multichannel retail: more than clicks and bricks

Multichannel retail: More than clicks and bricks

Contents

1 Executive summary

3 Introduction: New opportunities abound for retailers

4 Retail websites deepen relationships with customers

9 Smartphones change the retail experience

11 Social media is becoming integral to the consumer experience

13 Internet coupons gain popularity

15 Multichannel retailing gives rise to more third-party vendor relationships

17 Closing thoughts: Be dynamic, maintain focus

18 Grant Thornton offices

1


Executive summary

Multichannel retail — the merging of traditional brick-and-mortar retailing with online and mobile retail channels — involves far more than allowing customers to purchase items through a website. Multichannel retailing presents ample, seemingly boundless opportunities for brand engagement and interaction with customers across new platforms. Yet inevitably, these new technologies, platforms and sales channels come with new risks and challenges for companies to manage.

Retail websites deepen relationships with customers.With the growth of e-commerce, many retailers are using their websites to enhance their relationships with customers through offerings like live chats with service representatives and educational Web content that helps customers better choose or use the products they buy. However, the popularity of e-commerce has also brought about many new risks for retailers, including increased competition and quicker customer price comparisons.

Implication: Retailers must integrate their storefront and website operations, both conceptually and operationally; attend to data security risks in order to keep customer information safe and avoid costly security breaches; and stay on top of changing state and local tax legislation in the areas of nexus, apportionment and global retailing.

Smartphones change the retail experience.Seventy-eight million people in the United States are currently using smartphones. A large number of people use these devices to search for stores, compare prices and research product details. Some retailers are producing mobile applications — or “apps” — to create more opportunities for sales, customer interaction and an enhanced in-store experience. Yet smartphones have also shifted power toward the consumer in unprecedented ways. For example, while shopping, smartphone users may search online for better prices or selections elsewhere.

Implication: Retailers will want to maximize the potential opportunities of mobile applications, but they must carefully consider both competitive and security risks. Many mobile apps are not compliant with payment card industry (PCI) data standards — information security standards established by the major debit and credit card companies — and therefore may not be safe for use in sales transactions.

Social media is becoming integral to the consumer experience.Social media has also become a popular consumer engagement tool. A growing number of retailers use it as an opportunity to increase customer awareness and loyalty and provide additional outlets for customer service, advertising and feedback. But negative attention via social media can spin out of control quickly if left unchecked.

Implication: It is imperative for retailers to monitor social media and viral videos in order to respond promptly and informatively to customer questions and to manage problems swiftly.

2

Internet coupons gain popularity.GrouponTM, LivingSocial and many other Internet coupon sites have grown immensely in popularity over the past few years. For retailers, partnering with these companies to create special offers can help them reach new customers and provide an efficient means of marketing and advertising. However, retailers may make only 25 cents on the dollar — and sometimes even less — on these special offers, and there is no guarantee that customers will return after taking advantage of one-time deals.

Implication: Retailers must look at the reputational and financial factors involved in partnering with Internet coupon sites to determine whether such a partnership would be a good business decision.

Multichannel retailing gives rise to more third-party vendor relationships.As their companies have expanded, many retailers have outsourced business functions such as website hosting, shipping and credit card processing. However, retailers must ensure that their third-party service providers take precautions for backing up data and keeping customer information safe. Additionally, retailers selling digital products through third-party vendors can run into new tax situations.

Implication: Retailers should ask for an independent auditor’s report on third-party controls, such as Service Organization ControlSM (SOC) 1, SOC 2 and SOC 3 reports.1 Retailers must also be familiar with their state tax regulations and make sure that contracts with vendors clearly stipulate tax responsibility. They will want to make sure their tax personnel and external advisers are up to date on changing state tax laws that affect e-commerce.

1 Service Organization Control Reports, SOC 1, SOC 2 and SOC 3 are registered trademarks of the AICPA. See http://www.aicpa.org/InterestAreas/FRC/AssuranceAdvisoryServices/Pages/ SORHome.aspx.

3


Introduction: New opportunities abound for retailers

Retail strategy and operations have changed permanently. Retailers today are doing business across various new sales and service platforms, including websites, smartphones, social media, Internet couponing and third-party vendor relationships, among others. Certainly these multiple channels provide new ways to help retailers grow their businesses. But as retailers embrace these new channels — and the opportunities those channels offer — they must have the necessary controls and resources in place to ensure their safe and effective use.

