Addressing the Challenges of the ‘Bring Your Own Device Opportunity

The advancing capabilities of smartphones have triggered drastic changes within the workplace, such as the introduction of "bring your own device" (BYOD) programs. BYOD programs have resulted from the escalating importance of smartphones, tablets, and mobile computing in offices, school, and government offices. Companies have seen numerous benefits-increased employee satisfaction, improved productivity, reduced costs, and an expanded number of mobile users-from allowing employees to use their own devices in the workplace. But companies are also facing new security, policy, and legal challenges as employees use personal mobile devices to access networks and confidential data. Although these changes continue to grow in complexity, companies have found few solutions to the challenges they present.

The BYOD Revolution

Many companies, charitable organizations, and government agencies are considering the implementation of BYOD programs. As an alternative to traditional work environments, these programs allow employees to utilize a personal computing device for conducting business processes and accessing company data ("Bring Your Own Device," White House, Aug. 23, 2012, http://www.whitehouse.gov/ digitalgov/bring-your-own-device).

This movement has gained momentum as the use of mobile devices has grown; in 2012, 44% of Americans owned a anartphone; of these individuals, 71% used their smartphones in the workplace ("Our Mobile Planet: United States," Ipsos OTX MediaCT and Google, May 2012, http://services.google.com/fh/files/blogs/ our_mobile_planet_us_en.pdf). According to the same study, 96% of consumers have researched a product or service on their device, and 35% have made a purchase on their phone. Individual consumers are more likely to make changes to their lifestyle than their business counterparts because they have a lower level of risk; as a result, service providers have shifted their focus toward innovation for consumers (Henky Agusleo and Jeremy Uy, "Exploring Two-Sided Business Models for Service Providers: Creating Profitability through Innovation," Cisco, August 2010, http://www.cisco.com/web/about/ac79/ docs/pov/TwoSided_Model_POV_083110 _FINAL.pdf).

Some businesses have begun to see this shift as an opportunity to merge new technologies with their business needs (David A. Willis, "Bring Your Own Device: New Opportunities, New Challenges," Gartner, Aug. 16,2012). For example, commuters commonly respond to e-mails or produce documents while technically being "off the clock." Companies see this as an opportunity to implement BYOD programs, with specific regulations (e.g., adjusting software to business needs and facing the risks and challenges of these innovations).

The Benefits of BYOD Programs

The organizations that approach BYOD programs in the correct manner are gaming valuable competitive advantages within their industries. According to a recent study conducted by EWeek, 70% of IT decision makers believe that BYOD programs improve their work processes, and 74% experienced improved employee productivity after implementing a BYOD program (Nathan Eddy, "BYOD Programs Essential to Business Success: Dell," January 2013). By allowing employees to use devices they are comfortable with, companies can move through business processes at a faster speed, thereby improving customer response time.

According to a Gartner report, the best approach is an "opt-in" program, which gives employees-who will gain satisfaction from participation-the option of joining; employees who do not have advanced devices are not forced to participate, which almost guarantees increased employee satisfaction from the program (Janessa Rivera, "Gartner Says Bring Your Own Device Programs Herald the Most Radical Shift in Enterprise Client Computing Since the Introduction of the PC," Aug. 28, 2012, https://www.gartner.com/newsroom/id/ 2136615?brand=l). Increased employee satisfaction also results from increased flexibility-for example, at the Alcohol and Tobacco Tax and Trade Bureau (TTB), telecommuting employees are provided with remote access through BYOD programs or bureau-provided devices (White House 2012). The use of BYOD programs allows employees to complete their work in the privacy of their homes at convenient hours. This flexibility not only increases the number of mobile users within the company but can also improve communication between employees.

BYOD programs go beyond improving employee conditions: organizations benefit from reduced costs. For example, after implementing a BYOD program, the State of Delaware saw its current wireless expenditures reduced by almost one half (White House 2012). A company in Singapore had similar results; it reduced hardware costs and improved response times for workrelated matters by allowing employees to engage in a BYOD program (Liau Yun Qing, "BYOD on Rise in Asia, but Challenges Remain," ZDNet, February 2013). Some organizations experience cost reductions after implementing a BYOD program because they limit costs of reimbursement for devices, as well as the costs of support for device access, applications, and data; however, not all organizations will see such cost reductions.

Challenges of BYOD Programs

Despite the numerous benefits of BYOD programs, organizations still face policy, legal, and security challenges. Before implementing a similar program, companies should consider the risks involved. One of the biggest challenges is the lack of a standard set of protocols for BYOD programs, which leaves many organizations unaware of the security risks or unsure of which policies they can set up on their own. A study conducted by research firm ITIC found that 71% of businesses that allow BYOD have no specific policies or procedures in place to ensure security (Mary Brandel, "Seven BYOD Policy Essentials," Network World, October 2012). These businesses are putting themselves at risk and may face legal and security ramifications. For example, is the company allowed to wipe the personal device of a terminated employee who was involved in a BYOD program? Without a strict policy outlining the employer's right to wipe a device clean, organizations face legal action for conducting such wipes, regardless of the specific material that is cleared from the device (Brandel 2012).

Equal-access questions present another challenging legal issue for BYOD programs (White House 2012). If an employee is unable to financially provide the same quality device as another individual, can the company hold them liable for a lack of security? Complex legal challenges also include supply-chain risk management and legal discovery.

