20 Questions Businesses Should Ask About Privacy

Privacy has become a significant business risk to organizations that collect, use, retain and disclose personally identifiable information about customers and employees. As a result, business owners, board members and executive management need to assess whether their handling of personally identifiable information complies with numerous privacy laws and regulations. To provide guidance, the AICPA issued a Business Brief on April 10, 2012 called 20 Questions Businesses Should Ask About Privacy. It was prepared by Nancy Cohen, CPA.CITP, CIPP, CGMA, Senior Technical Manager, AICPA Member Specialization & Credentialing.

The questions contained in that Brief were adapted from the guidance booklet, 20 Questions BusinessesShould Ask About Privacy previously published by the Canadian Institute of Chartered Accountants (CICA). They are key questions a business should ask with the aim of understanding privacy risk, implementing a privacy program, managing privacy risk and obtaining privacy assurance.

Integrated Reporting practices of 100 JSE-listed companies

Deloitte has released its second quarterly report on the state of Integrated Reporting in South Africa. The report is called Integrated Reporting – Navigating your way to a truly Integrated Report. It reveals that Integrated Reporting standards have been adopted by more than half of South Africa’s listed companies. Although it is now necessary for these JSE-listed companies to include a statement of compliance with the principles set out in the King Code on Governance Principles (King III) in their annual reports, many companies are still scoring surprisingly low on corporate governance matters.

The publication (which applies to all members of the C-Suite) was prepared by the Deloitte Integrated Reporting and Sustainability team. It contains the key findings of the empirical research conducted on 100 companies listed on the Johannesburg Stock Exchange. The analysis covered 7 subjects, 58 principles and 160 questions seeking to assess actual performance against good practice. The publication includes practical observations on certain topical subjects which appear to be a challenge for companies.

COSO Internal Control - Integrated Framework

In November 2010, the Committee of Sponsoring Organizations of the Treadway Commission (COSO) announced a project to review and update the 1992 Internal Control - Integrated Framework. COSO’s goal in updating the framework is to increase its relevance in the increasingly complex and global business environment so that organizations worldwide can better design, implement and assess internal control.

COSO engaged PwC as author of the update. In turn, PwC received valuable input from the Advisory Council and other stakeholders. The proposed Framework retains the core definition of internal control and the five components of internal control. A significant enhancement is the expression of concepts described in the original framework as 17 principles, accompanied by related attributes. These principles and attributes should assist organizations as they apply judgment in improving performance and managing risk in changing business and operating environments.

This Framework will provide organizations with significant benefits – for example, by increasing confidence that controls mitigate risks to acceptable levels and by providing reliable information to support sound decision-making. Furthermore, because the definition of internal control and its five underlying components are not changing, the codification of the principles and attributes will not impose additional burdens or a higher threshold for designing and maintaining an effective system of internal control.

COSO is now seeking feedback comments on the proposed Internal Control - Integrated Framework. A series of questions are included in the exposure draft for consideration by participants. The comment period closes March 31, 2012.

Sustainability 2.0: Using sustainability to drive business innovation and growth

Sustainability can be a game changer. It can drive innovation by introducing new design constraints that shape how key resources— energy, carbon, water, materials and waste—are used in products and processes. It can also suggest areas where innovation can pay off especially well. These five resources are ubiquitous throughout an organization’s supply chain, and the potential to boost efficiency and cut costs across these resources is significant.

Sustainability-driven innovation goes beyond designing green products and packaging solely on their inherent virtue. It entails improving business operations and processes to become more efficient, with a goal of dramatically reducing costs and waste. It’s also about insulating a business from the risk of resource price shocks and shortages. Taken together these enhancements can deliver business benefits that go far beyond the bottom line—whether it’s improving the overall carbon footprint, enhancing the brand image or engaging employees in a more profound way.

Often, there are significant opportunities for organizations to use sustainability to drive innovation and improve how they do business. A methodical analysis can highlight areas ripe for attention. Taking it a step further, that analysis may yield even greater benefits if it is extended beyond the company’s own walls through collaboration with suppliers, customers and alliance partners. Changes to each link in the supply chain can affect everything upstream and downstream and create financial benefits for everyone involved.

