WebTrust seal program

Learn about the WebTrust seal program for Certification Authorities.

COVID-19 Response

Temporary WebTrust Seal for COVID-19 related qualified reports

CPA Canada and the WebTrust Task Force acknowledge the potential impact of COVID-19 on WebTrust for Certification Authorities engagements and the desire for Certification Authorities to continue to demonstrate compliance with WebTrust and CA/B Forum requirements. Recognizing that there may be some circumstances where practitioner report qualifications are the direct result of an inability to perform certain tests due to COVID-19 government-imposed restrictions, CPA Canada has decided to introduce a temporary COVID-19 WebTrust seal (temporary seal).

This temporary seal recognizes the extraordinary circumstances caused by the COVID-19 pandemic and is not intended to replace the traditional seal.

The temporary seal will be offered only in situations that meet the following criteria:

  • The practitioner report has been qualified,
  • The qualification is directly related to government-imposed COVID-19 scope restrictions only and is disclosed in the practitioner report, and
  • There are no qualifications due to control deficiencies in the period.

These circumstances are further described in the Practitioner Guidance, The Impact of COVID-19 on WebTrust for Certification Authorities Engagements, Reporting and Seal Issuance (Practitioner Guidance).

When a temporary seal has been granted, it is expected that a practitioner will be able to perform the procedures that could not be completed initially which gave rise to the scope limitation before the temporary seal expires. Where the practitioner is able to perform such procedures and is able to issue subsequently an unqualified report for the CA, the unqualified report could then be submitted to CPA Canada to obtain the traditional seal. Where the practitioner is not able to subsequently issue an unqualified report for the CA, the temporary seal will be deactivated.

To recognize the temporary nature of the circumstances, a temporary seal is permitted to remain on a CPA’s website for a maximum of six months from the end date of the period examined.

CPA Canada will monitor COVID-19 related events and based on the circumstances may discontinue the availability of the temporary seal.

The process for issuance of the temporary seal is as follows:

  • The practitioner report is due within 90 days from the end of period being examined (no change from current requirements).
  • If the practitioner report is unqualified, CPA Canada will provide a traditional WebTrust seal (assuming all necessary documentation is submitted to CPA Canada).
  • For qualified reports:
    • If the qualification is non-COVID-19 related, no WebTrust seal will be provided.
    • If the qualification relates to control deficiencies due to the effects of COVID-19, no WebTrust seal will be provided.
    • If the qualification relates to a scope restriction caused by government-imposed travel/access restrictions during the COVID-19 restriction period and the practitioner is unable to obtain sufficient evidence through traditional and/or alternative techniques or procedures (as described in the Practitioner Guidance), a temporary seal will be provided. The format for the qualified practitioner report is discussed in the Practitioner Guidance. The same documentation required for an unqualified report is required to be submitted to CPA Canada.
  • The temporary seal remains valid for six months from the end of the period examined.
  • If within the six months the practitioner is able to carry out the procedures that gave rise to the scope limitation, it may submit a new unqualified report (where appropriate) to CPA Canada for the period examined. Upon review, CPA Canada will provide a traditional WebTrust to replace the temporary seal.
  • If within the six months the necessary procedures have not been completed and a new unqualified report has not been received by CPA Canada, the temporary seal will be deemed invalid and removed.

For further information or if you have any questions please contact us.

 

The WebTrust for Certification Authorities program was developed to increase consumer confidence in the Internet as a vehicle for conducting ecommerce, and to increase consumer confidence in the application of PKI technology. This program, which was originally developed jointly by the AICPA and CICA, is now managed by Chartered Professional Accountants of Canada.

Public accounting firms and practitioners who are specifically licensed by CPA Canada can provide assurance services to evaluate and test whether the services provided by a particular certification authority meet these principles and criteria. The posting of the WebTrust seal of assurance is a symbolic representation of a practitioner's unqualified report. This seal, when provided, is displayed on the certificate authority’s web site and linked to the practitioner's report and other relevant information.

For inquiries regarding WebTrust, please contact CPA Canada.