电话：010-85195300
E-mail：cassoa@cass.org.cn
地址：中国北京建国门内大街5号中国社会科学院1#楼
扫一扫关注微信
国家哲学社会科学文献中心版权所有
Web assurance seals--are they all alike? A look at WebTrust and other web assurance seals.
Joseph, Gilbert W. ; Bostick, Lisa N. ; Slaughter, Lanford T., Jr. 等
EXHIBIT 4. QUESTIONNAIRE FOR BBBOnLine IN STEP 2 Web Seal Program Name: BBBOnLine Section A. e-commerce assurance concerns of the web assurance seal Doesn't program. Yes No Say Data Security: Does the seal program require the merchant to provide data security that does following? * Merchant must provide security for X data transmitted from the consumer to the web site (i.e., have a secure server transaction system). * Merchant must provide security for X data that appears on the web site that will be used by the consumer to make transaction decision. Business Policies: Does the seal program require the merchant to have business policies that the Doesn't following? Yes No Say * Merchant must display X understandable and consistent policies on the website (e.g., billing, payments, returns, sales tax) * Merchant must adopt business X policies previously established by the seal program rather than develop his / her own policies. * Merchant is allowed to write his / X her own business policies if the policies comply with principles approved by an acceptable body. * Merchant is required to maintain a X history of adhering to its own policies. * Merchant must demonstrate a X history of not changing these policies frequently. Transaction Integrity: Does the seal program require the merchant to provide transaction processing Doesn't integrity? Yes No Say * Merchant must properly process all X transactions only after gaining the consumer's agreement. * Merchant must respond to consumer X inquiries / complaints in a timely manner. * Merchant must use agreed-to X shipping and pricing data. * Merchant must resolve all customer X problems in a prompt manner. * Merchant must provide a means for X consumers to communicate with the merchant regarding inquiries, follow-up, or complaints. Data Privacy: Does the seal program require the merchant to provide data Doesn't privacy that does the following? Yes No Say * Merchant must display X understandable and consistent policies on the website (e.g., consumer data privacy principles). * Merchant must keep transaction and X personal information about the consumer confidential. * Merchant must adopt privacy X policies previously established by the seal program rather than develop his / her own policies. * Merchant is allowed to write his/ X her own privacy policies if the policies comply with principles approved by an acceptable body. * Merchant must allow the consumer X to verify or correct his / her personal data that is maintained on the merchant's computer. * Merchant must release or use data X only as agreed to by the consumer, except as needed to complete the transaction. * Merchant must protect the X consumer's computer from viruses or "cookies", except as needed to complete the transaction. Seal Program Activities: Does the seal program perform activities on behalf of consumers in the following Doesn't areas? Yes No Say * Merchant must allow consumers to X voluntarily document their experiences via the seal program website. * Merchant must let the seal program X summarize or rank consumer experiences with the merchant's history of honoring its policies. * Merchant must agree to X arbitration, let the web seal program intervene on the customer's behalf, or have a similar resolution process. Section B. Specific requirements of the firm to be able to display the Doesn't seal. Yes No Say Self-Reporting Activities: Does the seal program require merchants to self-report the following items? * Proof of having conducted business X for a specified period of time. * Agree to abide by the seal X program's requirements. * Pay a license fee. X * Install the seal or consumer links X to the seal program website. * Purchase or install security X software or hardware provided by the seal program. * Profess that the merchant has full X online ordering capability. Independent Evaluations: Does the seal program require merchants to have an initial evaluation as Doesn't follows? Yes No Say * Let a third party to confirm the X existence of the merchant. * Let seal program representatives X confirm the merchant's existence via an on-site visit. * Let seal program representatives X determine if the merchant fully discloses policies, without testing actual merchant performance. * Let seal program representatives X conduct tests to see if the merchant adheres to stated policies and meets performance criteria. * Engage an independent auditor to X determine if the merchant fully discloses policies, without testing actual merchant performance. * Engage an independent auditor to X conduct tests to see if the merchant adheres to stated policies and meets performance criteria. Renewal Requirements: Are specific actions by merchants required to renew their ability to display the Doesn't seal? Yes No Say * Pay a renewal license fee. X * Not have significant consumer X complaints about failure