American Institute of CPAs Expands Privacy Solutions to Help CPAs Advise Businesses About Company-Wide Privacy Risks.

Business Editors

NEW YORK--(BUSINESS WIRE)--Feb. 25, 2002

The misuse of customer information poses a significant risk to business, as shown by a recent Harris Interactive study sponsored by the American Institute of Certified Public Accountants (AICPA) and Ernst & Young - 83% of consumers said they would stop doing business entirely with companies if they hear or read that a company misuses customer information.

Conversely, the poll also shows that companies with good privacy practices stand to gain customer loyalty - almost 50% of consumers said they would buy more frequently and in greater volume from businesses that establish strong, trustworthy privacy practices.

The AICPA has formed an Enterprise-Wide Privacy Task Force to develop comprehensive privacy best practices and solutions that help CPAs advise the organizations they serve on issues related to privacy, including the risks associated with not having a good privacy policy. These best practices are being developed by the AICPA to help businesses implement good privacy practices throughout their organizations and comply with a myriad of privacy laws and guidelines that currently exist.

"Privacy is a risk management issue for all businesses today, and many are looking to the CPA profession for privacy solutions that will not only help them manage risk but provide them with a framework against which they can be examined," said Anthony Pugliese, Vice President of Member Innovation at the AICPA. "The AICPA's role in this process is to develop best practices so that all businesses know not only how high the bar has been raised, but also to what benchmark they will be held by their customers, business partners and other stakeholders."

The privacy framework developed by the AICPA is designed to address enterprise-wide privacy needs for businesses and will incorporate the WebTrust online privacy best practices developed by the AICPA and the Canadian Institute of Chartered Accountants (CICA) in 1999. WebTrust Online Privacy was designed to help e-commerce businesses meet the online privacy needs of their customers.

"The patchwork of privacy regulations, laws and guidelines that companies must navigate today can be overwhelming," said Everett Johnson, CPA, Chairman of the AICPA Enterprise-Wide Privacy Task Force and Partner in the Enterprise Risk Services group with Deloitte & Touche LLP. "One of our goals is to help turn a regulatory burden into a marketing opportunity for companies by helping them manage risk and see the benefits of having good privacy practices."

Examples of significant privacy laws include the Gramm-Leach-Bliley Act for the financial services industry and HIPAA for the healthcare industry in the U.S., Canada's PIPEDA, the UK Data Protection Act and the European Union (EU) Data Protection Directive. Significant guidelines include the U.S. Department of Commerce's Safe Harbor Agreement and a framework from the Organisation for Economic Co-operation and Development (OECD).

The AICPA Enterprise-Wide Privacy Task Force is composed of members representing the accounting, legal and academic professions.

About the AICPA

The American Institute of Certified Public Accountants (AICPA) is the ISO 9001 certified national professional organization of CPAs in the United States with more than 340,000 members in public practice, business and industry, government and education. For more information about the AICPA, please visit www.aicpa.org . For more information about WebTrust, please visit www.webtrust.org .