Multichannel retail: More than clicks and bricks examines the many opportunities for retailers to market to and interact with customers across new Web technology platforms such as social media and mobile applications. Based on our experience with multichannel retailers, we present an overview of the opportunities and challenges new retail channels and technologies pose, as well as some of the best practices that leading retailers are employing to surmount obstacles.

Grant Thornton LLP’s Retail practice professionals are well-versed in the issues facing retail companies. We help retailers identify and implement solutions that address a range of economic, tax and regulatory challenges, and we assist leading retailers as they develop a variety of short and long-term strategies for success.

We embrace the opportunity to strengthen our partnerships with retailers as they move toward successful multichannel growth.

Mark WullerNational Retail Practice Leader

Giles SuttonNational Retail Tax Practice Leader

4


Retail websites deepen relationships with customers

According to a recent report by comScore, 84 percent of all Internet users in the United States visited a retail site in the second quarter of 2011.2 In the same quarter, e-commerce spending grew by 14 percent, compared with 7 percent growth for total retail spending, signaling a consumer shift to multichannel retail outlets. The report also found that consumers are now spending approximately one in every 10 discretionary dollar online.

Furthermore, comScore reports that shopping via online channels has recovered from the 2008 recession more quickly than shopping via brick-and-mortar stores, posting seven quarters of gains. And while small businesses in the United States continue to struggle overall, small retailers have chalked up three straight quarters of gains in e-commerce sales.

More choices for customers, better storefront strategies

Internet retailing has made shopping more convenient for consumers and presents them with far more choices than they had in the pre-Internet age. Retailers, meanwhile, have gained the ability to sell more products to more people across the United States and around the world.

The popularity of e-commerce has also afforded retailers more freedom in how they operate their brick-and-mortar stores. According to Deepika Sandhu, Business Advisory Services (BAS) senior manager, the showroom model, in which salespeople show customers samples in the store and order their purchases online, is becoming popular with a wider range of retailers. Because inventory is kept in one central distribution center rather than in stores, this model ties up less resources, allowing retailers to create a more engaging brand experience, notes Sandhu.

The showroom model can contribute to a retailer’s loss prevention strategy, too: In August 2011, when thieves robbed Sonny’s Jewelry in Denver, approximately half of the stolen goods turned out to be worthless sample pieces.3 Owner Michael Nedler observed that the showroom model has become more popular for jewelry stores over the last two to three years. Given the skyrocketing costs of gold and diamonds, Nedler said, it’s getting prohibitively expensive to stock a full line of wedding rings or other jewelry if it’s just going to sit in the case.4

New ways to interact with customers

2 Fulgoni, Gian, and Lipsman, Andrew. “State of the U.S. Online Retail Economy in Q2 2011,” Aug. 10, 2011. Available at www.comscore.com/Press_Events/Presentations_Whitepapers/2011/ State_of_the_U.S._Online_Retail_Economy_in_Q2_2011.3 Bolton, Anastasiya. “Robbers Disguised as Clowns Stole Fake Jewelry,” 9news.com, Aug. 25, 2011. See www.9news.com/news/article/215583/188/Robbers-disguised-as-clowns-stole-fake- jewelry-.4 Ibid.

5

Retail websites serve many purposes beyond allowing customers to purchase products. In fact, retail websites — along with retailers’ mobile applications and social media outlets — represent the primary means of engaging with a retail brand for a growing number of customers.

According to BAS IT Audit Managing Director Matt Thompson: “Retailers are well aware that from a customer service perspective, websites and social media applications serve as a means for engaging and interacting before and after a sale. Retailers know it is a business risk not to get their multichannel strategies right.”

Thompson goes on to list some of the most promising opportunities for enhancing the customer experience through websites and other multichannel outlets:• New avenues for customer service — Multichannel retailing

has brought about many customer care options that go beyond an 800 number. Retailers are offering live chat capability via their websites and answering customer queries through corporate Facebook pages and Twitter accounts.

• Expanded Web content — Retailers are using rich, dynamic Web content to ensure that customers visit their websites frequently. Offerings might include a blog that adds new posts a few times a week, exclusive discounts and deals for customers who opt in, or educational content. For example, retailers such as Lowe’s® and Home Depot® have traditionally held free in-store classes and are now making similar how-to content available online and providing other presale resources to help customers. Other companies text customers discount codes to be redeemed online.