To reach this new frontier, leading organizations are taking a hard look inside their operations and across their supply chains, assessing where they are, prioritizing initiatives, and then formulating a broad sustainability strategy to foster product and process innovation to achieve their goals. They are also adopting metrics that more accurately measure their progress and improve their image in the marketplace. Companies that achieve this vision have the opportunity to enhance revenue and brand value, engage effectively with key stakeholders, manage risks and reduce costs.

To learn more, read the complimentary article reprint “Sustainability 2.0: Using sustainability to drive business innovation and growth” in Deloitte Review, Issue 10, January 2012. The article is also available for reading online.

Sustainability: Environmental and Social Issues Briefing

Environmental and social issues are increasingly having an impact on the bottom line and future prospects of companies in many industries. They can present both opportunities and risks. In addition, they can have important implications for strategy, competitiveness, risk management, stakeholder relations and business resilience. A company’s board of directors has key oversight responsibilities in relation to environmental and social issues.


Board awareness and attention are essential in keeping abreast of the fast-evolving business impacts of these issues. Sustainability: Environmental and Social Issues Briefing highlights the environmental and social issues directors need to consider, providing an understanding of the potential business implications of these issues and offers questions that directors might ask in discharging their oversight responsibilities.

Highlights of Corporate Governance Research

Several corporate governance developments have occurred in the wake of the high-profile scandals of the past decade. Some of these developments are motivated by legislation, such as the Sarbanes-Oxley Act of 2002 (SOX). Others are best practices enhancements intended to shore up investor confidence. Academic research has monitored these developments. The article “Highlights of Corporate Governance Research” in the September 2011 issue of the Journal of Accountancy summarizes important academic findings and observations recently published in prominent accounting and finance journals.

This article is part of a series that samples accounting research and distills key findings for busy practitioners and preparers. These summaries explain the implications of a wide range of research and give CPAs the opportunity to apply the results in day-to-day activities. Readers interested in more detail should review the full text of each article to explore the hypothesis, research process, statistical analysis, supporting theories and conclusions.

PwC’s “To the point: Current issues for boards of directors – Fall 2011”

As the title suggests, “To the point” addresses contemporary issues and is meant to be impactful, insightful and concise. Each quarter, PwC addresses select topics that are of immediate interest to directors. The Fall 2011 edition shares insights on several matters.

Next year's proxy season: The SEC's plan for proxy access was struck down by a US Court of Appeals decision in July, but directors should prepare for the possibility of private ordering proxy access.

A new discussion about mandatory auditor rotation: The idea of mandatory audit firm rotation has resurfaced in a recent PCAOB concept release, and comments are requested on the matter.

Technology in the boardroom: Directors are increasingly using electronic portals and tablet devices to access board materials and books, and the trend is likely to continue.

(Read PwC’s To the point: Current issues for boards of directors – Fall 2011.)

Communication Technologies put Privacy at Risk

According to a recent survey, Canadians are heavy users of social networks and other communications technologies, but many are not taking basic steps to protect their personal information. A telephone survey of 2,000 randomly selected adults, commissioned by the Office of the Privacy Commissioner of Canada (OPC), found that three-quarters (74%) of respondents own at least one mobile communications device, such as a cell phone, smart phone or tablet. However, only 4 in 10 use password locks for the devices, or adjust their settings to limit the sharing of personal information that may be stored on the devices.

The Canadians and Privacy Survey 2011 found that one-third of Canadians use public Wi-Fi sites, such as those located at coffee shops and airports, where online communication may not always be protected by encryption. Of those, fully 85% admitted to some concern about possible risks to the security of their personal information.

The poll, conducted by Harris/Decima, also found that just over half (51%) of respondents use social networking sites, such as Facebook, MySpace and LinkedIn. Fortunately, 4 in 5 said they take advantage of privacy settings that allow them to control access to their online content. Even so, 45% of all respondents who use social networking sites acknowledged that they are concerned about the associated risks to their privacy.

