Technology standards & the tax function: hosting issues, cloud-based data aggregation, and cybersecurity protection - mixed in with corporate tax requirements - are among the key concerns.

• Author: Levin-Epstein, Michael
• Position: Discussion

[ILLUSTRATION OMITTED]

As technology standards continue to change, so do their impact on the tax function and corporate tax professionals. Tax Executive convened a roundtable to discuss the burgeoning relationship among technology standards, tax requirements, and the changing dynamics of tax professionals. Kelly Necessary, senior director of tax at Time Warner Cable; Stephen McGerty, head of ONESOURCE Firm Edition at Thomson Reuters; and Luis Perez, senior manager of global tax automation and operations at Dell, participated in the discussion. Roundtable No. 9 was moderated by Tax Executive Senior Editor Michael Levin-Epstein.

[ILLUSTRATION OMITTED]

[ILLUSTRATION OMITTED]

[ILLUSTRATION OMITTED]

Michael Levin-Epstein: What are the technology standards that impact the tax function?

Stephen McGerty: You're likely to encounter a variety of technology standards from one organization to the next. Working at Thomson Reuters has given me the opportunity to help many companies with their direct income tax challenges, mostly through implementing ONESOURCE. You can categorize these standards into different levels. At the lowest level, you're concerned with where your tax technology solutions reside. Most ONESOURCE solutions are hosted in the cloud. Your IT groups are going to be concerned about the security of any cloud-based solution. So, like many vendors, Thomson Reuters puts in place sensible, modern protection mechanisms around the data and the servers that make up our cloud offerings.

As part of that process, we also have independent audits of that security, and these audit results are provided on request to our customers. If you're caught between wanting the convenience of a cloud-based software solution and your IT group's concerns about data security, these audits are often what's needed. In the circumstance where people are putting software on servers in their own environment, as opposed to the cloud, there tend to be a different set of standards to comply with, often focused on how the software is installed and maintained, as well as how it is administered.

At the higher levels, there are often standards around what software is preferred and how it should integrate with existing software in the organization. You'll often have situations where there is a preferred vendor for a certain type of solution because companies are looking to standardize the way they do things. There is often a desire to buy a software suite from one vendor to avoid challenges of integrating solutions from a variety of vendors. You may encounter a desire to use a specific piece of software for a particular function across the organization, common examples being document management and workflow. The noble goal of a standard is to ensure consistency, but sometimes individual standards don't work too well for tax departments, given the particular challenges they face.

Kelly Necessary: I think of two items: one which leverages what Stephen said, and the other around hosting rules. We have a standard acceptable-use policy for technologies that impact tax in our use to house sensitive, private, confidential, or restricted information, whether company or customer data. As I perform my duties in income tax, we often use potentially sensitive information, whether it be for tax reporting, in preparation of some of our credits and incentives, or even in defense of our tax returns when we're dealing with the audit authorities. We have a cyber risk team that monitors our use of tax databases to store this type of company or customer information needed for tax. In particular, beware of restrictions for use of certain third-party, cloud-based databases. We often speak to our technology department about the possibility of company-owned cloud-based technology solutions, given restrictions that may impact us if we try to use a third-party-vendor, cloud-based solution. In fact, our accounts payable department often monitors the invoices coming in and will question anything that looks like it's generated from a third-party database vendor. This policy can impact our access to information and the ability for us to use it and/or to timely import it into our tax system.

The second technology standard impacting our tax function concerns the hosting of tax software. Any tax process that ties closely to our critical company processes or customer data must be hosted in-house on our server. This is troublesome for some areas of tax, such as sales tax, given the magnitude of taxes and fees on our customer bills. We needed a tax system in order to assist us in making the appropriate tax determinations for the offerings to our customers, and we were required to build a custom solution hosted and owned by us. Alternatively, as Stephen alluded to, in an area like tax provision, where we use the ONESOURCE tax provision software, there is no option to host the system on our company server. In this instance, we had to work with our technology group to implement additional controls and Sarbanes-Oxley (SOX) testing around the system, in order to confirm to our technology group that the system is sufficient to sustain confidentiality and adheres to all of our technology standards.

Luis Perez: There generally are a set of standards that IT is working from, for example, trying to leverage enterprise resource planning (ERP) as much as possible in tax or finance and avoiding additional costs, licenses, or what they consider customizations. There are...