EU Commission and Basel II
Because of European corporate scandals comparable with those in the United States, the EU Commission is
imposing
similar requirements for improvement in auditing standards, oversight, and responsibilities by creating directives
related
to corporate governance, transparency, audit, accounting standards, and information services. A major difference is that the U.S. Sarbanes-Oxley Act carries
fines
and criminal sanctions, whereas the EU Commission does not recommend that level of enforcement.
Although the Sarbanes-Oxley legislation originated in the United States, there are
ramifications
for companies headquartered in other
countries
. Emerging European professional standards such as those established by the International Accounting Standards Board and the Basel II Capital Accord also will affect many multinational companies.
Basel II Capital Accord
Basel II is a consortium of international banks mostly in Europe but also in the United States and Canada. Initiated in 1974, the
group
publishes
accords
that cover a variety of banking topics and are intended to provide increased supervision and oversight of international banks. The advisory committee intended to promulgate a variety of technical and financial standards. The focus of the group is to provide a risk-management framework around capitalization standards for international banks. The Basel II accords are entirely voluntary, and any adoption is governed by the central bank of each country.
The Basel II Capital Accord is the most recent and most visible of the recommendations. The
intention
of this accord is to implement increased risk-management and capital-
supervisory
regulations
governing
the capital adequacy of internationally active banks.
In general, the Basel II Capital Accord provides for IT controls revolving around risk management in relation to loans. Therefore, as with Sarbanes-Oxley, the IT
auditor
should be
concerned
primarily with controls that protect the integrity of financial information.
Payment Card Industry (PCI) Data Security Standard
Visa USA created the
Cardholder Information Security Program
(CISP) in mid-2001. The standard became a requirement for Visa member banks. The CISP program was intended to ensure high levels of information security for Visa cardholder data. The security standard applies to all Visa member banks,
merchants
accepting Visa cards, and all service providers processing Visa cardholder transactions. In 2004, the data security standards were cosponsored by Visa and MasterCard into an industry standard now known as the
Payment Card Industry Data Security Standard.
Other card
issuers
have adopted the standard and incorporated it into their own programs. In addition, an international version of the VISA CISP program called the
Visa Account Information Security
(AIS) applies to non-U.S.-based entities.
The PCI standard is not a law per se, but it is a mandatory compliance requirement for
participants
in the card payment-processing industry. Generally speaking, any entity, system, or component that handles Visa cardholder information
anywhere
in the value chain is subject to the standard if they wish to
remain
a participant in the Visa payment-processing system.
Participants in the Visa payment-processing system not only must adopt PCI but also must validate compliance with the standard. Specific standards apply to various sections of the payment-processing environment. Specific compliance standards and auditing requirements are published for member banks, merchants, and service providers. The auditing standards and compliance requirements are very specific and scaled to fit the relative risks represented by the various classifications.
In order to facilitate the program, Visa and other card issuers have published lists of organizations authorized to conduct validation inspections (
audits
), as well as conduct incident-response investigations. The publication of the auditing standards, approved service providers, and the various approved auditing organizations has
served
to raise the bar significantly on information security in the payment-processing industry.
PCI Impact on the Payment Card Industry
{% if main.adsdop %}{% include 'adsenceinline.tpl' %}{% endif %}
Conformance to the PCI data security standard represented by PCI has become a "cost of doing business." In order to participate in the card payment-processing industry, conformance is not negotiable. The only
enforcement
necessary to ensure adoption of the standard is exclusion from participation in the industry. Visa, MasterCard, and other card issuers have "decertified" service providers for
nonconformance
with the standard. The most notable of these events have occurred after disclosure of security breaches resulting in loss of cardholder private data.
From a data security standpoint, the PCI standard represents commonly accepted data security standards and practices. There is nothing extraordinary in the standard. It is a set of standard best practices already well accepted in the IT security field. While the PCI standard represents basic security practices, the
imposition
of the PCI standard on the card payment-processing industry has had a dramatic impact on the technical infrastructure of the industry.
PCI has changed the focus of every software developer of card payment-processing software in any form to shift from adding feature functionality and reducing cost to restructuring their software to accommodate the standard. The impact has been felt across the spectrum of commercial software and system providers to individual retailers who develop and maintain their own systems. Similar to the general impact of SOX, the PCI standard has added vocabulary regarding standards, controls, and audits to an entire industry from smallest to largest and across the spectrum of industries.
A specialized cottage industry has arisen from the introduction of the standard around evaluating conformance to the PCI standard, testing for conformance, and training companies on how to assess and
comply
with the standard. While the standard does not represent cutting-edge security technology, the introduction and enforced compliance with the standard changed the entire card payment-processing industry in less than 4
years
.