The Law and CPA WebTrust

Internet fraud may not soon be a staple of TV crime shows such as Law and Order and NYPD Blue , but that doesn’t mean CPAs should wait until there’s drama to take a look at the legal ramifications of WebTrust. If a problem requiring court intervention arises in an e-commerce case involving a WebTrust engagement, what are a CPA’s liabilities? What legal precedents come into play with this new assurance service? The law ultimately will evolve with regard to assurances linked to electronic commerce, but for now, the well-prepared CPA will want to know precedents and strategies that can minimize litigation risk. CPAs should not be needlessly frightened away from WebTrust because of this risk; increased awareness, not fear, is the answer.

Development and deployment of any new CPA assurance service and, indeed, many accounting services, carry some litigation risk. Perceived as guarantors of financial statement accuracy, CPAs often are targets in lawsuits filed by aggrieved shareholders or creditors who see accountants or their malpractice insurers as deep pockets. Technological aspects of WebTrust make some litigation issues even more complex than in standard engagements. In December 1996before the AICPA unveiled WebTrust, SEC Commissioner Steven Wallman commented on how the evolution of financial information technology would affect accountants, predicting it would cause a shift away from substance attestation toward process attestation. For accountants, process attestation means providing assurance about the integrity or reliability of the system a client employs rather than about the integrity of the business information that system produces.

In the world Wallman described, the potential liability of assurance service providers is staggering given that virtually any computer user, anywhere in the world, can access a business Web site that displays a WebTrust seal. The accountant’s potential liability exposure is global, since the Internet knows no borders. Given the potential exposure, CPAs must become familiar with the litigation-risk issues before they initiate WebTrust engagements.

THE EXPECTATION GAP
WebTrust liability does not exist in a vacuum. For the past several decades, the accounting profession has faced an expectation gap, the difference between the public’s perception of the scope of an independent accountant’s responsibilities and his or her actual responsibilities. Various groups have concluded that the public assigns independent accountants a greater responsibility for detecting and reporting fraud and financial misinformation than can be met. Many e-commerce consumers may not understand the limitations of WebTrust and may incorrectly assume the CPA behind the seal guarantees the quality of goods bought over the Internet. However, WebTrust’s purpose is to assist entities and their customers in assessing the risks of doing business electronically, according to the AICPA/CICA WebTrust Principles and Criteria for Business-to-Consumer Electronic Commerce. (Go to www.aicpa.org/webtrust/ index.htm.)

Financial statement users who suffer investment or credit losses often seek reimbursement or indemnification from accountants. In fact, research indicates that demand for auditing services is partly explained by clients and users desire to have the accountant serve as de facto insurer if losses are sustained. (Several articles have noted this, including The Economic Role of the Audit in Free and Regulated Markets: A Review, by W. Wallace, Research in Accounting Regulation , 1987, 1:7-34.) The accountant is deemed a deep pocket, as the CPA firm often carries malpractice insurance or is, in many cases, the only solvent defendant in a lawsuit.

It is not hard to imagine several scenarios in which consumers are defrauded in an e-commerce transaction and feel they have no recourse. In such situations, it’s easy to see how a disgruntled customer might target the CPA WebTrust provider.

WEBTRUSTS LEGAL HERITAGE
So far, no legal case has directly addressed accountants liability to third parties (or nonclients) for disseminating misleading or false financial information over the Internet. Several cases exist, however, that may have bearing on accountants liability to third parties for computer-disseminated data. These cases serve as examples of what might happen should a WebTrust case ever make it to court. The good news is that such cases appear to reduce CPAs liability.

Precedents antedate not only the Internet but computers themselves. Jaillet v. Cashman (189 N.Y.S. 743 [Sup. Ct. 1921], affd, 194 N.Y.S. 947 [App. Div.]; affd 130 N.E. 714 [N.Y. 1923]) was decided by a New York State trial court in 1921. On March 8, 1920, Dow Jones & Co. reported incorrectly over its ticker service the effect of a U.S. Supreme Court decision on the taxable status of stock dividends as income. An investor saw the ticker report in his broker’s office and sold stocks in the belief that stock prices would drop. When the Dow Jones report was corrected, the market rose. The investor sued Dow Jones for negligently reporting the court case. The New York trial court dismissed the investor’s lawsuit, reasoning that as a matter of practical expediency the law did not impose a legal duty on Dow Jones toward every member of the community who could be misled by an incorrect report.

In 1987, a New York trial court faced the issue of the liability of a media company that disseminated incorrect financial data over an electronic network. Daniel v. Dow Jones & Co., Inc. (520 N.Y.S. 2d 334 [Civ. Ct. 1987]) involved Eldridge Daniel, a subscriber to the Dow Jones News Retrieval Service; the service provided instantaneous news transmission by computer-to-computer linkup. Daniel made an investment based on a report that Huskey Oil, a Canadian corporation, was restructuring. The news report omitted that the prices quoted were in Canadian, not U.S., dollars. Daniel lost money and sued Dow Jones for negligent misrepresentation.

