Survey spotlights need for data and security strategies

On the surface, the results of the 2013 North America Top Technology Initiatives survey show that “managing and retaining data” nudged past “securing the IT environment” to become the top technology priority cited by the nearly 2,000 accounting professionals polled.

Dig a little deeper, and the evidence indicates that the emphasis on data stems at least in part from concerns about the increased security risks caused by the proliferation of mobile devices and the mass movement of confidential information to the cloud. Add to those factors the explosive growth in the amount of data worldwide and the rapid rise in the number and sophistication of cyberthreats to the security of that data, and the result is a situation ripe for security breaches. It’s no wonder then that the survey found increased concern with the prevention and response to computer fraud and decreased confidence among CPAs in the ability of their organizations to achieve success with their top tech initiatives. 

“The challenge is to identify where data resides and moves during the data cycle,” said Steven J. Ursillo Jr., CPA/CITP, CGMA, principal and director of technology and assurance services for Sparrow, Johnson & Ursillo, a Rhode Island-based accounting firm that also provides technology and security audits and consulting. “It’s very challenging to govern all of that.”

This article looks at the results of the 2013 North America TTI survey and the implications for public accounting firms, businesses, and other organizations.

The Survey: U.S. vs. Canada

The 2013 North America TTI survey was a joint effort of the AICPA and the Chartered Professional Accountants of Canada (CPA Canada). In the United States, the AICPA surveyed nearly 1,700 of its members from Feb. 12 through March 6. In Canada, CPA Canada surveyed more than 200 of its members from Feb. 14 through March 5 (for more, see the sidebar “Survey Demographics,” below).

Asked to prioritize the importance of their employers’ and clients’ 2013 technology initiatives, the U.S. CPAs and their Canadian counterparts responded with the same top two answers: managing and retaining data; and securing the IT environment (see Exhibit 1).

There were some notable differences between the U.S. and Canadian respondents. The poll found that the Canadian chartered accountants placed more emphasis than U.S. CPAs on using technology to enable decision support and analytics and on managing their IT investments and spending. The U.S. respondents gave greater weight to managing IT risks, ensuring privacy, and, most notably, preventing and responding to computer fraud.

CPA Confidence Slips

The U.S. CPAs surveyed were less confident than their Canadian counterparts of the ability of their organizations to achieve their top technology initiatives this year (see Exhibit 2). The CPAs also were less confident than respondents were a year ago, when securing the IT environment ranked as the top concern in the U.S.-only Top Technology Initiatives survey (see Exhibit 3). Last year, 60% or more of U.S. respondents said they were confident or highly confident that their organizations would prevent and respond to fraud; successfully manage and retain data (61%); secure the IT environment (62%); ensure privacy (62%); and manage IT risk and compliance (65%).

This year, the highest level of confidence was 55% (for managing and retaining data). Why did the U.S. confidence levels drop?

“My gut feeling is that there is actually more awareness of the issues and challenges in all of these areas as a whole,” said Donny Shimamoto, CPA/CITP, CGMA, managing director of IntrapriseTechKnowlogies LLC, and chair of the AICPA Information Management and Technology Assurance Executive Committee. “The decline in confidence levels may mean professionals are making more knowledgeable assessments of the ability of organizations to achieve technology goals. These goals are within reach, but organizations must have the focus, commitment, and drive to achieve them.”

Data management and information security are the only two initiatives to produce confidence ratings higher than 50% in the U.S. survey, but a look at the responses to individual questions reveals wide differences in opinion. On the positive side, CPAs exude confidence in their organizations’ data retention, cost management, and data backup and restoration policies. Similarly, most CPAs are confident in their organization’s policies and protections for internal networks and servers.

The confidence level plunges once outside the firewall. Only a third of U.S. respondents are confident or highly confident that their organizations have properly protected all mobile devices (laptops, tablets, mobile phones, etc.) to prevent a data breach. Similarly, only 33% of U.S. respondents have confidence in their organizations’ ability to quickly detect and respond to a cyberattack, and less than 40% believe their employers have “considered all of the relevant vulnerabilities and threats pertaining to IT, including those related to emerging technologies like cloud computing, mobile technologies, and social media.”

The CPAs’ concerns are understandable. News of successful cyberattacks on companies and government agencies worldwide, including several cloud-computing providers, has increased dramatically over the past couple of years. Cybercriminals have leveraged an intimate knowledge of data flow and a slew of sophisticated malware-building techniques to design attacks that have compromised data in myriad ways, including the theft of money through falsified automated clearing house (ACH) and wire transactions and the delivery of malware to social networks, where a variety of viruses can infect employee computers, then gain access to corporate networks and even cloud-based confidential data.

“Years ago, nine out of 10 corporate frauds were inside jobs,” Ursillo said. “The big theme we are starting to see carried out is that it’s when you are going to be attacked, not if.”

The Data Dilemma

The front lines in the war against cybercrime have moved to the cloud, because that’s where most of the world’s data is. And it’s data that creates incentives for security threats, said Dan Schroeder, CPA/CITP, a partner with Atlanta-based accounting and consulting firm Habif, Arogeti & Wynne.

“In its most simplistic sense, security threats exist because data exists, is accessible, and has value,” Schroeder said. “So, no data, no security problem.”

Of course, no data is not an option. Instead, the amount of data is growing at a 60% annual clip, a pace projected to continue for several years, Schroeder said.

That growth makes it imperative that public accounting firms, businesses, and other organizations know where their data and their clients’ or customers’ data is stored, moved, and processed. This can be easier said than done when using cloud-based software, infrastructure, and/or computing platforms. Such subscription-based services can offer anytime, anywhere connectivity, and access to clients and technology resources previously out of reach due to geographic and cost barriers. The downside is that organizations that leverage the power of the cloud must also manage their data in the labyrinth of servers and networks, providers, and threats that make up the internet.

