J. Pickard, CPA, and Olympic was, in fact, a dummy company set up by the FBI to try to bribe politicians on behalf of Middle Eastern businessmen, in the undercover operation known as ABSCAM. We suspected private investigators would be hired to make sure Olympic Construction was realand not a trap. We had to make it look like a real company. It needed real ledgers and real responses to federal regulatory authorities. CPAs, knowledgeable about how real companies worked, proved able to set up a fake one. As Ive always told agent-trainees, the most important tool they have isnt a 9 mm. handgun; its a number-two pencil.

Pickard has used both tools in his 23 years with the FBI. Licensed as a CPA in New York, with an undergraduate degree in accounting and an MBA in taxation, he worked for two and a half years at Touche Ross before joining the bureau. In the FBIs New York office, he was assistant special agent in charge (ASAC) for all white collar crime investigations and was later ASAC for violent crimes matters. He supervised the trials of the World Trade Center defendants and played a key role in the investigation of the TWA 800 explosion.

Since ABSCAM, the pencil has given way to the laptop computer, now standard issue for all FBI special agents. In February Pickard moved from the Washington field office to FBI headquarters as assistant director in charge of its criminal investigative division, the bureaus third-highest position. The CPAs role in the FBI has grown as well; nearly 1,400 of the bureaus 12,000 special agents are agent accountants. Pickard recently discussed with the Journal frauds that are the concern of all CPAs, important security issues for business and how he has applied traditional CPA skills in new ways.

Accountant as investigator
CPA agents apply their accounting skills in reviewing the finances of top officials: Pickard was one of a small army of special agents who pored over Nelson Rockefellers extensive financial records when he was chosen as vice-president. CPAs look into possible fraud at FDIC banks and work with U.S. Attorneys investigating finances in criminal cases.

Todays financial crimes increasingly involve computers and the Internet, in some surprising places. Illegal gambling houses would keep records on rice paper and throw them into buckets of water to dissolve as we broke down the door. The special agents first task was kicking the buckets over. Now, these outfits use computers and take their bets over the Internet. We raided a drug dealers headquartersthe suspect actually had a group of Pentium computers, which he used for accounts payable and receivable. One terrorist, Ramzi Yousef, encrypted financial records on his hard drive. Special agents eventually decoded the records and were able to use them to win a conviction.

The Internet easily crosses international borders, as do online criminals. An overseas Internet fraud may be the result of a hostile foreign governmentor a 17-year-old with a PC. The FBI maintains units overseas to work with local law enforcement agencies. U.S. companies sell products through a Web site and get excited when orders pour in. Soon, they realize the credit cards used are fraudulent, tied to nonexistent addresses. Ive seen very sophisticated companies cheated this way.

Any CFO at a corporation may have responsibility for keeping payroll data private. So did Pickard, who had an especially urgent reason for redesigning the FBIs payroll system: The bureau had to avoid compromising undercover agents living under assumed names.

Take a tip from the G-men
In many cases, CPA agents work closely with a companys auditors to investigate fraud cases. Pickards experience in fraud and other white-collar crimes has given him insights into what companies should do to protect themselves. Review procedures. For example, check a credit card number you receive online before processing an order. He stressed the need to consider the enemy withinthe disloyal employee. If youre having trouble with your system, is it a malfunctioning server or someone trying to break into a secure area? You used to lock up ledgersare you locking up your systems? Pickards general advice to CPAs is to look at the big picture. Too often CPAs get overly involved in the numbers. Step back and ask yourselfdoes this make any sense?

The electronic world presents a challenge for CPAs, said Pickard. CPAs concerned about their own companies security issues or their clients may want to consider additional education in this area; the FBI does. All agentseven senior onescontinue to take FBI-sponsored classes. Agents can hone their computer skills, for example. Also, the bureau is a CPE provider for its CPA agents, who keep up with new audit techniques. Raids used to end with agents seizing boxes of paper recordsnow its boxes of floppy disks.