Global Anti-bribery and Corruption Survey 2011

In Canada, managing bribery and corruption risks has not assumed the importance and urgency seen in other jurisdictions. To date, Canada’s Corruption of Foreign Public Officials Act (CFPOA), has received little attention from corporations and enforcement by officials. This is in stark contrast to the situation in the United States where the Foreign Corrupt Practice Act (FCPA) is robustly and strictly enforced.


However, there have been important developments on the Canadian anti-bribery and corruption (AB&C) front. The new reality for Canadian companies is one of increased AB&C enforcement activity, both at home and abroad.

KPMG Forensic commissioned a survey of 214 executives (106 in the US and 108 in the UK) who consider themselves “one of the most senior persons in charge of day-to-day AB&C matters at their company.” The three most significant AB&C compliance challenges cited by both US and UK respondents are auditing third parties for compliance, difficulty in performing effective due diligence on foreign agents/third parties, and variations in country requirements and local laws on issues, such as data privacy and facilitating payments. (Read the Global Anti-bribery and Corruption Survey 2011.)

Mobile insecurity

The proliferation of mobile computing has brought on a number of challenges, specifically around security issues. Smartphones are repeating a pattern witnessed in the 1980s with desktop computers. They flood into the corporate fold without any rational plan. And very often, they are introduced by employees who can’t resist the status statement these devices make. The greatest obstacle to security is the users themselves. People believe nothing of value resides on their device, yet much can be used for identity theft, intellectual property theft or espionage. Everyone likes these devices for the immediacy and convenience, and don’t want to be bothered with security barriers, especially passwords. This is why many users deactivate the password protection, which to begin with is very rudimentary and requires only a four-digit PIN identification. In a regular notebook, that would never be accepted as security. To learn more, read the article “Mobile insecurity” in the September 2011 CAmagazine online.

The "cloud" and what it can do for your business

When someone talks about joining “the cloud” are you puzzled? What is it, what does it do and what does it mean for the future? Some believe the cloud is a major step in the evolution of the Internet. Others say that, without a doubt, cloud computing will play a huge role in the design, reliability and speed of corporate websites. Many are convinced that, within the next five to six years, most computing services will be delivered from the cloud. Still, for many small business enterprises, cloud computing is an abstract concept. To learn more, read the article "Still foggy on cloud computing?" in the September 2011 issue of CAmagazine online. 

PwC – 10 Minutes on the CEO agenda

PwC research has found that CEOs across the globe are redefining what growth looks like in a post-crisis world. Companies are reshaping their strategies and operating models—focusing on issues like talent, innovation and collaboration—to find new sources of revenue growth and competitive advantage. There are eight key questions leaders can ask— about where and how to change—to ready their businesses for the road ahead. Read the PwC March 2011 publication Growth reimagined: The eight questions every CEO should ask about getting—and staying—ahead.

The Top Ten Tech Issues

The Canadian Institute of Chartered Accountants (CICA) Information Technology Advisory Committee conducts an annual survey of the most important IT issues facing the profession, which provides interesting insight into the prevalence and impact that technology has on businesses. While some topics come up every year, the relative importance of several issues changes from survey to survey.

This year was no different. Information management rose to the top spot from No. 3, pushing last year’s No. 1 issue, legislation and regulatory compliance, to second place. The impact of the recession, No. 2 last year, fell to No. 10 in this year’s survey, while new and emerging technologies rose to No. 3 from No. 5. (To learn more, read the article "The Top Ten Tech Issues" in the September 2011 CAmagazine online.)

PwC Thought Leadership Highlights

Every month, PricewaterhouseCoopers (PwC) delivers a range of Thought Leadership materials that explore key business issues affecting companies around the world. This month the focus is on a variety of issues that address the following questions and more: What's the key to successful business innovation? What are the implications of the proposed FASB/IASB revenue recognition changes? How are businesses adapting to the changing needs of their talent? What's next for nuclear power? (for example, see View:Striking the innovation balance).

