Hashing: The Linchpin of the National CPA Database

Enforcement Newsletter

February 2014

Each dataset that remains unhashed creates a hole in the safety net of public protection where the bad actors who are repeat offenders can slip through. Perhaps hashing has been the one component holding your Board back from achieving the ALD Big Four. Read on for a recap of why hashing is so crucial and how it can be accomplished.

A more intuitive and complete search

Records that link across state lines make the national database more intuitive and the results more complete. Here is a great example: If you search for a name from an unhashed state in the ALD, it will pull up one record. If you search for that same name from a hashed state, you’ll see all of the records she or he holds from any hashed states. If you search for Anita Baker in WY, you’ll see that she’s linked to eight other states. That’s powerful information.

Mobility enables CPAs from all over to practice just about anywhere. This is fantastic, but can make it a serious challenge for client to determine which jurisdiction originally licensed the CPA he or she is looking to hire or if there are any disciplinary actions in other states where the CPA may have been licensed in the past. If all records in the database include the hashed identifier, then all records for a particular CPA, regardless of which state is involved or searched, will be included in the results. In the end, the public gets a much more complete picture of the CPA they are about to hire or employ.

More effective enforcement

If your Board’s data is not yet hashed, the data does not link across state lines, so unfortunately peer Boards will not be notified about your Board’s enforcement and disciplinary cases (historical or new status changes). Of course, the information will be searchable in the ALD, but the value of the disciplinary email alert feature is that real time notifications are made to the specific boards that may need to take action against the licensee and this notification happens automatically. Without hashing, the automation is lost and therefore much of the value.

NASBA has some incredible services and tools that are available to you if your Board’s data is hashed:

• The ALD Disciplinary Email Alert sends an email when a licensee in your state has been disciplined by another Board in another state where they are licensed. Revocations and suspensions trigger an alert. According to some state laws, that gives the notified board enough authority to hand down their own discipline as well.
• CPE Audit Service is a new program that helps Boards manage their CPE audits and automates some of the vital functions involved. The program utilizes NASBA’s CPE compliance evaluation platform, CPEtracking, and the licensee data feeds received from Boards for the Accountancy Licensee Database (ALD).
• Federal Enforcement is harder to pursue when it is not clear where the individual or firm in question is licensed. Federal referrals are typically sent to the state where the infraction happened and there may not be a reference to where the CPA is licensed. If all records in the database are linked through the hashed identifier, then Federal Agencies will be able to rely on CPAverify to determine where to send the referral.

What is needed?

The required pieces of data that a board must have are dates of birth (DOBs) and the last four digits of SSNs (last 4). Once those two data points are added for each record, your Board’s IT team will use an algorithm to hash the file at the Board. These pieces of data are not delivered to NASBA. Instead, they are used to create a hashed unique identifier before the file is sent. NASBA will only ever see the hashed unique identifier which cannot be reversed. The hashed unique identifier links up the records for the same individuals across state lines.

Some Boards have reported that they just don’t capture DOBs or last four digits of SSN. If that is the case, here’s how to start:

1. Determine under your state law, what data you can collect and in what manner.
2. If you can collect this information, then consider adding it to your renewal forms so you can have it the next time renewals roll around. States have begun to use this approach and have found it a very streamlined way to collect the data quickly.
3. Once you have collected the data, the last is to apply the “hashing program” to your ALD feed. Contact the ALD Manager, Elizabeth Stanton, with your best IT contact and she can assist with the final technical setup.

As a recap, sending a hashed dataset allows Boards to:

• Quickly see all states where a person is licensed;
• Cross reference state records to compare a CPA’s licensing and disciplinary history;
• Receive ALD disciplinary email alerts;
• Qualify for exciting programs like CPE Audit Service; and
• Enjoy added confidence when it comes to enforcement of federal cases and mobility.