About the Bulletin
Become a Contributor
Terms of Use
Privacy Policy
About the PolicyPro Library
Take a 30-Day Trial
Help Desk
How to Subscribe
Change email Address
Unsubscribe to Bulletin
Contact Us
 


         
October 2007 - Volume 2, Issue 10

1. Accounting Standards for Private Businesses
2. Privacy Commissioners’ Findings on TJX/WMI Security Breach
3. Battling the Invisible Competitor
4. Twenty Questions Directors Should Ask About IT Projects
5. Be a LEEDer



Accounting Standards for Private Businesses

In Vol. 2, Issue 6 of the PolicyPro Bulletin, we discussed the overall strategic plan of the Canadian Accounting Standards Board (AcSB) to merge Canadian GAAP with international standards.

As announced in that plan, the Board is proceeding with an examination of the needs of the users of private enterprise financial statements to understand the financial reporting approach that best meets the needs of these businesses. Accordingly, the Board has recently published a discussion paper “Financial Reporting by Private Enterprises” and has issued an invitation to comment (ITC) on this issue.

And it’s a thorny topic, with lots of history and the potential for far-reaching consequences. After all, owner-managed businesses are the backbone of the Canadian economy, accounting for 86% of the nation’s 2.2 million privately held enterprises. They employ approximately 32% of Canadian workers and spend proportionately more on R&D than Canada’s largest companies.

There seems to be little dispute that most of these businesses need a different standard of financial reporting than publicly accountable enterprises, specifically one that is less costly and time-consuming. There’s also no question that private businesses need reliable financial reports. But do they need GAAP financial statements? GAAP statements are intended for external users of information and many private enterprises simply do not have any. The AcSB consulted lenders, the most common external users of financial statements of private companies and found that at the lower end of the credit scale, they do not need GAAP financial statements.

The Discussion Paper nicely canvasses these issues, and discusses possible approaches for ensuring high-quality, general purpose GAAP financial statements for private enterprises.

For a link to the paper, and other related documents, see the new CICA’s new Transition to International Standards website, specifically the page dealing with financial reporting by private enterprises.

<< Top of Page


Privacy Commissioners’ Findings on TJX/WMI Security Breach

A joint investigation by the Privacy Commissioner of Canada and the Information and Privacy Commissioner of Alberta into the breach of network security that affected 45 million TJX/Winners Merchants International customers in Canada, the United States, Puerto Rico, the United Kingdom and Ireland, has revealed two fundamental problems:

  • The organization was collecting too much personal information, and retaining it for too long
  • The technology, policies and procedures used to safeguard customer information were inadequate

The Commissioners’ report is the most thorough post mortem of the breach to date. There are many interesting findings in the report, but a couple stand out.

First, TJX/WMI were protecting themselves against potential fraud by “frequent returners” by collecting personal information, including driver’s license numbers, from all customers who returned merchandise. The Commissioners found that, although the collection of some personal information, like addresses, is legitimate for this purpose, collecting driver’s license numbers as unique numeric identifiers cannot be justified. They drew an analogy between driver's license numbers and SINs, and stated that a driver’s license is proof that an individual is licensed to operate a motor vehicle, and should only be used for that purpose. This is especially important because a license number is such an extremely valuable piece of data to fraudsters and identity thieves.

Second, they noted that TJX/WMI had used the relatively weak Wired Equivalency Privacy (WEP) encryption protocol at the time of the breach, although they were in the process of converting to the more secure Wi-Fi Protected Access (WPA) protocol. The Commissioners found that weak wireless network security was a major contributing factor to the breach.

As you might expect, the Commissioners found that TJX/WMI were in breach of the Personal Information Protection and Electronic Documents Act (PIPEDA). But the report is much more than that—it is a cautionary tale for any company engaged in e-commerce, illustrating the disasters that can ensue if the proper business, privacy and IT controls are not in place.

For a copy of the report, click here.

