Electronic Document Management for CPA's

Best Practices: Electronic Document Management for CPA's
These days, CPAs find themselves needing to ensure their clients comply with Sarbanes-Oxley, Graham-Leach-Bliley, and a rapidly expanding number of other legal and regulatory requirements. As a result, more and more electronic data is getting classified as vital, requiring the data to be securely stored to protect it from catastrophic destruction.

Ultimately, only about 5 percent of the records produced by a typical CPA client are legally considered vital. However, CPAs themselves typically have a much higher percentage of active case files and documents that fall under this scenario. As a result, accounting professionals are increasingly looking for cost-effective ways to upgrade their document-management procedures and record-retention policies.

One key, often-overlooked aspect of electronic document management is the physical protection of tapes and discs. For CPAs to serve their clients to the best of their ability, it is imperative they understand the need to "physically protect" as a top priority. This includes either storing files on-site or outsourcing storage to an off-site vendor. Electronic records require specific environmental conditions (including temperature and humidity controls), as well as careful handling throughout their lifecycle to ensure their preservation.

Equipment
Specially designed data cabinets and media vaults provide on-site protection for magnetic tapes and disks. Putting electronically stored records in a non-fireproof container is, of course, a huge risk considering how easily a fire could destroy everything. However, even fireproof file cabinets designed to store paper and microforms do not provide sufficient protection for magnetic tapes, disks and diskettes, since the ignition point of paper and microfilm is much higher than that of magnetic media.

Atlantic Mutual, an insurance company, specifically recommends that we store all magnetic media in a fireproof safe or container that has specific qualities, such as a fire rating. A vault with a fire rating should hold the temperature constant during a catastrophic fire. Paper is destroyed at 400°F, but computer media are rendered useless at 125°F and 80 percent relative humidity.

In addition, a vault with a "classified fire rate" will protect the media stored inside it for at least two hours, and that the product has been tested and classified by Underwriters’ Laboratory (UL) or another independent testing lab. The contents are rated to remain at or below 125°F for at least two hours when exposed to a fire (as per the Standard Time Temperature Curve) of up to 1850°F.

You must also consider the effect of water (from fire hoses, sprinklers and burst pipes) on stored media. These situations are where a product with an interior relative humidity of less than 80 percent becomes crucial.

Location
Another issue to consider, whether off- or on-site, is the storage room environment, which should be climate-controlled at 63°F and 35 percent relative humidity. The storage room’s security also must be considered. Does the room offer restricted access, ensuring that only those with the proper authority can enter the location where the documents are kept?

The IRS and SEC require that a business keep its accounting records for a minimum of seven years in case of an audit. These governmental bodies, however, do not specify what type of container the records must be stored in during this time. Some accounting organizations do make recommendations for all firms to follow.

For example, in an AICPA article on personal financial planning for consumers, fireproof record storage is part of a set of financial record-keeping procedures: "Avoid storing your records in a place where they can be stolen or damaged by natural elements. Your records should be placed in a fireproof unit. For documents that would be difficult to replace, consider a safe."

These are guidelines, not regulations that the industry is forced to follow; however good general business practices for the accounting industry should require proper fire-suppression equipment – as well as fireproof record storage – for all electronic documents. Otherwise, we waste the precious time and money of our clients and our own offices until the correct decision to take action has been made.

About Doug Voet
Doug Voet, CPA, is CFO of Fire King Security Group, a New Albany, Ind.-based provider of security products and solutions. He has held that position since 1995. Mr. Voet, a CPA since 1980, is a member of the Kentucky Society of CPAs and a member of the AICPA. E-mail him at dougv@fireking.com.