Close
Most businesses, including virtually all CPA firms, are dependent on Microsoft Office applications, particularly word processing and spreadsheets for creating client documents. While accounting firms have benefitted from these tools, there are valid concerns that they may be inadvertently exposing confidential data through the metadata captured within these documents. Metadata is information stored in documents about the client or subject it was originally created for, when it was revised or saved, and anyone that might have made edits. Metadata can be added to documents whenever any change is made and that document subsequently saved. This can include information captured by opening documents from one client and then saving as a new file for another client. Metadata also can also be created using the track changes feature and not properly cleaning up the comments. Some firms and individuals purposely use metadata to find information quickly or organize files, but if your firm chooses to do so, your personnel must be made aware of what data is captured and see that proper quality control procedures are mandated before finalizing any document and providing it to a client in an electronic format.
It is fairly easy to access the metadata tagged in a document in Microsoft Word, Excel, and PowerPoint. Within Office 2007, the metadata can be viewed by going to the Office Button and selecting the Prepare and Properties tabs. While this initial screen will show the documents Author, Title, Subject and a few other data fields, by going to the Document Properties tab and selecting Advanced Properties, additional information on revisions and edits can be exposed including when the document was created and by whom. This can be extremely embarrassing if a client is exposed to the names of other clients or the time they were charged for creating a document from an existing template was minimal. There are also legal concerns if reviewer comments on financial statements were not properly removed and the firm is in litigation regarding the preparation of these financial documents.
So what are firms to do? Once the firm has established whether or not to utilize metadata for the creation and management of client documents, they should designate a process to educate all firm personnel on what metadata is during their normal Office application training sessions. This training should explain how metadata is created, how to discover it, and most importantly, how to properly clean it up at completion of a client engagement. Office 2007 has added a Document Inspector tool in the Prepare tab of the Office Button that will identify and erase all affiliated metadata. This procedure should become part of the normal quality control process for finalization of all Word and Excel documents. Firms should also have ongoing training so that end users are reminded of this feature.
Microsoft Office applications will continue to be an integral tool for many aspects of client production so it is imperative that firms are aware of its features and benefits including the metadata that is inherent with the products and having a standard to deal with it.