SaaS Offerings for CPA Firms
Written by Brian Tankersley CPA.CITP   
Wednesday, 15 July 2009 13:44

Deli.cio.us    Digg    reddit    Facebook    StumbleUpon    Newsvine

Software as a Service (SaaS) offerings for CPA firms have been slowly emerging from the shadows, and are now front and center for many categories. Although the risks of any solution should be understood and evaluated before deploying any solution in a production environment, many CPA firms do not understand how the points of potential failure associated with SaaS applications are fundamentally different than the typical points of failure associated with traditional, on-premises applications.

SaaS Markup
(Click Image to Enlarge)

Figure 1 – By confirming that a website is using HTTPS for secure web browsing and inspecting its third-party SSL encryption certificate, users can gain comfort that a service’s website is legitimate and that data is encrypted while being transmitted from the service provider to the end user. This example shows the digital certificate for the portal for CCH’s Global fx service.

In addition to payroll solutions made available on a subscription basis, there are many other examples offerings for accountants in public practice, including:

  • Global fx, Intelliconnect, and Accounting Research Manager from CCH, a Wolters Kluwer business,

  • Virtual Office CS, the Enterprise Suite, and RIA Checkpoint from Thomson Reuters Tax & Accounting,

  • GruntWorx and GruntWorx Pro from Copanion,

  • QuickBooks Online from Intuit,

  • Intacct’s on demand financial system,

  • Hosted Customer Relationship Management offerings such as Dynamics CRM on Demand from Microsoft and SaaS applications like Salesforce.com, and

  • Capital Confirmation’s CONFIRM validated bank confirmation service.

Many on-demand applications offer advantages over traditional, on-premises installations such as:

  • Many applications require only a high speed internet connection and a web browser to operate

  • In most cases, no software must be installed on the client computer.

  • Updates and patches are installed automatically by the service provider

  • Users can access their applications and data from almost anywhere at almost any time.

  • Most service providers have technical staff monitoring system operations and security around the clock, 365 days a year.

  • Some service providers offer unlimited support and training for their on-demand offerings with extended hours of availability.

Despite these attractive features, there are risks associated with SaaS offerings which are different than on-premises offerings, including:

  • Since a company’s applications are made available from centralized servers, data from all users is hosted together on a company’s computers. Users may want to inquire about policies and procedures which prevent unauthorized users from viewing their data.

  • Users may want to view disclosures and independent tests of a company’s security and privacy policies.

  • Disasters and other service provider business interruptions can easily impact customers worldwide.

  • Some applications may not be available as locally-installed applications, which means that users should have a plan for how they will back up, restore, and convert their data in the event of a service disruption.

  • Most SaaS applications provide access to applications and data from anywhere, allowing remote workers to have the same tools as their co-workers in the office while retaining the convenience of a remote/home office.

Organizations such as the SANS Institute (SANS.org) provide sample policies and illustrative security standards for application service providers. These are free from the SANS website at www.sans.org, and a direct link to the page for the SANS security policy project is http://tinyurl.com/sans-asp. CPA’s evaluating online services should consider this guidance, as well as many other questions such as:

  • Is the company stable and well-capitalized?

  • How has the company dealt with past interruptions and contingencies (e.g. hurricanes, earthquakes, power blackouts, etc.)?

  • What is the organization’s service level agreement (SLA), or its stated policies regarding availability and interruptions of the applications? Are there any penalties for failing to meet these standards? Has the company ever had to make payments under these provisions?

  • What is the company’s plans for a catastrophic failure at its primary data center? Does the provider have multiple sites, mirrored servers, and structured plans for a contingency? How far apart are the primary and backup data centers? Is there a concentration of risk here in the event of a catastrophe? For example, if a company’s primary data center was in San Jose, and the backup data center was in Santa Clara (less than ten miles away), this might provide good protection against a small, localized power or internet outage, but might not provide adequate protection against a widespread power outage, a coordinated attack against fiber optic backbone cables, or a significant natural disaster like a major earthquake.

  • Are there any third-party security audits of the company’s policies and procedures (e.g. SAS 70 Type II)? Have you read the audits to confirm that the audit covers the organization’s internal procedures, and not just the general controls over the data center where its servers are located?

SaaS Markup2
(Click Image to Enlarge)

Figure 2 - Copanion’s website features SSL encryption for confidentiality, extended validation by a third party to thwart phishing attacks, and numerous security and privacy certifications.

 

  • Is all data stored in encrypted databases where the end user has sole control to the mechanisms of decrypting the data, or do the company’s technical personnel have access to confidential information? Is access to data logged and reviewed for propriety?

  • What are the organizations policies for hiring, retaining, and terminating personnel?

  • Is there any kind of extended authentication, certificate validation, or IP address verification available to mitigate the risk of a compromised username and password?

