The Law and CPA WebTrust
Afraid of WebTrust liability issues? Listen to the facts, not rumors. Internet fraud may not soon be a staple of TV crime shows such as Law and Order and NYPD Blue, but that doesn't mean CPAs should wait until there's drama to take a look at the legal ramifications of WebTrust. If a problem requiring court intervention arises in an e-commerce case involving a WebTrust engagement, what are a CPA's liabilities? What legal precedents come into play with this new assurance service? The law ultimately will evolve with regard to assurances linked to electronic commerce, but for now the well-prepared CPA will want to know precedents and strategies that can minimize litigation risk. CPAs should not be needlessly frightened away from WebTrust because of this risk; increased awareness, not fear, is the answer. Development and deployment of any new CPA assurance service and, indeed, many accounting services, carry some litigation risk. Perceived as guarantors of financial statement accuracy, CPAs often are targets in lawsuits filed by aggrieved shareholders or creditors who see accountants or their malpractice insurers as "deep pockets." Technological aspects of WebTrust make some litigation issues even more complex than in standard engagements. In December 1996--before the AICPA unveiled WebTrust--SEC Commissioner Steven Wallman commented on how the evolution of financial information technology would affect accountants, predicting it would cause a shift away from "substance attestation" toward "process attestation." For accountants, process attestation means providing assurance about the integrity or reliability of the system a client employs rather than about the integrity of the business information that system produces. In the world Wallman described, the potential liability of assurance service providers is staggering given that virtually any computer user--anywhere in the world--can access a business Web site that displays a WebTrust seal. The accountant's potential liability exposure is global, since the Internet knows no borders. Given the potential exposure, CPAs must become familiar with the litigation-risk issues before they initiate WebTrust engagements. THE EXPECTATION GAP WebTrust liability does not exist in a vacuum. For the past several decades, the accounting profession has faced an "expectation gap"--the difference between the public's perception of the scope of an independent accountant's responsibilities and his or her actual responsibilities. Various groups have concluded that the public assigns independent accountants a greater responsibility for detecting and reporting fraud and financial misinformation than can be met. Many e-commerce consumers may not understand the limitations of WebTrust and may incorrectly assume the CPA behind the seal guarantees the quality of goods bought over the Internet. However, WebTrust's purpose is to "assist entities and their customers in assessing the risks of doing business electronically," according to the AICPA/CICA WebTrust Principles and Criteria for Business-to-Consumer Electronic Commerce. (Go to www.aicpa.org/webtrust/index.htm.) Financial statement users who suffer investment or credit losses often seek reimbursement or indemnification from accountants. In fact, research indicates that demand for auditing services is partly explained by clients' and users' desire to have the accountant serve as de facto insurer if losses are sustained. (Several articles have noted this, including "The Economic Role of the Audit in Free and Regulated Markets: A Review," by W Wallace, Research in Accounting Regulation, 1987, 1:7-34.) The accountant is deemed a "deep pocket," as the CPA firm often carries malpractice insurance or is, in many cases, the only solvent defendant in a lawsuit. It is not hard to imagine several scenarios in which consumers are defrauded in an e-commerce transaction and feel they have no recourse. …