Perhaps the most substantial challenges of BYOD programs relate to security risks. Within an organization's network, IT departments can maintain the security requirements of hardware and can set password control and encryption; however, without knowledge of the legal ramifications or a set of policies for BYOD hardware, confidential data can be leaked for use by competitors or to hurt the organization's profitability. In addition, a breach of hardware security can give unauthorized individuals access to more secure data and networks.

Companies should also consider additional challenges, such as employees who work internationally-for example, some countries might consider remote wipes of personal devices to be illegal. Furthermore, although personal devices could be utilized in simple work environments, employees might be less willing to use smartphones at higher data-plan rates when offered the same reimbursement rate (White House 2012). These cost challenges also arise when training users on security risks and investing in the global platform necessary for some larger-scale BYOD programs (Qing 2013).

Future Risks and Possible Responses

Goal convergence occurs when related, but distinctly separate, trends are working toward an overall goal. With the various challenges introduced by BYOD, organizations would be well advised to remain mindful of achieving goal convergence, rather than introducing goal conflicts; in this way, technology can serve the best interests of the organization as a whole. Although some organizations might respond impulsively to some of these challenges, there are rational and strategic ways to significantly reduce the risks associated with BYOD programs. For example, companies can utilize new device technologies and applications or even current technologies, such as virtual desktops. In addition, the communication and implementation of a company-wide policy should be maintained.

As the business environment evolves, managers continue to consider possible solutions to the challenges of BYOD programs. With more advanced smartphone applications, risks to the security of communications-in particular, mobile e-mail-become greater; however, recently developed mobile devices have more advanced security, better functionality, and tiie ability to run a single client over multiple device families. This helps assuage some of these security concerns.

Furthermore, dual-identity phones, currently in production and slated for release later this year, enable users to run two separate interfaces on the same device; this would provide additional security for organizations by dividing work and personal data (Lucas Mearían, "Dual-Identity Smartphones Could Bridge BYOD Private, Corporate Divide," Computerworld, November 2012, http://www.computerworld.eom/s/ article/923 3 83 4/Dual_identity_ smartphonescouldbridgeB Y 0D_ pri vate_corporate_di vide).

The TTB introduced another alternative by setting up virtual desktops that avoided saving data on personal devices while maintaining a mobile work environment (White House 2012). This allowed employees to access a remote server containing the TTB's applications and data through their own devices for work purposes. The virtual desktop worked for snartphones as well as for PCs.

In order to address the concerns over governance and policies, responses to risk need to be wider in scope. Proper governance begins with an oiganization's policies on protocols and monitoring prior to the implementation of a BYOD program. These policies should include organizational positions on remote wipes and confiscation; employee responsibilities, in terms of hardware and software requirements; allowable activities and devices; and procedures for support (Brandel 2012). Although these positions might not be universal to each organization or industry, setting ground rules is a vital step for organizational security. Given the rapid turnover of new technology, allowable devices for employees are always changing; thus, it is important to maintain certain policy standards throughout the organization.

Maintaining communication with employees who participate in these programs is also important when developing policies. This includes both proper training on the risks associated with BYOD programs and informing stakeholders throughout the organizational ladder about the reasons for adopting certain policies (Brandel 2012). This continuous approach engages all stakeholders-employees in particular-in the governance process, which could help them better regulate their activities and understand why they should not violate the policies. Engaging stakeholders lends effective support to the organization's goal convergence.

Engagement and communication with legal counsel and human resources can also assist in legal challenges that can result from the implementation of BYOD programs (White House 2012). Before implementing these programs, management in each organization must understand and assess its financial position, industry conditions, and responsibilities. This selfassessment and subsequent understanding will help ensure that organizations do not stumble into legal obligations as a result of their conduct in a BYOD program.

After applying BYOD policies, organizational technicians (or consultants) should implement and test controls, such as remote device wipe, restrictions on e-mail forwarding, and screening for e-mail that contains malicious software. Organizations should apply both preventive controls, such as antivirus software, as well as detective and corrective controls, such as firewall alert mechanisms. Testing these controls is another effective response to risks that can be uniquely introduced by a BYOD program, regardless of how long it has been in place; testing does not need to be a one-time effort, and it is never too late to test controls.

The Role of CPAs

The part of CPAs in this process is clear- whether working internally or externally, they can assist in the establishment of proper protocols and controls in order to maintain a company's security. Once a BYOD program is established, CPAs can play a vital role in testing the controls and maintaining knowledge of the risks associated with these programs. CPAs possess basic knowledge of accounting and information systems, and they can demonstrate their value to an organization through an analysis of risks, responses, and monitoring.

Although BYOD programs still present a number of risks that have yet to be adequately mitigated, the benefits are worthy of consideration. Moreover, it is imperative for managers to prepare their organization, set up policies, test controls, communicate with necessary parties, and understand other technological options in order to give their organization the best chance for a successful implementation of a BYOD program.

BYOD programs go beyond improving employee conditions: organizations benefit from reduced costs.

Once a BYOD program is established, CPAs can play a vital role in testing the controls and maintaining knowledge of the risks associated with these programs.

This article was published with the assistance of Yigal Rechtman, CPA, CFE, CITP, CISM, a senior manager at Grassi & Co. He is also a member o/The CPA Journal Editorial Board.

Holly Ansaldi is a staff accountant at Raymond F. Wager, CPA, PC, Henrietta, N.Y.