For some of the controls that TJX/WMI should have considered, see GV1.11 – Confidentiality and Privacy and FN1.07 – Customer Refunds, Retail in Finance and Accounting PolicyPro; as well as IT10.04 – Wireless Network in Information Technology PolicyPro.

<< Top of Page


Battling the Invisible Competitor

“Whether it's emerging economies such as China, a shrinking labour pool or the dizzying speed of technological change, SMEs today must compete in a whole different way.”

So writes Jérôme Nycz, Vice President, Strategy and Planning at BDC, who adds that the interdependence of business has created a new, invisible competitor—the supply chain.

For the full text of the article click here.

<< Top of Page


Twenty Questions Directors Should Ask About IT Projects

This succinct brochure, the latest addition in a series of “20 Question” guides written and published by the CICA’s Information Technology Advisory Committee (ITAC) is designed to guide members of boards of directors, audit committees, and IT steering and project committees when planning and implementing significant IT projects.

To download the guide, click here.

Information Technology PolicyPro (ITPP) contains expert advice and ready-to-use policies dealing with IT Planning as well as Systems Acquisition, Maintenance and Disposal. For more information about ITPP, click here.

<< Top of Page




Be a LEEDer

In the never-ending parade of new acronyms and abbreviations, we introduce LEED—Leadership in Energy and Environmental Design. It’s a fairly recent and fast-growing standard for rating the environmental sustainability of building construction.

The rating system addresses six areas:

  • Sustainable sites
  • Water efficiency
  • Energy and atmosphere
  • Materials and resources
  • Indoor environmental quality
  • Innovation and design process

What’s the payback?

Tenants in a LEED-compliant commercial building might pay an extra 50 cents a square foot on the base lease, but can save $1 a square foot on operating costs, especially heat, light and air conditioning, after three or four years. A LEED-compliant building also has the potential to house more workers in a smaller space, because higher air quality and air circulation standards mean a healthier work environment. All this, plus the attraction of being known for supporting sustainability and the environment, is making these buildings a hot commodity.

For more information, click here for a Wikipedia article about LEED, and here for the website for the Canada Green Building Council.

See Chapter 5 of Operations and Marketing PolicyPro (OMPP) for ready-to-use environmental management policies and procedures. For more information on OMPP, click here.

<< Top of Page




About the PolicyPro Bulletin

Editor: Colin Braithwaite, Managing Editor – PolicyPro.

Please do not reply to this Email.

PolicyPro Bulletin is a complimentary service published by First Reference Inc. and is sent to you monthly. Each issue of the PolicyPro Bulletin provides headlines and summaries of news that affects internal controls and policies in Canada.

Please forward this Bulletin to your colleagues.

Please send any comments or suggestions about the PolicyPro Bulletin to editor@policypro.ca. For information about the PolicyPro Library, visit www.PolicyPro.ca. For information about First Reference and our HR-related products, visit www.firstreference.com. To read our Terms of Use, Disclaimer, Privacy Policy and other legal matters, visit PolicyPro.ca.

This publication is written for informational purposes only and should NOT be relied upon as legal advice or opinions. The reader should always obtain legal advice from a qualified lawyer or other qualified professional, which will be responsive to the case or circumstance of the individual. Please note that the content provided in this Bulletin or any content contained in or made available through any third party website linked to from this Bulletin, is provided "as is" without representations or warranties of any kind. All representations and warranties in respect of Content or Third Party Content, express or implied, including, without limitation any representations to warranties or conditions regarding accuracy, timeliness, completeness, non-infringement, merchantability or fitness for any particular purpose are hereby disclaimed.

PolicyPro Bulletin ISSN: 1718-5866 Copyright ©2007, First Reference Inc., All Rights Reserved.

Finance and Accounting PolicyPro
Vol I:  Finance
Vol II: Corporate           Governance

Information Technology Policy Pro

Operations and Marketing PolicyPro

Human Resources PolicyPro - Ontario

Human Resources PolicyPro - BC

Human Resources PolicyPro - AB