A road less traveled
Pickard likes applying his skills to his FBI job but warns it isnt for everyone. There are many prerequisites for being a special agent, and its more physical than a Big 4 job. Your workday can start at 5:00 a.m. FBI policy requires all special agents to be physically able to engage in firearms use, raids and defensive tactics. Pickard once extradited a terrorist from another country, but the criminal was so dangerous no other country would allow any plane carrying him to land, even for refueling. I spent over 20 nonstop hours with my prisoner on a U.S. military transport that had to refuel in midair. But he does emphasize the opportunities for young CPAs (applicants must be between the ages of 23 and 37) interested in something different. The FBI handles more than 200 different kinds of federal violations. The CPA agent is the only special agent with the education to handle all of them. I would not be where I am today without my CPA designation; I would not have had the opportunities.

Richard J. Koreto

AICPA Grants Top Honors to Three
A key innovator, noted leader and an influential corporate board member received recognition in 1997 for their contributions to the Institute and to the profession.

The Gold Medal Award for Distinguished Service to the professionthe AICPAs highest honorwent to Robert K. Elliott, who has served on the AICPA board and governing council, the auditing standards board and the special committee on financial reporting. He is probably best known, however, for chairing the special committee on assurance services. (The recently unveiled CPA WebTrust came out of this committees work, and more new assurance services are on their way.) Elliott also has been active in the American Accounting Association and has served on its executive committee. The co-author of five books, he has written more than 70 articles. Elliott is assistant to the chairman of KPMG Peat Marwick.

Also receiving the Gold Medal was Robert L. Israeloff, head of Israeloff, Trattner & Co. in Valley Stream, New York, and 1994-95 AICPA board chairman. Israeloff has had a distinguished history of committee service, including serving as chairman of both the PCPS and SECPS executive committees and as a member of the special committee on financial reporting. He is a past president of the New York State Society of CPAs.

Kathryn D. Wriston, a lawyer and corporate director, won the 1997 Medal of Honor, which recognizes nonmembers who have made contributions to the profession. She has been a public member of the AICPA board and governing council. Currently, she sits on the board of the American Arbitration Association and is a member of the Financial Accounting Foundation.

O'Reilly Recognized for Audit Career
Vincent M. OReilly received the 1997 John J. McCloy Award for outstanding contributions to the auditing profession. The award was presented by A. A. Sommer, Jr., chairman of the Public Oversight Board of the AICPAs SECPS, at the Institutes National Conference on Current SEC Developments in Washington, D.C.

OReilly is distinguished senior lecturer at the Carroll Graduate School of Management of Boston College. He retired last year from Coopers & Lybrand, in Boston, after 28 years. He had held a number of management positions at the firm: deputy chairman, chief operating officer and chairman of the international accounting and auditing services group. He chaired the ethical practices committee and served on the firms executive committee for 17 years.

A founding member of the Accounting Education Change Commission, OReilly also was a member of the SECPS executive committee and of the Financial Accounting Standards Advisory Council of the Financial Accounting Foundation.

The McCloy award was established by the POB in 1988. Recipients are recognized within the accounting profession for their contributions to the goal of strengthening the integrity and value of auditing within the United States.

©1998 AICPA

Flexible spending accounts, used most commonly for health care and dependent care, allow employees to open tax-deferred savings accounts to meet health care expe

nses not covered by insurance plans or to pay a day care center, for example. However, these accounts must be spent by yearend or the money is forfeited.

©1998 AICPA

The International Federation of Accountants has revised its Code of Ethics for Professional Accountants to include information on the disclosure of confidential information, underbidding competitors and employing non-accountants. The ethics code also was modified to reinforce its role as a model for national accounting and auditing guidance around the world.

The revised code explains that professional accountants must respect the confidentiality of their clients or employers affairs. According to the code, confidentiality should be overridden only when professional, legal or ethical requirements call for public disclosure of information.

The code examines the practice of underbidding a competitor to secure an audit client. The concern is that, as a result of a lower fee, accountants may be tempted to reduce the quality of the work they carry out. Revisions in the code make it clear that an accountant who has obtained work at fee levels significantly lower than those charged or quoted by other accountants must not compromise the quality of an audit.

A copy of the revised code of ethics can be obtained by contacting IFAC at 212-302-5952 or by visiting the IFAC Website at www.ifac.org .

The paper, Reporting Financial Performance: Current Developments and Future Directions , surveys the similarities and differences in the reporting or presentation of profit or income in use around the world. For example, recent financial reporting standards issued by the U.K.s ASB, New Zealands Financial Reporting Standards Board, the FASB and the IASC all required

• The income statement to be supplemented by another statement that includes some reporting of financial performance.
  