• More sophisticated market research — Websites and social media applications have provided retailers with many new opportunities to monitor customer behavior and identify ways to better serve customers. Many retailers segment their customer data to understand the relationship between consumer behavior and online purchases. Most retailers use analytics to understand why customers abandon a selection at checkout. To understand how to help customers online, many retailers also employ traditional strategies such as in-person focus groups.

Further, a large number of retailers are putting a great deal of effort into integrating their brick-and-mortar storefronts with their online businesses. Take Barnes & Noble, for example. While its bookstores play a crucial role in introducing customers to new merchandise and selling the company’s NookTM e-reader, The Wall Street Journal reports that the chain’s growth and future profits will be linked to its ability to compete with online rivals such as Apple®5 and Amazon.com.6 As retail consultant Lorraine Shanley told WSJ, “It’s a balancing act, because bookstores are needed to generate excitement even though the final transaction may be digital.”7

Increased competition, faster consumer price comparisons and less consistency

5 Apple, iPad, iPod, iPhone, and Mac are trademarks of Apple Inc. Multichannel retail: More than clicks and bricks is an independent white paper and has not been authorized, sponsored or otherwise approved by Apple Inc.6 Trachtenberg, Jeffrey A. “Barnes & Noble Focuses on E-Books,” The Wall Street Journal, July 20, 2011. Available at online.wsj.com/article/SB10001424052702303795304576453882840821 172.html?mod=dist_smartbrief.7 Ibid.

6

While retailers benefit from the ability to reach more customers via e-commerce, they also face an increased number of competitors in the multichannel sphere. And the Internet has allowed consumers to conduct price comparisons in a far more effective manner than visiting multiple storefronts or making several phone calls. Partly because of the fallout from the 2008 recession, seeking out the lowest price has become crucial to the customer shopping experience, trumping factors such as brand loyalty.

Of course, retailers must do more than offer competitive prices, robust product selection and respectful customer service to be relevant in the multichannel space, and many long-standing brick-and-mortar businesses have found it daunting to incorporate effective online and mobile elements into their overall business design. To ensure that their brand survives expansion into these areas, retailers must focus on consistency.As Danny Miller, national solutions leader for cybersecurity and privacy at Grant Thornton, asserts, “Whether they are being accessed on a BlackBerry®, iPhone®, desktop or tablet, a company’s website and applications need to feel, look and work in a manner that is intuitive and that is consistent with all of the other channels.”

Brand consistency goes beyond technology. Retailers must ensure that their storefronts are working in cooperation with their other channels, Miller says. All operations should be complementary, sharing the same message and delivering a unified customer experience. For example, many customers expect a business to provide the option of returning an item purchased online to their nearest store. If a retailer hasn’t considered the flow from one channel into another, then complications can arise.

In multichannel retailing, business functions blend and overlap. For these functions to operate seamlessly, the proper financial and employee policies and processes must be in place. In-store and mobile point-of-sale (POS) systems, or checkouts, should be integrated so that store employees are able to assist customers who have ordered merchandise online with in-store pickups and returns. Furthermore, a designated employee should be responsible for ensuring that items ordered online or through mobile applications are readily accessible by the customer.

“Creating clear policies for their multichannel operations and educating all employees about these policies will go a long way toward providing customers with a consistent experience,” BAS IT Audit Managing Director Matt Thompson observes.

To take further advantage of the opportunities offered by multichannel technology, retailers should make sure that the culture and metrics of their company encourage online activity. For some retailers, adopting this mindset has not come easily. As Thompson notes, “In the early days of Walmart.com, Wal-Mart store managers were effectively penalized by online sales that cannibalized in-store sales, so they resisted efforts to promote Walmart.com.”

Many retailers still lag behind when it comes to acknowledging the key role that multichannel platforms play in promoting their businesses. Retailers should not only have a vigorous multichannel presence, but also encourage all staff members to champion these efforts.

Security risksMultichannel retailers may be receiving sensitive customer data online and wirelessly, which can make them a target for hackers. Hackers can easily pick up unencrypted wireless traffic with readily available off-the-shelf equipment. Even when information is encrypted, wireless devices and communications may not be completely secure. When customer information is intercepted, this can have serious implications for retailers: According to a 2011 study conducted by the Ponemon Institute, “data breach incidents cost U.S. companies $204 per compromised customer record in 2009.”8 Considering that this figure would be multiplied by thousands in the event of a security breach, retailers can get a sense of the true cost of a breach. As BAS IT Senior Manager Brian Browne points out, “The numbers don’t even include costs related to staff response and brand image repair.”

