Seal To Broaden Trust In E-Biz

The nation's largest association of accountants is finalizing standards for companies engaged in Web commerce. But earning its seal of approval might prove too costly for the very e-businesses that stand to gain the most.

The WebTrust program, sponsored by the American Institute of Certified Public Accountants, will require participants to adhere to one or more e-businesses "principles" that cover privacy, security, general-business practices and four other areas.

But compliance won't come cheap. E-businesses will have to pay for and pass an audit before they can place the WebTrust seal on their sites. The auditing and preparatory consulting could run anywhere from $10,000 to $100,000, said Christopher Leach, an AICPA member and national director of e-risk services for Grant Thornton LLP. E-businesses might spend considerably more on tweaking their systems, processes and site design to meet the standards.

The AICPA this month begins releasing drafts of its principles, including four new ones designed for B2B e-commerce. Those cover user confidentiality, site availability, disclosure of site usage data and nonrepudiation (the assurance that an e-business can authenticate electronic transactions and agreements). The three principles that focus on B2C e-commerce are privacy, security and transaction integrity (the assurance that consumers get what the e-business promised them).

The idea is simple, said Leach: What procedures or processes do you have in place to do business online? An audit by an AICPA member--and a follow-up review every six months--should help e-businesses figure that out.

The AICPA has 360,000 accountants representing 12,000 firms, any one of which might cobrand the AICPA seal to lend its name to a Web site to boost consumer confidence. Both IT and accounting experts would conduct the audits.

But WebTrust has raised yellow flags. Some observers see another set of e-business "best practices" as overkill.

"One of the major drawbacks out there is the confusion," said Ari Schwartz, a policy analyst with the Center for Democracy and Technology. "People are just beginning to understand what these seals mean."

In addition to WebTrust, there's the TRUSTe program, guided by a not-for-profit organization whose directors include members of industry and other groups. It claims more than 1,000 seal-holders. In addition, the Better Business Bureau administers its own online reliability and privacy seal programs.

WebTrust isn't new. The AICPA, its members and their counterparts abroad launched a broad set of e-business principles in 1998. The updated WebTrust is designed to coexist with e-commerce laws that already exist in 12 nations.

WebTrust Partnership
The WebTrust program includes a partnership with the National Arbitration Forum that provides a quick link to resources for settling disputes. WebTrust participants agree to accept binding arbitration as a last resort to settle disputes.

WebTrust has managed to garner only a handful of participants. AICPA officials say that streamlining the standards into seven modules should attract more companies.

The idea is to attract incremental participation. For instance, a business might want to show its partners that it has been audited for confidentiality, while its adherence to privacy guidelines is adequately demonstrated by a seal from another organization.

Among early adopters of the original WebTrust program was Bell Canada.

Anthony D'Alimonte, a customer experience advocate for Bell Canada, praised WebTrust. "It keeps us true and honest," he said. But for smaller businesses, D'Alimonte said, the cost of keeping up with the program could be onerous. "It's not a cheap program," he said.

At least part of that cost is incurred after an audit is successfully completed. Companies must spend the money necessary to train employees. The challenge is communicating the meaning of the seal across a large corporation, he said.

Whatever the reason, price will likely be a big factor in the decision on whether to pursue a WebTrust seal, said Manu Rehki, founder and CEO of online wine seller WineGlobe.com. "Not knowing the full details, I would shy away from that," he said. His site already bears a privacy seal from TRUSTe program.

There is a powerful agenda to the plan: heading off legislation.

Seal proponents are not shy about it. Self-regulation is key to seal programs, said Charles Underhill, the COO for the Better Business Bureau's BBBOnline program, a program similar to WebTrust.

"It's a self-regulatory code," said Underhill, whose online seal program has been sold to about 6,000 participants for varying amounts.

AICPA members put it more bluntly. "Let's keep the regulators out of there," Leach said.