At the CPA firm of Hamilton, Boynton and Associates, 35 employees communicate with each other from two different locations - one in Simi Valley and the other in Orange County, Calif. - by using instant messaging."It's a lot quicker than using e-mail," said Robert Gaby, CPA and a partner at the firm. "To slip a note for a quick question, nothing with details - just a 'yes' or 'no' kind of answer - especially when someone is on the phone, is very effective."
Today, many CPA firms are using IM services to connect multi-office locations, correspond with their clients, communicate with partners and other employees during conference calls, and to gain quick answers without having to leave their desks. The safest way to correspond over IM in the workplace is proving to be through enterprise instant messaging gateways and platforms.
However, just as e-mail was once viewed as disruptive and unnecessary, some CPAs find IM a waste of bandwidth.
Despite objections, many CPAs are still very interested in the capabilities of IM in the workplace. In the American Institute of CPAs' 2005 Top Technology concerns survey, released in January, the No. 6 concern for CPA firms was instant messaging, edging out authentication technologies like those protecting employee privacy, and even wireless technologies such as cell phones and personal digital assistants.
Some of the most popular IM brands are the public and free IM services - AOL IM, MSN Messenger, Skype and Yahoo! Messenger, to name a few - that are available for download on the Internet.
In mid-October, Microsoft and Yahoo! announced a partnership for their IM services. By summer 2006, an MSN Messenger user will be able to freely chat with a Yahoo! Messenger user, something that was previously impossible without downloading the other IM software. The move highlights one of the major concerns regarding IM services - the inability to talk across the multiple platforms.
AOL has no plans to partner with other IM service providers, yet remains the predominant IM provider with over 43 million users, 14 million of whom use IM in the workplace.
A new version of AOL IM, dubbed Triton, currently in its beta state and available for download, will make the service easier to use, with features like one window with tabs for each "buddy" that a user is talking to, instead of a different window for each buddy conversation; a choice between sending the message as an e-mail, text message or IM; and a larger buddy list of up to 500.
"We don't necessarily think we're going to change business results," explained AOL spokesperson Krista Thomas, "but we are changing the speed at which business communication flows. The benefit is in how you use it."
However, using a public IM service behind a firewall, even with anti-virus software, will not catch users sending employees viruses, spam and other malicious software.
"Public clients are not ideal for enterprise users. The use of public IM networks has put pressure on IT administrators, who have had to contend with products at the workplace that pose many threats from an IT perspective," said David Alexander, product manager for the Real-Time Collaboration Group at Microsoft Corp. "Public network IM is unencrypted, it moves as clear text through a company firewall and allows for intellectual property to be captured rather easily."
Enterprise instant messaging gateways create an extra layer of security, protection and archival capabilities for IM services in the workplace, such as IMlogic IM, FaceTime, and IronIM from CipherTrust Inc. All three of these EIM gateways use peer-to-peer blocking components to provide extra security to corporate IM solutions like Microsoft's Live Communications Server 2005, IBM's Lotus IM (formerly SameTime), and Jabber.
"A lot of it is based on e-mail security. We've been in that field for five years now," said Alex Hernandez, director of advanced product development at CipherTrust. "Inbound, we protect from viruses, spamming and worms, and outbound, we provide compliance and encryption services."
IronIM messages can cross platforms, speaking to both users of IronIM and those using other IM services, like AIM. However, this can only occur if the policies of both users' companies allow for such communication, and this cross-platform communication is not encrypted and therefore consider insecure.
Don't ban - understand
Many companies prefer not to have any IM services in place within their company network, solving both concerns about security and disruption of workers' time. But to ban IM use entirely, warns vice president and research director at Forrester Nate Root in a paper from November last year, is "usually ineffective and misses an important point: IM can be a valuable business tool, when controlled properly." Root goes on to say that merely providing anti-virus and anti-spam software along with a firewall is not controlling the services properly.
Root recommended that organizations that want to use IM services do so through an EIM platform, like MS LCS, or through an EIM gateway like IronIM. But when choosing an IM service, Root warned to keep in mind that IM will soon be linked to Voice over Internet Protocol and e-mail through one device - so they should buy products using industry standards like the VoIP SIP standard for the "clearest path to inter-operability."
"There are no disadvantages," said Julian Chavez, a partner at Drew, Stafford & Chavez Inc., a CPA firm based in Laguna Hills, Calif. Chavez's firm uses a public IM service from Skype, which is also a free VoIP service, to connect employees from all three of his firms' office locations.
But many CPAs do not share his enthusiasm for IM services in the work place.
"One of the great unknown risks is that recipients are logging you and you are not logging them," said Chaim Yudkowsky, CPA, CITP and director of a nonprofit organization. "If you are not logging them, things can be taken out of context for a criminal investigation. If you don't have your perspective, it can be a challenge."
Keeping records of conversations, even electronic files such as IMs, regarding financial data falls under the retention of workpapers in Sarbanes-Oxley Section 802 regulation, said David Hardesty, CPA and a vice president at Larkspur, Calif.-based CPA firm Wilson, Markle, Stuckey, Hardesty & Bott.
The Securities and Exchange Commission issued a regulation in January 2003 that, as part of SOX, accountants must retain audit and review records for seven years after an audit. However, no one can be certain what data will be needed during a future audit, so, as Hardesty said, it's best to "keep everything."
"With the growth in IM, industry regulators have begun paying attention to IM in the workplace and are viewing it similarly to e-mail," said Microsoft's Alexander. "Companies perceive the need to log all their electronic communications, including instant messages between employees - a capability not provided by public IM technologies."
Still, some CPAs are still not convinced that IM services are an asset rather than a liability.
"We have a policy here, but it's hard to dictate human behavior short of putting a chip in people's brain," joked CPA/CITP Yudkowsky.
Rob Carmines, CPA and partner at the Newport News, Va.-based firm of Carmines, Robbins and Co., is skeptical, too. "One reason we don't allow people to use AOL IM in the office is because it slows down the network," said Carmines. "I don't see the usefulness unless you make it accessible to clients. It's for immediate back and forth, so it doesn't do any good if they are not at their computer. Text messaging has far more benefit than IM applications."
While text messaging is less likely to be abused by employees than IM services - just because of the sheer time it takes to type out a text message - text messages cannot be saved for a long period of time. Much like public IMs, this too creates a Sarbanes-Oxley compliance issue, as well as being impossible to monitor.
"IM becoming a disruptive force is always a concern," said Gaby. "But controlling who has access to the system, just letting users in the office chat ... bringing it in-house, it's the best solution available."
