Reporting on Systems Reliability

n today’s increasingly interconnected economy, one company’s glitch on Monday can be another’s bad headline on Tuesday. It’s not just a company’s own systems that need to be reliable; the systems of suppliers, business partners and customers must also be dependable. In the drive to find new markets, reduce costs and provide better customer service, companies rely on each other’s systems through outsourcing, partnerships and joint ventures. In response to concerns about unreliable systems, the AICPA and the Canadian Institute of Chartered Accountants jointly developed a new assurance service—SysTrust ^SM— to provide assurance that a system is, in fact, reliable.

In a SysTrust engagement, accountants report on the availability, security, integrity and maintainability of a system. A SysTrust engagement includes a system description that delineates the boundaries of the system covered by the engagement, management’s assertion about the system’s underlying controls and an attestation report by a CPA that evaluates the system against specific criteria. To earn an unqualified opinion, a system must meet all of the SysTrust principles and criteria. (See exhibit 1 for more details.)

A “system” is an infrastructure of hardware, software, people, procedures and data that—together in a business context—produces information. See exhibit 2 for clarification of these terms. A system may be as simple as a personal computerbased payroll application with a single user. Or it may be as complex as a multiapplication, multicomputer banking system accessed by virtually an unlimited number of users inside and outside the entity.

THE RELIABILITY FRAMEWORK

To describe the framework, the systems-reliability task force, a joint venture of the AICPA assurance services executive committee and the CICA assurance services development board, compiled a set of principles and definitions that accountants will use as the basis for the service.

Unreliable systems will display some common symptoms:

• Frequent failures and crashes that deny internal and external users access to essential system services.
• Unauthorized access, making the system vulnerable to viruses, hackers and loss of data confidentiality.
• Loss of data integrity, including corrupted, incomplete and fictitious data.
• Serious maintenance problems resulting in unintended negative side effects from system changes, such as loss of access to system services, loss of data confidentiality or loss of integrity.

A reliable system is one that operates without material error, fault or failure during a specified time in a specified environment. The four essential principles underlying such systems are

1. Availability. The system is available for operation and use at times set forth in service agreements.

2. Security. The system is protected against unauthorized physical and logical access. (Logical access is the ability to read or manipulate data through remote access.)

3. Integrity. System processing is complete, accurate, timely and in accordance with the entity’s transaction approval and output distribution policy.

4. Maintainability. The system can be updated in a manner that provides continuous availability, security and integrity.

For each principle, criteria enable a practitioner to determine if an entity’s system met it. The criteria are organized into three categories:

1. Communications. The entity has defined and communicated performance objectives, policies and standards for system availability, security, integrity and maintainability.

2. Procedures. The entity uses procedures, people, software, data and infrastructure to achieve system availability, security, integrity and maintainability objectives in accordance with established policies and standards.

3. Monitoring. The entity monitors the system and takes action to achieve compliance with system availability, security, integrity and maintainability objectives, policies and standards.

A system must satisfy all of the SysTrust criteria to be deemed reliable. To obtain evidence that criteria have been met, a practitioner examines the controls related to the criteria. The SysTrust guidance materials provide practitioners with several illustrative controls related to each criterion.

RULES TO FOLLOW

In the United States a SysTrust engagement is performed under AICPA Statement on Standards for Attestation Engagements no. 1, Attestation Standards. In Canada the engagement is performed under CICA standards for assurance engagements, found in the CICA Handbook. AICPA and CICA professional standards specify that an independent, objective, knowledgeable practitioner will perform tests of management’s assertion or of the subject matter to which the assertion relates. A practitioner will gather evidence about the assertion’s conformity with the criteria in the same way he or she would in other examination-level engagements: by inspection, observation, inquiry, confirmation, computation and analysis to verify that the criteria have been met. The practitioner then expresses an opinion on management’s assertion or on the subject matter to which it relates.

How does a SysTrust engagement differ from existing services, such as a service auditor’s engagement performed under SAS no. 70, Service Organizations (in the United States), and S 5900, “Opinions on Control Procedures at Service Organizations” (in Canada)? SAS no. 70 applies when an auditor audits the financial statements of an entity that obtains services from another organization (a service organization). It is designed to provide information and assurance to the auditor of the user organization about controls at the service organization that may affect the user organization’s financial statements. A SysTrust engagement is designed to provide report-users with assurance about whether the entity has maintained effective controls over the reliability of a system. In a SysTrust engagement, users will not receive a detailed description of the system, the procedures the practitioner performs and the results of those procedures—as they would in a service auditor’s engagement.