The court dismissed Daniels claim, holding that as a matter of public policy the class of plaintiffs to whom Dow Jones could be liable must be carefully circumscribed to avoid the potential of unlimited liability. The court found no reason existed for treating a person who reads data on a computer screen differently from one who reads it on paper. The special relationship required to allow a claim for negligent misstatements did not exist between Daniel and Dow Jones. The relationship that did exist, in the eyes of the court, was that between the ordinary buyer and seller.

Significantly, the court also found that the First Amendment, freedom of the press, barred the negligence claim. Established law prohibits imposing liability on a media defendant for nondefamatory, negligently untruthful news. But the degree of First Amendment protection offered to WebTrust service providers who are nonmedia parties is uncertain and controversial.

According to attorneys Richard Miller and Michael Young in Financial Reporting and Risk Management in the 21st Century, in the April 1997 issue of the Fordham Law Review , the rule that can be distilled from the Jaillet and Daniel cases is that one who negligently disseminates false financial or other information over a public medium is immune from a negligence claim. The Jaillet rule has been applied to a newspaper, an investment newsletter and an interactive computer network. Miller and Young also point out that the Jaillet rule does not appear to be more or less valid based on the number of users. The rule has been applied when the number of subscribers was as few as 2,200.

WebTrust practitioners should note that the Jaillet rule also has been applied in a situation in which the user and disseminator of financial information had an explicit agreement. In First Equity Corp. v. Standard & Poors Corp. (869 F.2d 175 [2d Cir. 1989]), First Equity, an investment banking firm, entered into a one-year subscription agreement with S&P to receive Corporation Records , a loose-leaf publication summarizing the business operations and finances of many corporations. The publication did not make investment recommendations and included a disclaimer that S&P did not guarantee the accuracy and completeness of the information. First Equity and one of its clients, Robert Cornfeld, claimed losses in excess of $200,000 as a result of inaccurate information in Corporation Records about a redemption feature in certain trust notes. In dismissing the negligence claim against S&P, the Second Circuit Court of Appeals applied the Jaillet rule, finding the subscription agreement did not create a special relationship amounting to privity (a direct connection or contractual relationship) between First Equity and S&P.

Interestingly, the Second Circuit said its decision in First Equity was partially supported by New York case law regarding the liability of accountants for nondefamatory negligent misrepresentations. New York law has avoided exposing accountants to the potential liability represented by a large class of third-party users of negligently audited financial statements.

The key lesson for CPAs in WebTrust engagements is Miller and Young’s argument that consistent application of the legal rules involved in the Jaillet, Daniel and First Equity cases should, by inference, give accountants immunity from liability for negligence for information disseminated over the Internet. However, no court has applied Jaillet to an accountant providing assurance services over the Internet. The Jaillet rule also is not entirely consistent with the existing body of law on accountants’ liability for negligence to nonclients. Furthermore, the Jaillet rule does not protect against legal claims based on fraud or recklessness. CPAs also should remember that Jaillet may not be applied uniformly by all jurisdictions. WebTrust service providers must closely monitor legal developments.

HOME COURT ADVANTAGE
The Internet crosses international boundaries, and so do the legal issues surrounding WebTrust. Miller and Young point out that foreign nations usually can assert jurisdiction over nonresidents when the exercise of that jurisdiction is reasonable: You are regularly conducting business in a foreign country; engaging in an activity outside the foreign country that has a substantial, direct and foreseeable effect within that particular country; or performing an activity owned, possessed or used in the foreign country that is the subject of court action. Conceivably, a court in another country could deem it reasonable to exercise jurisdiction over a U.S. accounting firm that provided a WebTrust seal of assurance for an e-commerce transaction involving one of its citizens.

Once a WebTrust service provider becomes subject to the power of a foreign court, the question is what country’s law applies to the transaction in dispute. Miller and Young say a foreign court may apply U.S. law or local law. Suffice it to say that a foreign court would have significant leeway in deciding which body of law to apply to a U.S. accounting firm that has disseminated false or misleading information over the Internet. Being subjected to the application of another country’s laws in that nation’s courts, however, might not pose as much risk to a U.S. firm as U.S. law would in a domestic court.

Miller and Young indicate that various procedural aspects of foreign law may render a foreign court more hospitable than a U.S. court to a CPA WebTrust service provider:

• In general, class-action lawsuits may not be filed under the laws of other countries. This is a significant procedural deterrent to a group of aggrieved consumers, each of whom may have lost a modest sum of money.
• Most countries do not permit contingency fees; anyone who seeks to file a legal claim against a party must pay the lawyer out-of-pocket as a case progresses.
• Many countries follow the English rule for payment of attorneys’ fees, the loser must pay the winners fees as well as his own, which discourages frivolous lawsuits.

