In the previous article, which was the first of two parts about data security, we set forth why we believe a cloud-based software solution could be a good choice for your company from a data security perspective.
In this article, we will explore what security features an ideal cloud environment should provide. Plus, we have covered a few aspects of security where outsourcing of tasks to third parties is involved. Our advice keeps in view the two options that ESEF iXBRL document creation software providers might be offering a cloud-based solution and the outsourcing option.
Data security on a cloud-based platform
Two-factor authentication
Two-factor authentication is an extra layer of security that requires users logging in to any online system to key in a security token or a pin number apart from their passwords. The extra layer makes it harder for hackers to gain access to sensitive information even in case they do break into a database of passwords.
Secure cloud hosting
Your cloud-based solution must be hosted on trusted sites such as Microsoft Azure, Amazon Web, or Google. These hosting sites offer very strong data security in addition to application security measures such as data encryption and user access controls, which ensure your data stays within a group of trusted team members.
Private cloud
Find out if your vendor can make the software available on a private cloud, where security aspects remain in your control. A private cloud can allow greater control and customization of systems. However, the one drawback of a private cloud is higher maintenance costs.
Data security when tasks are outsourced
If your company has chosen to outsource your ESEF iXBRL document creation or any aspect of your financial repo. We re delighted you stayed with us through our series of articles on ensuring quality in your ESEF reporting process. This final article of the series is a wrap-up of all the points we have considered over the past few days.
1) The positive correlation between high-quality financial disclosures and a company’s market value with studies across geographies, time periods, and corporation sizes is well established, and there is a real benefit in ensuring high-quality financial reporting.
2) The IRIS Research Study on 707 listed companies across 27 EU countries found that
*10% of the 707 companies had numeric errors in their primary financial statements
* 73% of these errors were basic totaling mistakes
* 60% of the companies which had errors were firms with a market capitalization of over 100 million euros
The simple fact that emerged from our study was that the conversion of a financial statement into a machine-readable standard can have an immediate positive bearing on its quality. Our findings led us to a set of pointers on bringing quality into the reporting process, which formed the basis of the last 12 articles.
The role of software in quality
Adopting technology or software is the logical first step for quality because manual processes are highly error-prone and inefficient. And while software solutions that claim to have an answer are a dime a dozen, the ones that hold out the most promise are cloud-based, because they allow easy collaboration across geographies. Add to this features that allow version control, workflow decisions, interlinking of numbers across the document, commenting, and you have a package that brings you to financial close with a minimum of hassle.
The second piece in the quality puzzle: The XBRL standard
Embracing an open data standard such as XBRL would make your financial reports machine readable, and thereby more visible to analysts and investors. While some mandates (like Phase 1 of the ESEF mandate) require only part of the report to be converted into a machine-readable format, it would help if you went beyond and converted your entire annual report into the iXBRL format. This would enhance the quality of your report and make it discoverable across a much wider audience. And you would be one step ahead of Phase 2.
Checklist for the right software
Among the first items that should form your checklist on picking software that combines cutting-edge technology with XBRL-related tools and features are an XBRL International (XII) certification, third-party quality rankings, and user preferences. Then check for the degree of automation the solution allows (watch out for over-automation), check how future-proof the solution is, the amount of experience your vendor has with XBRL, and the vendor’s support turnaround time.
The ESEF filing process
What you are required to submit to your local regulator under the ESEF mandate is your annual report in a digital format. The digital format has two parts an instance document and a company taxonomy.
Your instance document creation entails mapping each line item or disclosure in your annual report to a relevant concept in the ESEF taxonomy; creating extensions or custom tags in cases where you cannot find appropriate concepts in the ESEF taxonomy and anchoring your extensions to elements with their nearest accounting meaning in the ESEF taxonomy.
Your company taxonomy represents the elements you have chosen out of the ESEF taxonomy or have customized and the relationships between these elements. It represents the structure of your document through four linkbases. Over a four-part mini-series, we covered each aspect of your digital annual report preparation and how you could bring quality to your ESEF report specifically.
Audit and review tool
Your checklist to pick an audit tool is similar to the one we suggested for picking your reporting software. You must check if the tool is XBRL International certified, is collaborative, offers flexible cloud hosting options, and has an XII certified validator integrated. In addition, look for features that allow a fact-by-fact review and approval of disclosures, a link between the document and taxonomy views, separate workflows for reviewers and auditors, version comparison, and report generation.
A word on security
On data security, there are separate checks you could conduct on the solutions or services you access for your financial report creation. In the case of cloud-based software, ensure a two-factor authentication for logging in, hosting on a secure platform such as Microsoft Azure, Amazon Web, or Google, and the option of a private cloud if need be. If you re relying on external services, ensure that there’s a secure file transfer protocol in place and your financial data is not sent via email. You could also run appropriate checks on your outsourcing service provider, including background checks on the person who would be dealing with your data.
We truly hope you enjoyed reading our ESEF Quality Series articles. And we hope this series will bring a difference, both to your ESEF documents as well as your overall financial reporting process.
rt finalization to a third party, here are a few pointers on keeping your files secure.
A Secure File Transfer Protocol
What’s most important to bear in mind is to never send your financial reports via email. That would pose a significant cyber security risk. Ensure that your documents are shared via a Secure File Transfer Protocol, which offers encryption and guarantees safe passage of financial reports from one system to another.
Who has access to your data?
Find out who at your outsourcing service provider’s end would have access to your company’s data. Find out what the permission levels are. The more people with access, the more opportunities there are for data compromises. Ensure that your service provider has implemented strong security measures and has strong processes in place, which include background checks and contractual agreements with the personnel who will be handling your data.
Security audit and certification
A widely accepted security audit for financial software and service providers is’sSAE 18. This audit is based on standards defined by the American Institute of Certified Public Accountants (AICPA) and focuses on internal control over financial reporting. Check for the System and Organization Controls or SOC certifications of your solution or service provider.
There are data security concerns both around the software solutions you may choose and the services you may avail of. We have set forth a few guidelines on ensuring that your data remains secure, both from a solutions and services engagement perspective. We hope the guidelines will be of help as you decide how best to handle your tasks around ESEF compliance and your broader financial report creation process.
Do stay tuned in for our next article, which will be a wrap-up of our ESEF Quality Series.