One of the easiest ways to protect customers is by not storing their credit card data. Browne says it is not difficult to acquire chargeback information through other sources, and storing credit card information is usually a bigger security risk than it is worth.

Multichannel integration considerations• Dowehaveapolicythatallowscustomerstoreturnitemspurchasedonlinetostores?• Haveweupdatedaccountingandinventorysystemsandprocessestohandlemultichannelretailingtransactions?• Arein-store,onlineandmobilePOSsystemsintegrated?• Dowehavecontrolsinplacetomanagefunctionsthatoverlapbetweenonlineandin-storecomponents?• Dowehaveapolicyinplaceforrespondingtoin-storecustomers’requeststopayacheaperpricewhentheyfindtheitemdiscountedonlineoratanother

retailer?• Arewetrainingemployeesinmultichannelcustomerservice?

However, many retailers still opt to store cardholder data. In this case, Browne advises them to practice segregation with respect to the systems that handle sensitive information. “If your sales systems are detached from all other systems, that is a good step toward making the data less vulnerable to an attack,” he observes.

Furthermore, retailers should assess their information security regularly. There is a variety of software — data leakage prevention (DLP) tools, for example — that can be used to monitor for hacking and check the integrity of a company’s systems.

BAS Cybersecurity Senior Manager David Glod notes: “It’s important for retailers to take proactive steps against hacking. Controls aren’t perfect — for example, scans using DLP tools often require manual verification — but they are helpful. If your systems are hard to break into, then hackers tend to go elsewhere.”

Once retailers put the proper controls in place, it is crucial to create a culture of compliance within their organization. “It’s important to train employees to conduct security checks regularly and follow up on them consistently,” says Glod. “This will foster a culture where employees understand that security controls are a critical part of day-to-day operations.”

Fraud risksHackers trying to access customer information are not the only fraud-related issue retailers face. Another popular scheme, according to Mark Sullivan, national practice leader for investigations, Forensic and Valuation Services, is ordering merchandise online or through mobile devices using stolen credit card numbers. “When the order is scheduled to arrive, the perpetrators will loiter near legitimate physical addresses and intercept the delivery,” he notes.

Another threat is a fraudster creating a phony website that looks identical to a retailer’s actual website. These fraudulent sites are largely used for the purpose of phishing, or attempting to gather sensitive visitor data such as Social Security numbers or credit card information. “More recently, fraudsters have begun setting up legitimate-looking blogs linking to special retail offers. The link then takes visitors to the phony retail site. While this type of fraud usually has no immediate monetary repercussions for retailers, it can certainly harm brand integrity,” warns Sullivan.

Just as retailers employ software to keep hackers out of their systems, they can also use it to assist in fraud detection. Many programs, such as Accertify, protect against velocity hacks — the practice of ordering merchandise via multiple stolen credit cards to test whether they will work — by monitoring suspicious orders originating from the same Internet Protocol (IP) address. Sullivan also suggests that retailers use systems such as MarkMonitor, which manages IP addresses and scans the Internet for phishing websites and other inappropriate use of a retailer’s brand.

Retailers should also ensure that all staff members are trained to detect indicators of possible fraudulent activity. For instance, a salesperson might receive a telephone call from a customer complaining that an item ordered online never arrived. If the salesperson can find no record of the customer’s order, the salesperson should be aware of the possibility that the customer may have visited a phony website — and the alternate possibility that the customer may in fact be a scammer . . Retailers should have a process in place for investigating these claims and pursuing fraudsters proactively.

New tax challengesAmong the most complex issues being raised by e-commerce are those related to taxes. Today’s tax landscape is evolving quickly as new retail practices emerge and cash-strapped state governments seek additional sources of tax revenue.

According to Retail Tax Practice Leader Giles Sutton, “Tax issues are affecting most retailers: All major chain stores have an Internet retail presence, and with mobile technology, that presence is only increasing. When a customer orders an item online and picks it up at the store, that item can be taxed. However, if the customer purchases the item online and has it shipped, the tax situation gets murkier and depends on who is collecting the tax and where that tax is being collected.”

8 Ponemon Institute, LLC. “Ponemon Study Shows the Cost of a Data Breach Continues to Increase” (press release). See www.ponemon.org/news-2/23.

Security and fraud considerations• Arewemanagingcreditcarddatarisksappropriately(e.g.,storing

cardholder data prudently) or not at all?• Doweutilizefrauddetectiontoolsthatidentifyhigh-risktransactions,

monitor and prevent fraudulent orders, and identify deceptive use of our brand?