Readers also may wonder about the differences between the SysTrust service and two other assurance services—WebTrust and ISPTrust (a new assurance service being developed by the electronic commerce task force that will evaluate Internet service providers). There are differences in both the nature of the systems being addressed and the nature of the assurance being provided. Both WebTrust ^SM and ISPTrust ^SM focus only on Internet-based systems; SysTrust applies to numerous types of systems. And while WebTrust and ISPTrust focus primarily on controls over Internet-based transactions, SysTrust focuses specifically on the reliability of systems themselves. Although it is possible to have a qualified SysTrust report, this possibility does not exist for a WebTrust report.

THE NEED FOR STANDARDIZED ASSURANCE

How can an unqualified SysTrust report (see exhibit 3) benefit today’s competitive business world? An unqualified report can provide many parties with confidence about the reliability of systems they use in e-commerce or for which they pay user fees. Management and the board of directors can gain more confidence in their own internal systems by making sure they are subject to appropriate controls. This enables an entity to differentiate itself from competitors who cannot provide the same assurance. Internal auditors and system owners can use the framework to guide them in developing and implementing a reliable system within an entity. These services can lower costs, help avert systems-development rework and prevent loss of reputation or market share due to unreliable systems.

System integrators, vendors and those who do outsourcing can engage a practitioner to provide assurance about the reliability of the systems and services they provide to their customers. In turn, system builders and consultants can use the framework to design reliable systems. Finally, a SysTrust report on system reliability can increase business partners’ confidence in each other’s systems.

Consider the following scenarios.

Scenario 1. Acme Co. is competing to win business as a supplier to Fisbees Department Store, a major retailer which has a just-in-time inventory system that depends on its suppliers. Acme can differentiate itself from its competitors with a SysTrust report on its systems. Fisbees also can require all its major suppliers to provide periodic SysTrust reports.

Scenario 2. Acme decides to outsource its employee-care systems (human resources, payroll, benefits). As part of its request for proposal, it specifies that the successful bidder must maintain an unqualified SysTrust report on its outsourced systems.

Scenario 3. With the heightened awareness that post-Y2K systems may be subject to various reliability issues, companies with dependable systems need to differentiate themselves in the marketplace to preserve shareholder value. Both Fisbees and Acme commission SysTrust reports to assure the reliability of their systems.

Scenario 4. An insurer is asked to provide Fisbees with business interruption coverage. Before writing the coverage, the insurer asks Fisbees to provide a SysTrust report on its inventory management system.

Scenario 5. Fisbees Department Store publishes sales information on its Web site. External stakeholders voice concern about the reliability of the information being disseminated. A regulator requires a periodic report on the system that furnishes financial information to the entity’s Web site.

Scenario 6. Fisbees is divesting itself of a subsidiary. To increase buyer interest, ensure top price and reduce buyers’ due diligence procedures, it commissions a SysTrust report on the subsidiary’s systems.

These and other scenarios suggest ways a SysTrust report can benefit both internal and external stakeholders of entities engaged in commercial activity that relies on key information systems.

To support effective and consistent use of SysTrust reporting, the systems-reliability task force is developing several training courses (see exhibit 4, below). In addition, it is putting together a competency model illustrating the skills needed to perform a SysTrust engagement, as well as practice aids including model workplans, engagement letters and checklists of controls.

REQUIRED COMPETENCIES

To perform a SysTrust engagement, practitioners should have a number of competencies, including information technology (IT)-related skills. However, the degree of IT sophistication will depend on the nature of the system the CPA is examining. Many practitioners already have most of the essential skills needed to conduct an effective evaluation of internal control. With modest additional training, practitioners can enhance these skills to enable those with internal control evaluation skills to provide valuable SysTrust services to their clients.

Some aspects of a SysTrust engagement may require more specialized IT skills. Those skills can be brought to bear on an examination as needed—they are not required for the entire engagement. Thus, with effective teamwork and skills management, practitioners can combine their talents with those of colleagues who are IT specialists to provide SysTrust services.

THE NEXT STEPS

For the immediate future, the systems-reliability task force will work on building awareness and acceptance of this new assurance service among practitioners and the business community—including management, boards of directors, system developers, outsourcers and internal auditors. It will seek to demonstrate the value of SysTrust to both industry and practice. For practitioners, SysTrust represents potentially significant engagements they can leverage into opportunities to provide other services such as security profiling and design, application controls consulting and privacy consulting.

Will a SysTrust report prevent the situations headlined at the start of this article? By itself, no. What SysTrust will do is reduce the risk that such situations will occur and provide a common level of assurance that management has taken prudent steps to address reliability and to implement a balanced set of controls that operate effectively. The SysTrust principles and criteria are a rigorous test of system reliability from which business partners, customers and regulators can take comfort.