“Very few businesses have formalized data management practices commensurate with their data assets,” Schroeder said. “For that matter, very few think of data as an asset.”

CPAs and their organizations need to understand that not all data is of equal value and that trying to provide equal protection to all of an organization’s data is prohibitively costly or ineffective, or both, Schroeder said. “There is an adage that if you protect toothbrushes and diamonds the same, at the end of the day you will have more toothbrushes and fewer diamonds,” he said. “Businesses need to understand which of their data is like toothbrushes and which is like diamonds, and apply security controls commensurately.”

The Big Asset Challenge

Data is generated by sources as diverse as websites and social media networks, emails and texts, voice and video files, and innumerable business transactions and processes. The development of faster computer processors and software applications has made it possible for organizations to aggregate and analyze large amounts of data, or big data, to uncover patterns and other insights that can help drive better, and quicker, business decisions.

The proper mining and application of data, big and small, can create great value for organizations, but only if they know how to manage it. Organizations that implement strong data management policies can leverage data to increase productivity, control costs, or improve the effectiveness of their marketing and sales efforts. Failure to handle data correctly can lead to poor business decisions based on bad or incomplete information, the loss of crucial information due to security breaches or improper storage, or even regulatory or legal problems.

To mitigate those risks, organizations need to develop a strategic plan to ensure that they meet internal, legal, and compliance-related requirements for data retention and usage. Organizations also need to vet vendors and their own security procedures to provide as much protection as possible to their confidential corporate and customer information.

Conclusion

The results of the 2013 North America Top Technology Initiatives survey show that U.S. and Canadian accounting professionals recognize the importance of data management and security efforts with their employers and clients. The U.S. results show that CPAs are aware that their organizations might not be as prepared as they had thought to protect their far-flung data and mobile assets in a rapidly expanding galaxy of cyberthreats and criminal activity.

Organizations that employ best practices for data management and security can lower their risk of a data breach but by no means eliminate it. Given that reality, organizations need to implement cyberattack detection and response procedures that fulfill all regulatory, legal, and competitive obligations for the stewardship of confidential customer information. Those public accounting firms, businesses, and other entities that can minimize data and security risks while maximizing the value of their data assets will have a competitive edge in the marketplace.  

Survey Demographics

U.S. Survey Participants
Of the U.S. survey participants, 36% are in public accounting and 36% are in business and industry. The remaining 28% are in consulting, government, not-for-profit, or other organizations. As to their positions in organizations, 20% of survey participants are in management positions in public accounting or business, while 38% indicate that their job responsibilities are those associated with a business executive or firm partner. A majority of participants said they “frequently” or “regularly” encounter information technology questions in their field of work.

Canadian Survey Participants
Among the Canadian respondents to the survey, about a fourth work in public accounting, slightly more than 40% in business and industry, 15% in government and the military, 10% in consulting and law, 6% in the nonprofit sector, and the rest in other areas. Most of the respondents are in management positions, and most said they “frequently” or “regularly” encounter information technology questions in their field of work.

EXECUTIVE SUMMARY

Managing and retaining data emerged as the top technology priority of the U.S. and Canadian accounting professionals polled in the 2013 North America Top Technology Initiatives survey. This marked the first year the AICPA and CPA Canada jointly conducted the survey.

Securing the IT environment slipped to No. 2 on the priority rankings, but security issues remain top of mind. Most of the accountants surveyed doubt the ability of their employers and clients to protect mobile devices and data outside of network firewalls and to detect and respond to a cyberattack.

The number and sophistication of cyberattacks are increasing as criminals target the rapidly increasing amount of data accessible via the internet and mobile devices. Organizations should view data as an asset and implement data management practices.

Data mining offers great potential for organizations, but only if they have the proper processes and policies in place.

U.S. CPAs are less confident than they were last year in the ability of their organizations to meet all the goals in their 2013 technology initiatives.

Jeff Drew is a JofA senior editor. To comment on this article or to suggest an idea for another article, contact him at jdrew@aicpa.org or 919-402-4056.

AICPA RESOURCES

JofA articles

• “From ‘Write-Up’ to Right Profitable,” April 2013, page 24
• “Tech Talk: What CPAs Need to Know,” April 2013, page 42
• “Managing Cybersecurity Risks,” Aug. 2012, page 44
• “CPAs Prioritize Tech Security,” May 2012, page 50

Publications

• Information Management and Technology Assurance (IMTA) Section’s A Practice Aid for Records Retention (PDF, free to IMTA members, tinyurl.com/cnv5cws)
• Private Companies Practice Section (PCPS) Quantum of Paperless Guide (PDF, available free to PCPS members, tinyurl.com/bdqunkg)

CPE self-study

• Complete Guide to the CITP Body of Knowledge (#733890)
• IT: Risks and Controls in Traditional and Emerging Environments (#733520)

Conference

Practitioners Symposium and Tech+ Conference in partnership with the Association for Accounting Marketing Summit, June 10–12, Las Vegas

For more information or to make a purchase or register, go to cpa2biz.com or call the Institute at 888-777-7077.

Information Management and Technology Assurance (IMTA) Section and CITP credential

In an effort to better recognize and support the breadth of its members’ professional duties and responsibilities, the AICPA has changed the name of the Information Technology Section to the Information Management and Technology Assurance (IMTA) Section. The IMTA division serves members of the IMTA Membership Section, CPAs who hold the Certified Information Technology Professional (CITP) credential, other AICPA members, and accounting professionals who want to maximize information technology to provide information management and/or technology assurance services to meet their clients’ or organization’s operational, compliance, and assurance needs. To learn about the IMTA division, visit aicpa.org/IMTA.