UK: WebTrust Seal Sets The Standard For E-Commerce Security

UK consumers will be able to buy with greater confidence over the Internet from today with the launch of the first public WebTrust-accredited site.

WebTrust is an international e-commerce seal of approval designed to improve the confidence and security of consumers and businesses trading on the Internet by applying and enforcing strict conditions of good business practice. It is operated in the UK by the Institute of Chartered Accountants (ICAEW), which trains and licenses member firms to undertake compliance audits and authorise use of the WebTrust seal.

The first seal for a company offering goods and services to the general public has been awarded to internet mortgage providers First Active Financial plc whose e-business standards and procedures were verified to WebTrust standard by the Information Risk Management practice of accountants and business advisors KPMG.

E-shoppers using sites displaying the WebTrust seal will have the assurance that the business has had a rigorous audit conducted on site by an independent firm of chartered accountants. The assessment process involves the following areas.

• Privacy: strict confidentiality of information provided by customers. Only information that a customer knowingly submits is obtained and used. This, for example, extends to prohibition on "ET Programs" such as zBubbles which covertly copy non-connected data from a user's machine
• Security standards: correct security systems are both in place and tested including firewalls, data access controls and encryption to prevent hacking attacks and other unauthorised disclosures of information such as customer credit card details.
• Transaction integrity and completeness: the ways goods and services are delivered to the customer, such as call centres, mail room and warehouse operations, are inspected.
• Business disclosures on the website: full terms and conditions surrounding the goods and services on offer are displayed, complying with a WebTrust check list designed to prevent unethical practices.
• Consumer recourse. clear explanations are displayed on the website of how a consumer can complain if dissatisfied, including details of an independent arbitration process as a final recourse.
• Proactive and comprehensive e-commerce fraud deterrent. In addition to protecting against fraudulent activity by third parties, WebTrust will monitor controls to ensure the identification of fraudulent activity on the part of the e-tailer
• Compliance with relevant UK legislation including Data Protection Act and VAT regulations.
• In addition the consumer will also have the benefit of an internationally accepted seal of approval. WebTrust is now used by 12 Accounting Institutes covering most of the principal financial centres around the world and, through KPMG, in 159 countries worldwide

Besides the initial assessment, WebTrust companies must undergo continuing audits - at least every three months or when there has been a major change in business practice - if they are to retain their WebTrust seal.

Robert Coles, Head of Information Security Services at KPMG commented " We are delighted that we were involved in the first significant WebTrust seal in the UK. We will be encouraging our other e-commerce clients to follow First Active. Traders as well as consumers will benefit from the confidence created by the rigorous certification process. KPMG is often called in by e-businesses to repair the results of security breaches. WebTrust certification should do much to ensure that these breaches do not occur in the first place."

Chris Howard, Director of Assurance Services and Strategy at the ICAEW added: "The ICAEW is committed to establishing WebTrust as the e-commerce standard for websites. This standard is rapidly gaining recognition. Four more leading accounting Institutes based in Holland, Denmark, Spain and Hong Kong signed up to WebTrust in the past week and an increasing number of successful e-commerce businesses are obtaining the WebTrust seal to demonstrate their commitment to a safety conscious internet society."

Copyright © KPMG International 2000. All rights reserved.