Do You Have the Right Skillset to Curb Fraud?
How technology skills can help.August 4, 2011
by Ron Box, CPA, CFF
Any CPA who has been in the corporate world over the past 20 or more years has seen an enormous change in the way technology is used around us. For me, when I started in public practice, we had to go back to your office to return client calls and virtually no one had a personal computer on their desks. The effect of technology on our work has been seismic in nature. Now we use smartphones to make calls, send e-mails and even hold ad hoc video conferencing. Desktops, laptops and iPads among others give us access to an amazing amount of data that can be used to provide better service and make better decisions at lightning speed. The infrastructure behind all of this magic is based on local servers somewhere in your building or on cloud-based servers with the “tech” employees managing the back-office issues.
Have you considered how you, as a CPA, can take advantage of the technology that your business revolves around?
Most of us decided on certain career paths long ago within the scope of taxation, financial accounting, cost accounting, management or some variation of these basic alternatives. Those of us who did branch into technology usually did so by necessity or by an IT aptitude making you the “go to” person for the occasional technology problem.
Think for a moment, however, about the usefulness of information technology (IT) as a CPA skillset. This combination can create a bridge between the capabilities and limitations of an IT system providing the data that you use to create the financial information on which you base important financial decisions. Reflect on the security of the data that you use to produce decision material for senior management. Do you know the relevant questions to ask IT managers to attain an acceptable level of confidence that your data has not been corrupted, either intentionally or otherwise? Do you have a clear understanding about your IT compliance’s responsibilities (i.e. Sarbanes Oxley) and other information security and privacy regulations? Do you really want to rely on the IT manager to simply telling you it is being handled and not worry about it?
Why CPAs Should Have IT Skills
Many CPAs recognize skills such as risk assessment, fraud determination, general and internal controls, auditing techniques and information management to be essential — almost fundamental — to the performance of CPA-based work. These same skills can also form the basis of an IT skillset. Using the knowledge acquired over years, whether in public practice or in industry, can also provide greater insight into how technology can enhance quality CPA work.
For example, what are the risks associated with a material misstatement of financial statements? Obviously, today’s hi-tech environment cannot be limited to age-old schemes of misdirected funds or erroneous journal entries. We all depend on the accuracy, the confidentiality and the availability of data in our various computer systems in order to attest to financial statements without material misstatements or to produce data for management decisions that would not mislead due to corrupted information. This is information risk. Technology is a great enabler of fraud today.
Not surprisingly, a disgruntled employee knowing the internal vulnerabilities of a system or a clever outsider who can explore poorly configured firewalls can easily acquire access credentials thereby giving away the keys to the kingdom. These codes allow unscrupulous people to redirect bank wires or other automatic clearinghouse (ACH) funds movement. Such frauds can cost hundreds of thousands, even millions of dollars, in damages. Without sufficient insurance coverage, these types of losses can bankrupt an organization. Even the most knowledgeable and diligent IT manager would not necessarily have sufficient experience or knowledge in how fictitious accounting entries can be made or understand the electronic movement of large sums of cash around the world. In such situations, a CPA with the knowledge of how the accounting, finance, banking and IT systems all work together, however, can prove to be an invaluable asset.
Other Skillsets Overlapping CPAs and Technology
One of the most basic functions that a CPA must address is the creation of general controls to ensure the proper processing of transactions and accounting for assets. Most of us, when we begin our work in implementing controls for our organization, start with a computer-produced inventory list, materials on hand and cash, among others to gain an understanding of the extent of our issues. How often do you always verify every item on these computer reports and to what extent do you accept that the reports are correct? Do you have the skills to generate exception reports from out systems? How many of you can evaluate data to ensure (as much as possible) that the data is viable?
CPAs now have responsibilities to obtain SSAE 16 reports in auditing IT systems (formerly SAS 70 reports). Do you have the skills to judge whether an outside CPA is competent in rendering a quality SSAE 16 (PDF) report? Even the most common of CPA functions, i.e. providing management information and data analysis, can be a great opportunity if you understand how the data is acquired, processed and presented to senior staff. This type of competitive advantage can produce great dividends to the organization whose staff can bring this skillset onboard and certainly to the individual’s career that brings unique benefits to the table.
Adding Deep Technology Skillsets to Your Belt
Several years ago the AICPA established the Certified in Information Technology Professional (CITP) credential to differentiate CPAs who have a clear understanding of technology issues relevant to the accounting field. Two years ago, the CITP Body of Knowledge was revised to make it much more applicable to the current environment and reflect the evolving technology environment for which most CPAs should now be prepared.
Technology will certainly grow more complex and more ubiquitous. As CPAs, you will need to evolve to the next level in order to stay ahead of the technology curve. The CITP Body of Knowledge will continue to grow and evolve along with the needs of the CPA profession. Only CPAs can qualify for the CITP credential. The career opportunities for dedicated CITPs should continue to develop as more and more CFOs and firm managing partners realize how the designation can profitably differentiate an organization.
Ron Box, CPA.CITP, CFF, CISSP, is the chief financial officer and chief information officer for Joe Money Machinery, a Birmingham, AL.-based regional heavy construction distributor with operations in Georgia and Florida. Box also serves as chair for the 2010 AICPA Top Technology Task Force and is a member of the AICPA Certified Information Technology Professional (CITP) Credential Committee.