Get the fox out of the hen house: CPAs have the right skills to perform IT risk assessments for clients. (2003 Technology & Business Resource Guide: Risk Assessment).

It's hard to go through a day without hearing about the increasing number of security risks that threaten our information systems--and the biggest risk to a ii company's information is its employees.

The Association of Certified Fraud Examiners estimates that more than 75 percent of crimes against a business originate from inside the company. The fastest-growing fraud activity is theft or damage of electronically stored data.

So what's at risk? Virtually all accounting records, customer data, credit card information, trade secrets and any other information stored on a computer. Firewalls, virus protection or even locks don't protect against internal risks because company employees--armed with knowledge and access to a company's information system-are already past the main gate. The fox is in the hen house.

Before computers, information risk was easier to evaluate. Internal controls focused on the segregation of duties and procedures that applied checks and balances to the management of a company's assets. But the enormous volume of digitally stored data adds a new dimension to the information risk equation.

If appropriate safeguards are not in place, employees can copy, modify or destroy data without detection. The Internet adds yet another risk: unauthorized access to data from virtually anywhere. The books are no longer locked in the corporate tower.

A CLOSE LOOK

An information technology risk assessment identifies critical data, access paths to that data and employees who may have or do have access to that data. It also examines a system's integrity, reliability, ownership and system documentation. It reviews the company's disaster recovery and business continuity plans; evaluates employee policies and procedures; and tests the internal control structure.

Now, a tech person can attach a laptop to a client's domain, extract passwords and log files, security rights and other data, but may not be qualified to perform an internal control risk evaluation. This is where a CPAs training in evaluating internal control comes into play. It takes a CPA's understanding of the client's business environment, materiality and strategic thinking to evaluate the control risks.

Adding information risk assessments to the CPA's bag of tricks is not that difficult. There is a group of specialists--certified information technology professionals--who are designated by the AICPA and trained to provide this service. Many professional staff members have the tech skills needed to embrace this new service. They are only waiting for forward-thinking CPA firms to embrace the concept.

ASSESSMENT GUIDELINES 

Basic components of an information risk assessment include understanding the business environment; building an assessment program; taking inventory of key elements and assigning risk factors; evaluating each component and related controls; analyzing the findings; and presenting a report. These are nothing new to a CPA.

Key components of a review include network hardware; system file servers; workstations and terminals; applications; data files; and databases. Each component is then evaluated for its availability, security and integrity.

A matrix of users, components and accessibility becomes a center point of an information risk assessment. The user matrix shows who has security rights at the operating system level, application level and database level. It identifies risk areas where a weak password--such as administrative rights granted to someone who does not have an extra secure password or the password is not changed regularly--may allow for potential breaches in the information system.

If CPAs stop at this point of the risk assessment, they can render an impartial opinion on the condition of the IT system. It may be natural to go the next step and provide recommendations on how to improve the system, but this would step into the realm of consulting where independence may be impaired.

CLIENT BENEFITS

Even if an IT risk assessment stops short of making recommendations, the client has received various benefits, including identifying conditions for inherent risk of loss, corruption, incompleteness, theft or misappropriation of critical information; providing the first step in building walls of defense around its critical information; documenting its IT infrastructure; providing the foundation for a disaster recovery and business continuity plan; and aiding in the performance evaluation of the technical support personnel.

Historically, local and regional CPA firms have not evaluated internal control risks inherent in their clients' information systems, but the leading CPA firms of the 21st century will be evaluating their clients' information systems, along with their financial statements.

Are you ready for the 21st century?

Larry Russell, CPA, CITP, is with Los Angeles-based Accoun Tec. You can reach him at [e-mail].