Miller and Young also point out that lawsuits against accountants outside the United States do not offer the prospect of large jury awards, because most foreign jurisdictions do not permit either jury trials or punitive damage awards. The WebTrust service provider should keep in mind, however, that foreign laws can change just as U.S. laws do.

Which third parties or nonclients in a foreign nation have the right to sue a WebTrust service provider? It is far from clear. Miller and Young say that foreign law covering accountants’ liability to nonclients for negligence is not as well developed as U.S. law. Even if a consumer in a foreign country obtains a judgment against a U.S. firm, it often must be enforced through a proceeding in a U.S. court, increasing the burden on a foreign consumer suing in a foreign jurisdiction.

LOOK BEFORE YOU LEAP
As suggested by the AICPA’s litigation risk model for assurance services (AICPA Assurance Service Liability , www.aicpa.org/assurance/scas/majtheme/svcliab/ index.htm), the first step WebTrust providers should take is to determine whether to perform the assurance service at all.

Firm partners should consider the impact of the WebTrust engagement on the firms overall litigation risk exposure. The firm first must have a good grasp of the risk posed by the services it already offers. Firms can obtain this understanding by following these steps for each service:

1. Identify all the risks, what parties can sue the CPA in a particular engagement on what legal grounds.
2. Look at risk factors such as the client’s financial condition.
3. Quantify risk. Estimate potential monetary damages.
4. Evaluate the risks and rewards of offering a service.

A CPA is not required to perform the WebTrust service for every business that requests it. The importance of the decision to accept a new WebTrust client or continue to offer the service to an existing client is reflected in the inclusion of acceptance and continuance of clients as one of the five quality control elements for CPA firms (AICPA Statement on Quality Control Standards no. 2, System of Quality Control for a CPA Firms Accounting and Auditing Practice [QC section 20.14-.16]). The steps involved in the WebTrust engagement evaluation process include (1) evaluating the integrity of management, (2) identifying special circumstances and unusual risks, (3) assessing the firms competencies to perform the WebTrust engagement, (4) evaluating independence, (5) determining the CPAs ability to use due care and (6) preparing an engagement letter.

Most, if not all, CPA firms enter into engagement agreements with audit clients (as recommended in SAS no. 83, Establishing an Understanding With the Client ). A firm should make a comparable arrangement with a WebTrust client. Engagement letters are required by the WebTrust license agreement and may contain numerous provisions.

Another litigation-risk-control device is cautionary language to warn the reader about limitations regarding the scope of information certified in a WebTrust engagement. Cautionary wording is crucial to preclude e-commerce consumers from believing that a CPA WebTrust provider guarantees the quality of goods purchased, the prices quoted or delivery times posted on a Web site or the integrity of future transactions. The WebTrust seal denotes only that a CPA (1) has evaluated the Web site owners business practices and controls to determine whether they conform to the WebTrust Principles and Criteria for Business-to-Consumer Electronic Commerce and (2) has issued an assurance services report with an unqualified opinion. Cautionary language should be displayed on the clients business Web site or in the WebTrust assurance report. If the CPA WebTrust provider contemplates the use of cautionary language, he or she should also consider its effect on the salability and pricing of the WebTrust assurance service. Cautionary language that is too strong or prominently displayed may scare off both potential clients and potential customers visiting clients Web sites. CPAs should develop any cautionary language used in WebTrust engagement letters or in online sign-up procedures in consultation with legal counsel. Some cautionary language is actually required in the CPAs report.

Another option is to include an alternative dispute resolution (ADR) provision in the engagement letter. ADR refers primarily to arbitration (in which the decision of a third party is binding) and mediation (in which a third party assists in reaching a settlement). ADR is aimed only at disputes with clients, not third parties. Primary benefits of ADR are avoidance of uncertainties (for example, deciding in which venue a dispute will be heard), delays and the expense of the judicial system. A disadvantage of ADR is that its low cost may encourage grievances by clients who would not otherwise commence litigation. ADR does have its limitations, so the WebTrust practitioner should consult legal counsel before using an ADR clause. CPAs should check their insurance: Some professional liability insurance policies limit use of ADR.

FOREWARNED IS FOREARMED
The potential for liability should not deter CPAs from adding WebTrust or other assurance services to their practices. Public accounting practice has always had litigation issues; new services merely mean that the level of risk is still unknown. Fortunately, the results of past court cases give reason for encouragement: It appears that one who is accused of negligently disseminating misleading or false information over a public medium will be immune from liability. Although the legal environment is in flux, any CPA with the skill, background and knowledge of the issues can jump into this new service with confidence.