to follow its own stated policies or to quickly resolve consumer problems. * Let seal program representatives X determine if the merchant fully discloses policies, without testing actual merchant performance. * Let seal program representatives X conduct tests to see if the merchant adheres to stated policies and meets performance criteria. * Engage an independent auditor to X determine if the merchant fully discloses policies, without testing actual merchant performance. * Engage an independent auditor to X conduct tests to see if the merchant adheres to stated policies and meets performance criteria only if severe violations were noted in previous merchant performance * Engage an independent auditor to X conduct tests to see if the merchant adheres to stated policies and meets performance criteria. How thoroughly do you feel that the Very Very website seal program addresses Good Good Fair Poor Poor e-commerce assurance objectives? (Check one answer for each of the assurance concerns) * Data Security * Business Policies * Transaction Integrity * Data Privacy * Seal Program Activities Would this web seal program require a Yes No CPA practitioner to make statements that the merchant met all the web X seal program's criteria in order to obtain, display, or renew the web assurance seal? (Check one answer) EXHIBIT 5. QUESTIONNAIRE FOR TRUSTE IN STEP 2 Web Seal Program Name: TRUSTe Section A. e-commerce assurance Doesn't concerns of the web assurance seal Yes No Say program. Data Security: Does the seal program require the merchant to provide data security that does the following? * Merchant must provide security X for data transmitted from the consumer to the web site (i.e., have a secure server transaction system). * Merchant must provide security X for data that appears on the web site that will be used by the consumer to make transaction decision. Business Policies: Does the seal program require the merchant to have business policies that provide Doesn't the following? Yes No Say * Merchant must display X understandable and consistent policies on the website (e.g., shipping, billing, payments, returns, sales tax). * Merchant must adopt business X policies previously established by the seal program rather than develop his / her own policies. * Merchant is allowed to write his X / her own business policies if the policies comply with principles approved by an acceptable body. * Merchant is required to maintain X a history of adhering to its own policies. * Merchant must demonstrate a X history of not changing these policies frequently. Transaction Integrity: Does the seal program require the merchant to provide transaction processing Doesn't integrity? Yes No Say * Merchant must properly process X all transactions only after gaining the consumer's agreement. * Merchant must respond to X consumer inquiries/complaints in a timely manner * Merchant must use agreed-to X shipping and pricing data. * Merchant must resolve all X customer problems in a prompt manner. * Merchant must provide a means X for consumers to communicate with the merchant regarding inquiries, follow-up, or complaints. Data Privacy: Does the seal program require the merchant to provide data privacy that does the Doesn't following? Yes No Say * Merchant must display X understandable and consistent policies on the website (e.g., consumer data privacy principles). * Merchant must keep transaction X and personal information about the consumer confidential. * Merchant must adopt privacy X policies previously established by the seal program rather than develop his / her own policies. * Merchant is allowed to write X his/her own privacy policies if the policies comply with principles approved by an acceptable body. * Merchant must allow the consumer X to verify or correct his / her personal data that is maintained on the merchant's computer. * Merchant must release or use X data only as agreed to by the consumer, except as needed to complete the transaction. * Merchant must protect the X consumer's computer from viruses or "cookies", except as needed to complete the transaction. Seal Program Activities: Does the seal program perform activities on behalf of consumers in the Doesn't following areas? Yes No Say * Merchant must allow consumers to X voluntarily document their experiences via the seal program website. * Merchant must let the seal X program summarize or rank consumer experiences with the merchant's history of honoring its policies. * Merchant must agree to X arbitration, let the web seal program intervene on the customer's behalf, or have a similar resolution process. Section B. Specific requirements of the firm to be able to display the seal. Self-Reporting Activities: Does the seal program require merchants to Doesn't self-report the following items? Yes No Say * Proof of having conducted X business for a specified period of time. * Agree to abide by the seal X program's requirements. * Pay a license fee. X * Install the seal or consumer X links to the seal program website. * Purchase or install security X software or hardware provided by the seal program. * Profess