Data Security Risk: You Can Take It Anywhere
It has been said that with great power comes great responsibility. Mobile devices and cloud computing empower CPAs to work on an anytime, anywhere basis, but increased access demands greater responsibility for data security. A CPA's obligation to protect client confidential data is not only governed by the AICPA Code of Professional Conduct and Internal Revenue Code Sec. 7216, but also by the patchwork of federal and state statutes and regulations that govern data security. This obligation is the same regardless of how or where the data is stored or transmitted. A breach of client confidential data poses various risks, including professional liability exposure if that information is used maliciously and damages are incurred. Risk also arises related to mandatory compliance with applicable federal and state breach notification statutes and regulations. Moreover, reputational and other harm may ensue from the failure to protect client information. CPAs' growing use of mobile devices to conduct business increases the number of potential data leakage points. Additionally, apps have become a prime avenue for hackers to gain access to mobile devices. All of these factors contribute to an increased likelihood of improper data disclosure. More data to protect, more data security laws with which to comply, and more ways data can be released or compromised--what's a CPA firm to do? As technology advances at lightning speed, the challenge to secure data may seem daunting. Prohibiting the use of mobile devices is not a practical option. While no security program or security software can guarantee that data will never be lost or stolen, application of a few basic principles can help address mobile security risks and mitigate professional liability exposure. Understand the firm's data security risk profile. The use of mobile devices creates additional opportunities for data to be lost or stolen. Review how the firm receives, uses, and maintains data, including how and where data is stored, the kind of data transmitted to and from mobile devices, and the practices that may place your firm at higher risk for data leakage and loss. For example, does the firm permit the use of unencrypted flash drives? * Rethink data needs. Before accepting confidential data from a client, determine if there is a business need for collecting the data. Could you perform the professional services in accordance with the engagement agreement without receiving the data? CPAs should be mindful of their responsibility to protect client data when they request information from clients or access client systems. Having access to data that is not truly necessary increases the CPA's professional liability risk. By limiting the type of information it receives from its clients, the firm can reduce the need to protect and secure such information. * Decide what type of mobile program fits the firm best. Will firm-owned devices be provided to your partners and employees, or will they provide their own devices as part of a bring-your-own-device (BYOD) program? Each program has risks and benefits. When the firm provides the device, it has more control over its use and security. A BYOD program might be less expensive, but it is less secure and may result in situations where employees have two of each device--one for work and one for personal use. Some features will be the same for both programs, but others will be different. Firms should decide which programs best fit their budget and address their cultural and security needs. * Take mobile security seriously. Do not allow partners and employees to use any device they wish, with programs they select, and believe that these devices are secure if they have a password. …