The Jacksonville Jaguars National Football League (NFL) team was one of the first major sporting organizations to take advantage of information technology (IT) tools in the sale of stadium snacks and souvenirs. Beginning in 1995, football fans at Alltel Stadium, where the Jaguars play their home games, began using Spot Cards to purchase soft drinks, beer, popcorn, and Jaguar souvenirs rather than fumble for cash and change when making their purchases.1 These reloadable Spot Cards, which contain an embedded computer chip, operate in a manner similar to other smart cards such as Kinko’s ExpressPay cards and many retail establishments including university student identification cards that are used for fee payment, meal and book purchases, and building access.

Not only does the Spot Card offer benefits to fans in the stadium, but the use of IT also offers advantages for snack and souvenir vendors by providing better information for monitoring their businesses. Although IT offers improvements for the fans and vendors, those who rely on the Spot Card to process sales need assurance that the technology and related information produced is accurate and reliable.

BACKGROUND The implementation of the Spot Card at the stadium in Jacksonville in the fall of 1995 represents one the first uses of that type of IT in a major sports stadium. The stadium contracted with First Union Bank, (which is now part of the Wachovia Corporation, one of the country’s largest financial institutions), to develop and implement the Spot Card system. First Union contracted with Diebold Incorporated of Canton, Ohio, a manufacturer of card-based transaction systems, to develop the Spot Card system. A description ofhow the system was designed to function follows. Customers purchase Spot Cards in various denominations such as $20, $50, and $100. ATM-like machines in the stadium allow fans to transfer funds from their bank or credit card onto an electronic chip on the Spot Card. Fans can also buy cards with cash or with a debit card. Other terminals are located in various bank branches around Jacksonville. Card readers located throughout the stadium allow fans to check card balances.

Fans purchasing snacks and souvenirs present their Spot Card to vendors at concession and souvenir stands, who calculate sales amounts and swipe the cards through point-of-sale (POS) machines. Software tracks each transaction for vendors. Before the transaction is complete, fans review the amount to be deducted and punch the “Yes” key on the POS machine. At that point, the POS device deducts the purchase amount from the chip-embedded balance on the fans Spot Card. These cards can also be used at battery-operated POS computers carried by vendors who roam the stadium stands selling merchandise during the game.

The POS machines capture information about each transaction. The system records the card number, location code, and the date and time of the transaction as well as the items sold. That information is later summarized for vendors.

Once the game is over, vendors link their POS machines to a network that allows the transfer of data stored on each POS machine to a computer located in the stadium counting room. Once all the data are downloaded to that computer, the information is then transmitted to a host computer at the bank in Jacksonville. The host computer uses the transmitted data to settle that day’s sales with each vendor in the stadium. The host computer produces various reports, which provide vendors detailed information to track sales volume for specific products in specific sections of the stadium.

The bank receives a fee from every Spot Card transaction, and the bank collects whatever remains on an unused Spot Card at the end of two years. Soon after implementation, the bank also began selling player-signature Spot Cards with pictures of selected Jaguar players on the front for an additional fee. Other stadiums around the country, such as the Carolina Panthers’ stadium in North Carolina, have used similar technologies.........

[1] To become more familiar with these assurance service opportunities, obtain a copy of the Trust Services Principles and Criteria, which can be located on the Internet. Use your internet browser to locate a copy of the framework by conducting a search for “Trust Services Principles and Criteria.” Most likely you will find a link to the framework posted on the AICPA’s “Information Technology Center” Web page (http://infotech.aicpa.org). Use the framework to complete the following exercises:
[a] Summarize in your own words the objective of a Trust Services engagement.
[b] What are the five Trust Services Principles? Provide a brief description of each Principle.
[c] For each of the five Trust Services Principles, describe why management at Alltel Stadium or fans in the stadium might want assurance about how the Spot Card technology complies with each of the five Trust Services Principles. For example, why might management be interested in obtaining assurance about the Spot Card’s system’s compliance with the “Security” principle?
[d] What are the purposes of “Principles” and “Criteria”? How do they relate and how do they differ?
[e] What is the relationship between a SysTrust engagement and the Trust Services Principles and Criteria? You may need to conduct an Internet-based search to locate more information about SystTrust services.
[f] What is the difference between a SysTrust engagement and a WebTrust engagement? You may need to conduct an Internet-based search to locate more information about these services.
[2] The use of IT offers tremendous advantages. At the time of implementation, what benefits did the use of Spot Cards offer to the following groups:
■ Jaguar stadium snack and souvenir vendors?
■ Fans in the stadium?
■ First Union Bank?
[3] While the Spot Card offered several benefits, the use of the related information technology to process snack and souvenir transactions did create new risks. Identify risks for the following groups:
■ Snack and souvenir vendors ■ Fans in the stadium ■ First Union Bank [4] What processes or controls might the stadium and First Union have implemented to help reduce these risks?
[5] What kind of information could the CPA examine and evaluate in order to assure stadium vendors that they can reasonably rely on the Spot Card system to conduct business?
[6] Using Trust Services Principles and Criteria for the “Online Privacy Principle,” develop an online privacy policy for Alltel Stadium that could be posted on the stadium’s website for customers to review before using the Spot Card technology.