that the merchant has X full online ordering capability. Independent Evaluations: Does the seal program require merchants to have an initial evaluation as Doesn't follows? Yes No Say * Let a third party to confirm the X existence of the merchant. * Let seal program representatives X confirm the merchant's existence via an on-site visit. [ONLY FOR UNLAUNCHED WEBSITES] * Let seal program representatives X determine if the merchant fully discloses policies, without testing actual merchant performance. * Let seal program representatives X conduct tests to see if the merchant adheres to stated policies and meets performance criteria. * Engage an independent auditor to X determine if the merchant fully discloses policies, without testing actual merchant performance. * Engage an independent auditor to X conduct tests to see if the merchant adheres to stated policies and meets performance criteria. Renewal Requirements: Are specific actions by merchants required to renew their ability to display the Doesn't seal? Yes No Say * Pay a renewal license fee. X * Not have significant consumer X complaints about failure to follow its own stated policies or to quickly resolve consumer problems. * Let seal program representatives X determine if the merchant fully discloses policies, without testing actual merchant performance. * Let seal program representatives X conduct tests to see if the merchant adheres to stated policies and meets performance criteria. * Engage an independent auditor to X determine if the merchant fully discloses policies, without testing actual merchant performance. * Engage an independent auditor to X(*) conduct tests to see if the merchant adheres to stated policies and meets performance criteria only if severe violations were noted in previous merchant performance * Engage an independent auditor to X conduct tests to see if the merchant adheres to stated policies and meets performance criteria. How thoroughly do you feel that the website seal program addresses e-commerce assurance objectives? (Check one answer for each of the Very Very assurance concerns) Good Good Fair Poor Poor * Data Security * Business Policies * Transaction Integrity * Data Privacy * Seal Program Activities Would this web seal program require Yes(*) No a CPA practitioner to make statements that the merchant met X X all the web seal program's criteria in order to obtain, display, or renew the web assurance seal? (Check one answer) (*) links together the responses for renewal requirements with the web seal program EXHIBIT 6. QUESTIONNAIRE FOR WEBTRUST IN STEP 2 Web Seal Program Name: WebTrust Section A. e-commerce assurance concerns of the web assurance seal program. Data Security: Does the seal program require the merchant to provide data security that Doesn't does the following? Yes No Say * Merchant must provide security X for data transmitted from the consumer to the web site (i.e., have a secure server transaction system). * Merchant must provide X security for data that appears on the web site that will be used by the consumer to make transaction decision. Business Policies: Does the seal program require the merchant to have business policies that provide the Doesn't following? Yes No Say * Merchant must display X understandable and consistent policies on the website (e.g., shipping, billing, payments, returns, sales tax). * Merchant must adopt business X policies previously established by the seal program rather than develop his / her own policies. * Merchant is allowed to write X his / her own business policies if the policies comply with principles approved by an acceptable body. * Merchant is required to X maintain a history of adhering to its own policies. * Merchant must demonstrate a X history of not changing these policies frequently. Transaction Integrity: Does the seal program require the merchant to provide transaction Doesn't processing integrity? Yes No Say * Merchant must properly X process all transactions only after gaining the consumer's agreement. * Merchant must respond to X consumer inquiries / complaints in a timely manner. * Merchant must use agreed-to X shipping and pricing data. * Merchant must resolve all X customer problems in a prompt manner. * Merchant must provide a X means for consumers to communicate with the merchant regarding inquiries, follow-up, or complaints. Data Privacy: Does the seal program require the merchant to provide data privacy that Doesn't does the following? Yes No Say * Merchant must display X understandable and consistent policies on the website (e.g., consumer data privacy principles). * Merchant must keep X transaction and personal information about the consumer confidential. * Merchant must adopt privacy X policies previously established by the seal program rather than develop his / her own policies. * Merchant is allowed to write X his/her own privacy policies if the policies comply with principles approved by an acceptable body. * Merchant must allow the X consumer to verify or correct his / her personal data that is maintained on the merchant's computer. * Merchant must release or use X data only as