  
• Financial performance to be reported on an all-inclusive basis (all gains and losses must be reported as a part of the financial performance).
  
  
• Inclusion of a total, or overall summary measure, of financial performance (except for the IASCs standard).

The paper is the sixth in a series of studies promoting harmonized international accounting standards.

Copies of the report (code: SRRFP) are available for $11.50 each from the FASB order department at 203-847-0700, ext. 555.

©1998 AICPA

Internal-Use Software Statement Issued
Accounting practices for the costs of software used internally have been diverse, but a new SOP from AcSEC brings consistency to this multibillion-dollar niche. Accounting for the Costs of Computer Software Developed or Obtained for Internal Use requires that many costs to develop or obtain internal-use software be capitalized. The statement also helps clarify what is, and is not, internal-use software and retains an appendix from the ED listing examples.

According to Daniel J. Noll, technical manager, AICPA accounting standards, AcSEC made two key changes to the statement after the exposure period. (For more background, see AcSEC Software Proposal to Have Major Effect, JofA, Feb.97, page 11, and Internal-Use Computer Software: The Fixed Asset of the Information Age, JofA, Mar.97, page 14.) First, the effective date was pushed back a year to fiscal years beginning after December 15, 1998, to give entities more time to implement the new requirements. Second, we widened the scope to account for data conversion costs, which the ED did not address, said Noll. The statement generally requires these costs to be expensed as incurred. AcSEC realized that data conversion is a key element in the process of developing new software and that entities need guidance to account for those costs.

The final SOP also clarifies that costs incurred in developing internal-use computer software during the application development stage should be capitalized, as should costs to develop or obtain software that allows for access or conversion of old data by new systems. The statement says training costs are not internal-use software development costs and should be expensed as incurred.

When the SOP was exposed, there was some concern the draft would not receive sufficient attention because companies affected by it might be unaware of its significance. According to Noll, however, AcSEC received about 130 comments and numerous calls about the SOP.

For information on the tax implications of internal-use software, see Internal-Use Software and the Research Credit, page 31.

To order the SOP, call the AICPA order department at 800-862-4272.

©1998 AICPA

The GASB received a three-year grant to research and develop performance-reporting techniques that will make it easier for citizens, elected officials and other financial report users to better understand the results of their governments operations. The Alfred P. Sloan Foundation, a philanthropic not-for-profit institution that is particularly interested in assessing government performance, awarded the grant.

The GASB also will hire a full-time staff member to work on its project on reporting for government service efforts and accomplishments. The GASB and FASB use that term to define the full results of government and not-for-profit operations.

According to Jay Fountain, GASB assistant director of research, the board will

• Establish an electronic clearinghouse as a forum for governments to exchange information on performance reporting.
• Research the effectiveness of performance reportingincluding how, if at all, it improves particular programs, budgeting and the governments ability to communicate with its citizens.
• Determine whether it should establish performance reporting standards for state and local governments.

We also must determine how performance measures are being reported, what methods of reporting and communication are effective and how governments can prepare citizens and elected officials to use this information, said Fountain.

For more information on the GASBs project, contact Jay Fountain by phone at 203-847-0700, ext. 259 or by e-mail at jrfountain@gasb.org .

New Federal Government Subcommittee
The AICPA has formed a new subcommittee of the government accounting and auditing committee that will address issues relevant to federal and international government accounting and auditing. It will provide views and comments on Federal Accounting Standards Advisory Board (FASAB) proposals and proposed legislation, regulation and other requirements relevant to federal audits and financial management activities.

David Cotton, managing partner of Cotton & Co. in Alexandria, Virginia, will chair the subcommittee. He and other committee members also will meet with representatives of federal agencies and departments to discuss federal audits and financial management and advise AICPA representatives on the International Federation of Accountants (IFAC) public sector committee. Representatives from the Office of Management and Budget and FASAB will be nonvoting participants in subcommittee meetings and activities.

For more information, contact Wendy Frederick, AICPA technical manager, at 202-434-9211.

©1998 AICPA

F

Y

I

Short takes, notes and items of interest

©1998 AICPA