  • What kind of identification and verification is required for a provider’s help desk to reset a user’s password? How do these procedures prevent someone posing as a staff person from obtaining unauthorized access to confidential information?

  • Does the provider make any assertions about their compliance with federal and state privacy regulations which may apply (e.g., HIPPA, Gramm-Leach-Bliley, IRC § 7216, etc.)

Just as many people make different decisions about whether to purchase or lease capital assets such as buildings, equipment, or vehicles, software as a service offers CPA’s a way to outsource the management and delivery of software applications and reduce the complexity of their internal technology infrastructure. While these solutions may not meet the needs of all firms, SaaS should be considered as an alternative to traditional on-premises deployment, and the market share of SaaS offerings should increase significantly over the next five years.

 


Brian Tankersley CPA.CITP
About the author:
Brian Tankersley is a consultant based in Knoxville, Tennessee. Brian is a frequent speaker at continuing education courses on auditing and technology for K2 Enterprises, and is a senior faculty member with Becker Professional Review. Brian writes and publishes a nationally recognized blog on accounting and technology (www.cpatechblog.com) and frequently posts articles to the K2 blog on AccountingWeb.com.
Read More >>
Last Updated on Tuesday, 15 September 2009 01:50
 

Add your comment

Your name:
Your email:
Subject:
Comment:
  The word for verification. Lowercase letters only with no spaces.
Word verification:
Comments (1)
Other SaaS Offerings
1 Wednesday, 15 July 2009 20:22
Scott Cytron
Bryan - good article. There are two others to consider at SpeedTax.com and LeapFile.com.

Thomson Intros New Workpaper Product

News image

Thomson Reuters has introduced a new workpaper product, Workpaper CS. And while the company will continue to maintain its Engagement CS product, that product will not get much further development.

News | The Progressive Accountant | Tuesday, 22 May 2012

Intuit's Smith: Good Tax Season; But..

News image

  Intuit had an 11 percent increase in consumer tax revenue and the first growth in units sold to tax preparation professionals in three years for its third quarter ended April 30. But CEO Brad Smith thought the company should have done better in both areas in what he called a solid performance..  

News | Bob Scott | Friday, 18 May 2012

Wave Accounting Gets $12 Million

News image

Wave Accounting has secured $12 million in funding for its efforts to develop the market for its online accounting applications. Based in Toronto, Wave said the funding round was led by The Social+Capital Partnership with participation from existing investors Charles River Ventures and OMERS Venture.

News | The Progressive Accountant | Thursday, 17 May 2012

NetSuite Signs GT, Deloitte, Frank Rimerman

NetSuite is making strong inroads into the accounting community. At its SuiteWorld conference, underway this week in San Francisco, it announced three accounting firms and Sage's largest reseller as new additions to its channel.

News | Bob Scott | Tuesday, 15 May 2012

A Cloudy Year for Accounting Software

The technology press likes to declare something a "Year of ..." whatever the hottest trend is. But evidence is building that 2012 is going to be a big year for the sale of accounting applications that run on the web. Now, as is usually the case, there are usually a few big years once a new technology catches on.

News | The Progressive Accountant | Tuesday, 15 May 2012

SmartPros Results Flat

News image

Continuing education provider Smart Pros turned in results for its first quarter ended March 31 that showed both revenue and its net loss virtually unchanged from results in 2011. The company said lingering results from the recession and competitive factors kept a lid of its business.

News | The Progressive Accountant | Tuesday, 15 May 2012

TaxAct Revs Up 9 Percent

News image

TaxAct, the tax preparation software company purchased by InfoSpace, had pro forma revenue of $61.9 million a 9-percent increase from $56.8 million for the first quarter ended March 31. TaxAct, purchased on January 31 contributed only two months of actual results to its Bellevue, Wash.-based parent.

News | The Progressive Accountant | Thursday, 10 May 2012

Sage and Avalara Ally for Accountants Network

News image

Sales-and-use tax vendor Avalara is joining with Sage North America to provide resources to members of the Sage Accountants Network. Avalara's Accountants Resource Center provides tools and educational resources for helping them increase their sales tax knowledge.  

News | The Progressive Accountant | Tuesday, 8 May 2012

CliftonLarsonAllen to Resell Avectra

News image

CliftonLarsonAllen has agreed to resell Avectra's Social CRM to associations and nonprofit organizations.The accounting firm will offer the Avectra product in combination with Intacct's online accounting software. It is the latest move in the expansion of McLean, Va.-based Avectra's reseller program.

News | The Progressive Accountant | Thursday, 3 May 2012

ADP Revenue and Net Up 7 Percent for 2012

News image

Automatic Data Processing rolled sevens for its fiscal 2012 as net income, and revenue for employer services and total revenue all increased by 7 percent over 2011. And the company's metrics were strong in almost all areas for the year just ended.

News | The Progressive Accountant | Thursday, 3 May 2012

More in: News