agreed to by the consumer, except as needed to complete the transaction. * Merchant must protect the X consumer's computer from viruses or "cookies", except as needed to complete the transaction. Seal Program Activities: Does the seal program perform activities on behalf of consumers in the following Doesn't areas? Yes No Say * Merchant must allow consumers X to voluntarily document their experiences via the seal program website. * Merchant must let the seal X program summarize or rank consumer experiences with the merchant's history of honoring its policies. * Merchant must agree to X arbitration, let the web seal program intervene on the customer's behalf, or have a similar resolution process. Section B. Specific requirements of the firm to be able to display the seal. Self-Reporting Activities: Does the seal program require merchants to self-report the Doesn't following items? Yes No Say * Proof of having conducted X business for a specified period of time. * Agree to abide by the seal X program's requirements. * Pay a license fee. X [ENGAGEMENT CHARGES OF CPA PRACTITIONER] * Install the seal or consumer X links to the seal program website. * Purchase or install security X software or hardware provided by the seal program. * Profess that the merchant has full online ordering capability. Independent Evaluations: Does the seal program require merchants to have an initial Doesn't evaluation as follows? Yes No Say * Let a third party to confirm X the existence of the merchant. [CPA PRACTITIONER] * Let seal program X representatives confirm the merchant's existence via an on-site visit. * Let seal program X representatives determine if the merchant fully discloses policies, without testing actual merchant performance. * Let seal program X representatives conduct tests to see if the merchant adheres to stated policies and meets performance criteria. * Engage an independent auditor to determine if the merchant X fully discloses policies, without testing actual merchant performance. * Engage an independent auditor X to conduct tests to see if the merchant adheres to stated policies and meets performance criteria. Renewal Requirements: Are specific actions by merchants required to renew their ability Doesn't to display the seal? Yes No Say * Pay a renewal license fee. X [ENGAGEMENT CHARGES OF CPA PRACTITIONER] * Not have significant consumer X complaints about failure to follow its own stated policies or to quickly resolve consumer problems. * Let seal program X representatives determine if the merchant fully discloses policies, without testing actual merchant performance. * Let seal program X representatives conduct tests to see if the merchant adheres to stated policies and meets performance criteria. * Engage an independent auditor X to determine if the merchant fully discloses policies, without testing actual merchant performance. * Engage an independent auditor X to conduct tests to see if the merchant adheres to stated policies and meets performance criteria only if severe violations were noted in previous merchant performance * Engage an independent auditor X to conduct tests to see if the merchant adheres to stated policies and meets performance criteria. How thoroughly do you feel that the website seal program addresses e-commerce assurance objectives? (Check one answer for each of the assurance Very Very concerns) Good Good Fair Poor Poor * Data Security * Business Policies * Transaction Integrity * Data Privacy * Seal Program Activities Would this web seal program Yes No require a CPA practitioner to make statements that the all X the merchant met web seal program's criteria in order to obtain, display, or renew the web assurance seal (Check one answer) EXHIBIT 7. QUESTIONNAIRE FOR ePUBLICEYE IN STEP 2 Web Seal Program Name: ePublicEye Section A. e-commerce assurance concerns of the web assurance seal program. Data Security: Does the seal program require the merchant to provide data security that Doesn't does the following? Yes No Say * Merchant must provide security X for data transmitted from the consumer to the web site (i.e., have a secure server transaction system). * Merchant must provide security X for data that appears on the web site that will be used by the consumer to make transaction decision. Business Policies: Does the seal program require the merchant to have business policies that provide the Doesn't following? Yes No Say * Merchant must display X understandable and consistent policies on the website (e.g., shipping, billing, payments, returns, sales tax). * Merchant must adopt business X policies previously established by the seal program rather than develop his / her own policies. * Merchant is allowed to write X his / her own business policies if the policies comply with principles approved by an acceptable body. * Merchant is required to X maintain a history of adhering to its own policies. * Merchant must demonstrate a X history of not changing these policies frequently. Transaction Integrity: Does the seal program require the merchant to provide transaction Doesn't processing integrity? Yes No Say * Merchant must