SysTrust and third-party risk
Carl Pacini, Stephen E. Ludwig, William Hillison, David H. Sinason, Leslee N. Higgins · Digital Commons - University of South Florida (University of South Florida) · 2000
How is your state likely to treat a third-party lawsuit after a SysTrust engagement? Although corporate information systems have progressed exponentially in the past 100 years, some things have not changed: CPAs are still associated with the information; corporate systems are still subject to failure and even criminal attacks; and concerns about lawsuits from third parties continue to dog the profession. And the launch of the SysTrust assurance service (Reporting on Systems Reliability, JofA, Nov. 99, page 75), which allows a CPA to report on the availability, security, integrity and maintainability of a system, has tied CPAs more closely than ever to such systems--and legal liability for their failure. Nevertheless, CPAs who understand some legal basics can provide this new assurance service in confidence. Increased reliance on information systems has led to some spectacular disasters involving astronomical sums: Hackers shut down Yahoo! and eBay with denial-of-service attacks and E-Trade lost $2.5 billion in market value when its system crashed. Procter & Gamble discovered problems with its new SourceOne global database system that led to many wasted hours as employees rechecked the accuracy of quarterly financial reports. And how close to disaster were ToysRUs.com and Amazon.com when both sites crashed in November 1999 because their systems were not able to handle the volume of users? Clearly, the liability risk could be huge from nonclients (individuals or entities), the third parties that rely on SysTrust assurance reports. But CPAs can protect themselves by understanding the legal precedents that could come into play with this new service and the various laws that apply in different jurisdictions. A look at some litigation history should clarify the applicable law and strategies that can minimize litigation risk. DEEP POCKETS, WIDE GAPS Accounting and assurance services traditionally have carried litigation risk for CPAs. As perceived guarantors of financial statement accuracy, auditors have long been targets of disappointed shareholders or creditors--third parties that view them as having deep pockets. The introduction of any new assurance service may involve even greater risks. For example, the still-new technological aspects of SysTrust make some litigation issues even more complex than those for traditional engagements. As early as 1996, SEC Commissioner Steven Wallman predicted how the evolution of information technology would affect accountants, causing a shift away from substance toward attestation. For accountants, process attestation means providing assurance about the reliability of the system a client employs rather than about the integrity of the business information that system produces. In the world Wallman described, an unqualified SysTrust assurance report could provide many parties with confidence about the reliability of a system. Thus, the potential liability for assurance providers is considerable, given that shareholders, customers, suppliers, employees, creditors and other stakeholders all depend on systems in processing business transactions. SysTrust, like other services, also faces an expectation gap--the difference between the public's perception of the scope of an independent accountant's responsibilities and his or her actual responsibilities. Parties that rely on a SysTrust report may incorrectly assume the practitioner guarantees the operation, security and accuracy of a company information system. Even though SysTrust's stated purpose is to increase the comfort of management and other stakeholders, it is likely that users will not fully understand there are limitations. PRESENT LAW The courts have not yet addressed this expectation gap. SysTrust is so new that no legal case has directly addressed accountants' liability to third parties. For now accountants can assume the courts will apply the common and statutory law that pertains to accountant liability for negligent audits. …