Also, experience the popular 10Minutes series on your iPad, now enhanced with new multimedia. With this inaugural issue, 10Minutes on the CEO Agenda, explore the eight pressing questions facing CEOs today, hear about the challenges directly from business leaders around the world. 10Minutes on the Cloud discusses how cloud computing can go beyond cost savings to offer a way to improve innovation and organizational agility, provide better customer engagement, and harness resources to focus on business imperatives.

Transocean: No Apologies Over Gulf Oil Spill

"Fourteen months after the Deepwater Horizon drilling rig exploded 50 miles southeast of Venice, La., killing 11 men and setting off the largest offshore oil spill in U.S. history, Transocean (RIG), the company that owned and ran the ill-fated 32,600-ton vessel, finally issued its official account of what happened and why. It produced a report on June 22 of no fewer than 854 pages, divided into two volumes, and spared no detail. The bottom line, though, isn’t complicated:It was BP’s (BP) fault." (Read the full story "Transocean: No Apologies Over Gulf Oil Spill" at Bloomberg Businessweek online.)

Sustainability Framework 2.0: Professional Accountants as Integrators

“The role of leadership and business strategy is to promote the integration of sustainability issues at a strategic level, so that they are embedded in organizational development covering strategy, planning, enterprise risk management, and operations. The importance of tone at the top is best captured by the King Code of Corporate Governance for South Africa, which specifically encourages the integration of governance and sustainability into strategy, operations, and reporting of an organization. The philosophy of the King code revolves around leadership, sustainability and corporate citizenship. Responsible leaders direct company strategies and operations with a view to achieving sustainable economic, social and environmental performance.” (Read the publication Sustainability Framework 2.0: Professional Accountants as Integrators, issued by the International Federation of Accountants (IFAC) in March 2011.)

20 Questions Directors Should Ask about Information Technology Security

“The CICA’s Information Technology Advisory Committee developed this booklet to guide Boards of Directors in evaluating information technology (IT) security issues. It should also be of use to other bodies responsible for governance — in particular audit committees and strategic bodies such as IT steering committees, risk management committees, and CEO/CFO controls certification committees. Directors are expected to satisfy themselves that risks potentially jeopardizing the integrity of information, the availability of information and operational systems, the confidentiality of sensitive data, and compliance with regulatory bodies, are identified and reduced or eliminated. This booklet provides questions for Boards to ask senior management as well as the context needed to ask the questions and assess responses. In this document, IT Security (Security) is defined as the protection of data captured, processed, transmitted, reported and stored electronically. IT Security also covers the protection of related components such as application systems, system software, networks and hardware, as well as the supporting people, policies, procedures, processes and organization.” (Read the CICA publication 20 Questions Directors Should Ask about Information Technology Security.)

Data-Centric Security - A CICA White Paper

In most organizations, data that was once static and stored in one place now moves freely from platform to platform throughout the organization and beyond. Because data is now often generated and modified by users and is resident in different forms and versions in different places simultaneously, maintaining a secure environment is a growing challenge. A White Paper issued by the Canadian Institute of Chartered Accountants (CICA) suggests that a data-centric policy should be the focus for management, auditors and others involved in securing data in this new mobile environment. The term “security” is taken in its broadest sense to include confidentiality, integrity (accuracy, completeness and validity) and availability. (Read the CICA publications on Data-Centric Security and

20 Questions Directors Should Ask About IT Security.)

A Framework for Board Oversight of Enterprise Risk

The Risk Oversight and Governance Board of the Canadian Institute of Chartered Accountants (CICA) has developed "A Framework for Board Oversight of Enterprise Risk" to provide a practical approach to risk oversight, including a methodology and tools designed specifically for boards of directors. The framework includes a nine-part process to assist boards in better identifying and addressing critical risk as well as understanding the inter-connectivity of risks.

Harnessing the opportunities and managing the risks of social media

According to a recent publication by Deloitte, virtually every organization is either using or considering social media for internal and external use. Now, the question is how to use social media effectively, while managing the risks it presents for businesses. Social media presents unparalleled opportunities for growth, innovation, customer and competitive intelligence, early risk identification and diffusion. (To learn more, read Enterprise 2.0: Harnessing the opportunities and managing the risks of social media.)