properly process X all transactions only after gaining the consumer's agreement. * Merchant must respond to X consumer inquiries / complaints in a timely manner. * Merchant must use agreed-to X shipping and pricing data. * Merchant must resolve all X customer problems in a prompt manner. * Merchant must provide a means X for consumers to communicate with the merchant regarding inquiries, follow-up, or complaints. Data Privacy: Does the seal Doesn't program require the merchant to Yes No Say provide data privacy that does the following? * Merchant must display X understandable and consistent policies on the website (e.g., consumer data privacy principles). * Merchant must keep transaction X and personal information about the consumer confidential. * Merchant must adopt privacy X policies previously established by the seal program rather than develop his / her own policies. * Merchant is allowed to write X his / her own privacy policies if the policies comply with principles approved by an acceptable body. * Merchant must allow the X consumer to verify or correct his / her personal data that is maintained on the merchant's computer. * Merchant must release or use X data only as agreed to by the consumer, except as needed to complete the transaction. * Merchant must protect the X consumer's computer from viruses or "cookies", except as needed to complete the transaction. Seal Program Activities: Does the seal program perform activities on behalf of consumers in the following Doesn't areas? Yes No Say * Merchant must allow consumers X to voluntarily document their experiences via the seal program website. * Merchant must let the seal X program summarize or rank consumer experiences with the merchant's history of honoring its policies. * Merchant must agree to X arbitration, let the web seal program intervene on the customer's behalf, or have a similar resolution process. Section B. Specific requirements of the firm to be able to display the seal. Self-Reporting Activities: Does the seal program require merchants to self-report the Doesn't following items? Yes No Say * Proof of having conducted X business for a specified period of time. * Agree to abide by the seal X program's requirements. * Pay a license fee. X * Install the seal or consumer X links to the seal program website. * Purchase or install security X software or hardware provided by the seal program. * Profess that the merchant has X full online ordering capability. Independent Evaluations: Does the seal program require merchants to have an initial Doesn't evaluation as follows? Yes No Say * Let a third party confirm the X existence of the merchant. * Let seal program X representatives confirm the merchant's existence via an on-site visit. * Let seal program X representatives determine if the merchant fully discloses policies, without testing actual merchant performance. * Let seal program X representatives conduct tests to see if the merchant adheres to stated policies and meets performance criteria. * Engage an independent auditor X to determine if the merchant fully discloses policies, without testing actual merchant performance. * Engage an independent auditor X to conduct tests to see if the merchant adheres to stated policies and meets performance criteria. Renewal Requirements: Are specific actions by merchants required to renew their ability Doesn't to display the seal? Yes No Say * Pay a renewal license fee. X * Not have significant consumer X complaints about failure to follow its own stated policies or to quickly resolve consumer problems. * Let seal program X representatives determine if the merchant fully discloses policies, without testing actual merchant performance. * Let seal program X representatives conduct tests to see if the merchant adheres to stated policies and meets performance criteria. * Engage an independent auditor X to determine if the merchant fully discloses policies, without testing actual merchant performance. * Engage an independent auditor X to conduct tests to see if the merchant adheres to stated policies and meets performance criteria only if severe violations were noted in previous merchant performance * Engage an independent auditor X to conduct tests to see if the merchant adheres to stated policies and meets performance criteria. How thoroughly do you feel that the website seal program addresses e-commerce assurance objectives? (Check one answer for each of the assurance Very Very concerns) Good Good Fair Poor Poor * Data Security * Business Policies * Transaction Integrity * Data Privacy * Seal Program Activities Would this web seal program Yes No require a CPA practitioner to make statements that the X merchant met all the web seal program's criteria in order to obtain, display, or renew the web assurance seal? (Check one answer) EXHIBIT 8. QUESTIONNAIRE FOR AT101 IN STEP 3 Section A. Identify the professional standard you are reviewing. Identify the Standard by number AT101--Attest Engagements (e.g., AT101, AT201, CS100, etc.) and write the exact title. Briefly summarize the stated Used when a CPA practitioner is purpose of the standard (e.g., engaged to issue an examination, when it is appropriate to use a review, or an agreed-upon this specific standard). procedures report on assertions or subject matter that is the responsibility of another party. Section B. With regard to this specific professional standard, can this standard be used by a CPA practitioner to support an engagement designed to accomplish the Don't following purpose? Yes No Know To perform an attest level engagement for X the purpose of obtaining a web assurance seal to display on the client's website. To perform an attest level engagement on X certain procedures related to the Trust Services principles. If you answered "No" to BOTH of the questions above, SKIP THE REMAINING SECTIONS of this questionnaire. If you answered "Yes" to ONE OR BOTH questions above, complete the remaining sections of this questionnaire. Section C. Identify the characteristics Don't required of the investigation. Yes No Know Does the professional standard require X that a "responsible party" be identified who will provide the assertions or who is responsible for the subject matter being investigated? For a web The management of the X assurance client who engages the CPA engagement, who practitioner to evaluate would be the the web site "responsible party" if one The organization that X is needed? administers the web seal program The CPA practitioner who X was hired to conducting the investigation Where could the The client or party X criteria come responsible for the subject from that will matter being investigated be used to evaluate the A body designated by the X assertions or AICPA governing council the subject matter being Groups composed of experts X evaluated? who follow due process procedures Industry associations X Other groups who do not X follow due process procedures What type(s) of Examination X investigation(s) can be performed Review X under this standard? (Use Agreed-Upon Procedures X your answer here to guide your Consulting Services X answers to Engagement Sections D, E & F below.) Section D. Report Type: For only each type Don't of investigation checked in Section C above, Yes No Know indicate the type of report that can be issued. You checked an The AICPA places NO X EXAMINATION restrictions on the investigation in content of the report. Section C above. Report must express a X positive opinion about the assertions or subject matter conforming to the evaluation criteria (unqualified, qualified, adverse, or disclaimer). Report must state that is X was a lesser investigation, express no opinion, and express only negative assurances. Report must identify the X test(s) performed and the specific findings (express no opinion or negative assurances). You checked a The AICPA places NO X REVIEW restrictions on the content investigation of the report. in Section C above. Report must express a X positive opinion about the assertions or subject matter conforming to the evaluation criteria (unqualified, qualified, adverse, or disclaimer). Report must state that is X was a lesser investigation, express no opinion, and express only negative assurances. Report must identify the X test(s) performed and the specific findings (express no opinion or negative assurances). You checked an The AICPA places NO X AGREED-UPON restrictions on the content PROCEDURES of the report. investigation in Section C Report must express a X above. positive opinion about the assertions or subject matter conforming to the evaluation criteria (unqualified, qualified, adverse, or disclaimer). Report must state that is X was a lesser investigation, express no opinion, and express only negative assurances. Report must identify the X test(s) performed and the specific findings (express no opinion or negative assurances). You checked a The AICPA places NO CONSULTING restrictions on the content SERVICES of the report. engagement in Section Report must express a C above. positive opinion about the assertions or subject matter conforming to the evaluation criteria (unqualified, qualified, adverse, or disclaimer). Report must state that is was a lesser investigation, express no opinion, and express only negative assurances. Report must identify the test(s) performed and the specific findings (express no opinion or negative assurances). Section E. Report Distribution: For only Don't each type of investigation checked in Yes No Know Section C above, indicate how the report can be distributed You checked an The AICPA places NO X EXAMINATION restrictions on the investigation in distribution of the report. Section C above. The report can be generally X distributed unless the criteria used are appropriate or available to only a limited number of parties, or when reporting on subject matter and written assertions were not provided by the responsible party. The report must be X restricted to specified readers who agree to accept the specific tests performed. You checked a The AICPA places NO X REVIEW restrictions on the investigation in distribution of the report. Section C above. The report can be generally X distributed unless the criteria used are appropriate