• Havewetrainedemployeesproperlysothattheyrecognizethered flags of fraud?

7

8

Following are some of the most prevalent tax issues affecting multichannel retailers:

Nexus issues — At one time, state taxes were relatively straightforward: If a retailer had a physical presence, or nexus, in a state that imposed a sales tax, then the retailer collected a sales tax. However, with the rise of online retail giants such as Amazon, state governments have begun figuring out how to charge sales taxes when companies do not have a physical presence in the state.

A number of states have either passed or proposed affiliate nexus legislation — and its corollary, the “Amazon rule” — that says a retailer must collect sales taxes if it works with business affiliates in that state. States with affiliate nexus legislation on the books or being considered include California, South Dakota, Colorado, Oklahoma, Texas, Illinois, Arkansas, New York, Vermont, Connecticut and North Carolina. Federal lawmakers have started paying attention to nexus issues as well; some are introducing legislation that would impose greater consistency across state tax laws.

The rapidly changing nexus rules have caused confusion among retailers. Notes Sutton, “The nexus rules contain so many gray areas that are open to interpretation, and retailers can expect these issues to continue to evolve for the foreseeable future.”

Apportionment — Retailers have long been required to apportion their taxes in the states where they do business, using sales, property and payroll factors. However, online and mobile sales have given rise to uncertainty about the best way to apportion taxes.

Global retailing — Multichannel retailing has paved the way for retailers to do business seamlessly in multiple countries. An emerging area of concern is how to handle international orders from a tax perspective. For example, retailers with limited international operations may find it most straightforward to let international customers order through one U.S.-based website. As their international business expands, they will likely consider hosting different parts of the business — and different websites — in multiple countries. Before proceeding, retailers need to understand the tax implications of operating in each country so that they can make informed business decisions.

Because tax laws are evolving so rapidly, the most important step retailers can take is to be proactive and keep abreast of current rules and regulations. “What is a regulation now may change in six months,” says Sutton. “Retailers need to have their eyes wide open. If they aren’t aware of alterations in the tax landscape, confusion will occur and negative consequences may follow. Furthermore, it is essential to share tax-related information with all parties in the company that need to know about it. This is part of managing information up the organizational chain.”

Tax considerations• Haveweconsideredwhetherchangesinthetaxlawinagivenstateapply

to our company?• Dowehavethesystemcapabilitiestocomplywiththenewlaws?• Whatwillbethefinancialimpactofagivenlawchangetoourcompany?

Amazon rule Affiliate nexus Amazon rule and affiliate nexusNot addressed No sales tax Contingent Amazon rule

Remote seller nexus − "Amazon rule" and affiliate nexus

Notes: (1) Calif. Amazon rule and affiliate nexus become operative on Sept. 15, 2012 or Jan. 1, 2013, depending on enactment of federal legislation and implementation by state; (2)Washington,D.C.has“remote-vendor”collectionrequirementforInternetsalesthatiscontingent on local SSTP-type reforms being enacted; (3) Penn. is based on administrative authority, legislation has been proposed; (4) Vt. Amazon rule becomes effective when at least 15 states have adopted similar rule.

ONLINE GROWTH

Opportunities• Increasingonlineconsumeractivityandpurchases• Expandingreach• Changingtoashowroommodel• Enhancingcustomerservice• Providingeducationalonlinecontent• Gatheringmarketintelligence

Challenges and risks• Increasingcompetition• Pricingpressures• Integratingonlineandin-storeprocessesandsystems,particularlythose

concerning loyalty programs and returns• Adaptingperformancemetricstosupportonlineactivities• Datasecurityandfraudrisks• Taxuncertaintiesandexposures(e.g.,nexus,apportionmentandinternational)

9

9 Fulgoni, Gian, and Lipsman, Andrew. “State of the U.S. Online Retail Economy in Q2 2011,” Aug. 10, 2011. Available at www.comscore.com/Press_Events/Presentations_Whitepapers/2011/ State_of_the_U.S._Online_Retail_Economy_in_Q2_2011.10 Johnson, Lauren. “Michaels Pushes Mobile Initiatives to Drive In-Store Traffic,” Mobile Commerce Daily, July 25, 2011. See www.mobilecommercedaily.com/2011/07/25/michaels-pushes- mobile-initiatives-to-drive-in-store-traffic.11 Ibid.


