The WebTrust seal of assurance for the CA will be managed by a seal manager along the following lines:
Upon becoming a WebTrust licensee, the WebTrust practitioner obtains a registration number (ID and password) from the WebTrust licensing authority. With this the practitioner can issue a WebTrust seal to the CA.
When the practitioner is prepared to issue a WebTrust seal, he or she accesses the WebTrust secure server system. Upon payment of the registration fee, the practitioner receives passwords and IDs unique to the engagement. The seal manager issues these to the practitioner in pairs. One set allows the practitioner to read and write to the secure server (see below) and the other permits the CA to preview the presentation.
The practitioner prepares a draft of the practitioner’s report and provides it along with management’s assertions for posting to the preview site.
The seal manager then delivers the seal to the CA with the appropriate links to the preview site. Notification of delivery is provided to the practitioner.
When the practitioner and CA have agreed that the seal should become active, the practitioner notifies the seal manager to transfer the information from the preview site to the active WebTrust site and provides the appropriate expiration date.
The seal remains valid for the period provided by the practitioner plus a one-month grace period, unless removed for cause. The one-month period is to allow sufficient time to complete the engagement and other open items. For example, if the seal expires on June 30, 20XX, the practitioner has 30 days to complete open items and prepare new documents for posting with the seal manager. The subsequent examination period begins July 1, 20XX
If the practitioner determines that the seal should be removed from the CA’s Web site, the practitioner will immediately notify the CA and request that the seal be removed from the CA’s site. The practitioner will then notify the seal manager to remove all the relevant information and to replace it with a statement that the WebTrust seal for this site is no longer valid.
The seal manager will notify the practitioner 30 days prior to expiration that the seal needs to be renewed. The seal manager may revoke seals if the registration fee for the seal is unpaid or for other sufficient cause.