or available to only a limited number of parties, or when reporting on subject matter and written assertions were not provided by the responsible party. The report must be X restricted to specified readers who agree to accept the specific tests performed. You checked an The AICPA places NO X AGREED-UPON restrictions on the PROCEDURES distribution of the report. investigation in Section C above. The report can be generally X distributed unless the criteria used are appropriate or available to only a limited number of parties, or when reporting on subject matter and written assertions were not provided by the responsible party. The report must be X restricted to specified readers who agree to accept the specific tests performed. You checked a The AICPA places NO CONSULTING restrictions on the SERVICES distribution of the report. engagement in Section C above. The report can be generally distributed unless the criteria used are appropriate or available to only a limited number of parties, or when reporting on subject matter and written assertions were not provided by the responsible party. The report must be restricted to specified readers who agree to accept the specific tests performed. Section F. General Standards: Within this specific professional standard, indicate if the standard requires CPA practitioner Don't independence or special training Yes No Know Is independence The AICPA imposes no X needed for this independence restrictions engagement? on the CPA practitioner for this engagement The CPA practitioner must X not do any other accounting or auditing services during this engagement The CPA practitioner must X not do any other consulting services for the client during the engagement The CPA practitioner must X maintain independence in mental attitude (be honest, impartial, unbiased) The CPA practitioner must X avoid conflicts of interest that would impair the practitioner's objectivity Is special There are no requirements X training needed stated about competence, for this technical training, engagement? * proficiency, or special knowledge The CPA practitioner must X possess additional skills to perform a web assurance engagement. The CPA practitioner must X possess professional competence in the engagement being undertaken * HINT: In addition to this specific professional standard look at the WebTrust internet site identified earlier. EXHIBIT 9. QUESTIONNAIRE FOR AT201 IN STEP 3 Section A. Identify the professional standard you are reviewing. Identify the Standard by number AT201--Agreed-Upon Procedures (e.g., AT101, AT201, CS100, etc.) Engagements and write the exact title. Briefly summarize the stated Used when a CPA practitioner purpose of the standard (e.g., performs and reports on all when it is appropriate to use agreed-upon procedures engagements. this specific standard). That is an engagement in which the CPA practitioner is engaged to issue a report of findings based upon specific procedures performed on a subject matter Section B. With regard to this specific professional standard, can this standard be used by a CPA practitioner to support an engagement designed to accomplish the Don't following purpose? Yes No Know To perform an attest level engagement for X the purpose of obtaining a web assurance seal to display on the client's website. To perform an attest level engagement on certain procedures related to the Trust X Services principles. If you answered "No" to BOTH of the questions above, SKIP THE REMAINING SECTIONS of this questionnaire. If you answered "Yes" to ONE OR BOTH questions above, complete the remaining sections of this questionnaire. Section C. Identify the characteristics Don't required of the investigation. Yes No Know Does the professional standard require that X a "responsible party" be identified who will provide the assertions or who is responsible for the subject matter being investigated? For a web The management of the assurance client who engages the CPA engagement, who practitioner to evaluate would be the the web site responsible party if one is The organization that needed? administers the web seal program The CPA practitioner who was hired to conducting the investigation Where could the The client or party X criteria come responsible for the subject from that will matter being investigated be used to evaluate the A body designated by the X assertions or AICPA governing council the subject matter being Groups composed of experts X evaluated? who follow due process procedures Industry associations X Other groups who do not X follow due process procedures What type(s) of Examination X investigation(s) can be performed Review X under this standard? (Use Agreed-Upon Procedures X your answer here to guide your Consulting Services X answers to Engagement Sections D, E & F below.) Section D. Report Type: For only each type Don't of investigation checked in Section C above, Yes No Know indicate the type of report that can be issued. You checked an The AICPA places NO EXAMINATION restrictions on the investigation in content of the report. Section C above. Report must express a positive opinion about the assertions or subject matter conforming to the evaluation criteria (unqualified, qualified, adverse, or disclaimer). Report must state that is was a lesser investigation, express no opinion, and express only negative assurances. Report must identify the test(s) performed and the specific findings (express no opinion or negative assurances). You checked a The AICPA places NO REVIEW restrictions on the investigation in content of the report. Section C above. Report must express a positive opinion about the assertions or subject matter conforming to the evaluation criteria (unqualified, qualified, adverse, or disclaimer). Report must state that is was a lesser investigation, express no opinion, and express only negative assurances. Report must identify the test(s) performed and the specific findings (express no opinion or negative assurances). You checked an The AICPA places NO X AGREED-UPON restrictions on the content PROCEDURES of the report. investigation in Section C Report must express a above. positive opinion about the X assertions or subject matter conforming to the evaluation criteria (unqualified, qualified, adverse, or disclaimer). Report must state that is X was a lesser investigation, express no opinion, and express only negative assurances. Report must identify the X test(s) performed and the specific findings(express no opinion or negative assurances). You checked a The AICPA places NO CONSULTING restrictions on the content SERVICES of the report. engagement in Section C above. Report must express a positive opinion about the assertions or subject matter conforming to the evaluation criteria (unqualified, qualified, adverse, or disclaimer). Report must state that is was a lesser investigation, express no opinion, and express only negative assurances. Report must identify the test(s) performed and the specific findings (express no opinion or negative assurances). Section E. Report Distribution: For only each type of investigation checked in Section C above, indicate how the report Don't can be distributed Yes No Know You checked an The AICPA places NO EXAMINATION restrictions on the investigation in distribution of the report. Section C above. The report can be generally distributed unless the criteria used are appropriate or available to only a limited number of parties, or when reporting on subject matter and written assertions were Not provided by the responsible party. The report must be restricted to specified readers who agree to accept the specific tests performed. You checked a The AICPA places NO REVIEW restrictions on the investigation in distribution of the report. Section C above. The report can be generally distributed unless the criteria used are appropriate or available to only a limited number of parties,or when reporting on subject matter and written assertions were not provided by the responsible party. The report must be restricted to specified readers who agree to accept the specific tests performed. You checked an The AICPA places NO X AGREED-UPON restrictions on the PROCEDURES distribution of the report. investigation in Section C The report can be generally X above. distributed unless the criteria used are appropriate or available to only a limited number of parties, or when reporting on subject matter and written assertions were notprovided by the responsible party. The report must be X restricted to specified readers who agree to accept the specific tests performed. The AICPA places NO restrictions on the You checked a distribution of the report. CONSULTING SERVICES The report can be generally engagement distributed unless the in Section C criteria used are above. appropriate or available to only a limited number of parties, or when reporting on subject matter and written assertions were not provided by the responsible party. The report must be restricted to specified readers who agree to accept the specific tests performed. Section F. General Standards: Within this Don't specific professional standard, indicate Yes No Know if the standard requires CPA practitioner independence or special training Is independence There AICPA imposes no X needed for this independence restrictions engagement? on the CPA practitioner for this engagement The CPA practitioner must X not do any other accounting or auditing services during this engagement The CPA practitioner must X not do any other consulting services for the client during the engagement The CPA practitioner must X maintain independence in mental attitude (be honest, impartial, unbiased) The CPA practitioner must X avoid conflicts of interest that would impair the practitioner's objectivity Is special There are no requirements X training needed stated about competence, for this technical training, engagement? * proficiency, or special knowledge The CPA practitioner must X possess adequate technical training, proficiency, and knowledge of the subject The CPA practitioner must X possess professional competence in the engagement being undertaken * HINT: In addition to this specific professional standard look at the WebTrust internet site identified earlier.