Smartphones change the retail experience

According to information recently released by comScore, 78 million people in the United States are currently using smartphones — phones with mobile access and Web browsing capabilities.9 A large number of smartphone users have incorporated these phones into their shopping habits: In the second quarter of 2011, 50 percent used their phones to find nearby stores, while 40 percent used them to compare prices before shopping, and 34 percent used them to research product details.

Retailers have taken notice, and many have designed mobile applications for the iPhone, the AndroidTM operating system and various tablet devices in hopes of enhancing traditional retail offerings. A recent adopter is Michaels, a large specialty crafts retailer that in 2011 introduced a mobile-optimized site application and mobile coupons aimed at boosting in-store traffic and improving customers’ in-store experiences.10

Anthony Price, Michaels’ senior director of digital marketing and public relations, told Mobile Commerce Daily, “Our key strategy was to give customers the opportunity to engage with Michaels whenever and wherever they choose.”11

Mobile applications are not only offering consumers more ways to interact with their favorite brands, but are also becoming integral to many shoppers’ expectations.

“Retailers, no matter the size and scope of their operations, must consider that customer demand for applications that enhance their overall shopping experience will only continue to thrive. Retailers that ignore this trend risk missing out on a valuable and growing customer base,” says BAS Partner Danny Miller.

Consumer empowermentWhile smartphones have helped retailers find new ways to engage customers, they have also shifted power toward the consumer in unprecedented ways. According to comScore, 66 percent of customers with smartphones report using their devices while in a brick-and-mortar store to search for better prices elsewhere. Thirty-eight percent have abandoned an in-store purchase after looking up information on their phones; over half of them did so because they located the item in another store or online for a better price.

These practices mark fundamental changes to consumers’ overall shopping behavior and indicate a need for retailers to re-examine their existing policies. For example, some retailers have adopted more aggressive price-matching guidelines. As the use of smartphones continues to rise, it is crucial that retailers take a proactive approach: They should not only figure out the best way to integrate mobile apps into their businesses, but also develop effective strategies for staying competitive in the face of this new technology.

10

Safety concerns about mobile applicationsMost retailers are very familiar with the need for PCI compliance — that is, adherence to the data security standards enforced by the payment card industry in order to keep cardholder information safe. All retailers that accept, transmit or store credit card data must be PCI-compliant and are subject to penalties if they are not.12

While the PCI standards have been in place for some time, the use of mobile applications to process cardholder data introduces new concerns. Miller notes that the PCI Security Standards Council is still studying how to make mobile applications safe. Currently, the council does not endorse using most mobile applications to collect customer data.

Although some newer mobile applications such as Square have been deemed PCI-compliant, many more have not. BAS Cybersecurity Senior Manager David Glod observes: “As retailers develop and offer new apps, consumers and regulators are focusing more sharply on credit card data security. It would be a big risk for retailers to use apps that are not PCI-compliant to collect customer information.”

This doesn’t mean that retailers should ignore mobile apps; they should simply approach them with caution for the time being. Adds Miller: “Mobile app technology is still in its early stages, and security standards are not yet consistent across platforms. They need to be.”

In the meantime, because apps are becoming an increasingly popular outlet for marketing and customer interaction, retailers should stay abreast of changes in mobile app technology. It’s also important to be aware of the risks apps present and weigh those risks accordingly.

Mobile app considerations• Havewebegundevelopingmobileappsthatenhanceourcustomers’

retail experience?• Dowehaveacompetitiveprice-matchingpolicy?• AreweexclusivelyusingPCI-compliantapplicationsandprocesses

to collect, transmit and store cardholder data and other customer information?

12 See www.pcisecuritystandards.org/security_standards/index.php.

SMARTPHONES

Opportunities• Newmeansofreachingandengagingconsumers• Waytomarkettocustomerswhiletheyareshopping

Challenges and risks• In-storepricematching• Purchaseabandonment• Datasecurity

11

13 Kats, Rimma. “Aeropostale Rolls Out Android App, Relaunches Mobile-Optimized Site for Fashionable Shoppers,” Mobile Commerce Daily, Aug. 1, 2011. See www.mobilecommercedaily.com/ 2011/08/01/aeropostale-rolls-out-android-app-relaunches-mobile-optimized-site-for-fashionable-shoppers14 Ibid.15 TBG Digital. “Advertising Goes Truly Social” (press release), July 19, 2011. See www.tbgdigital.com/archive/advertising-goes-truly-social/.


Social media is becoming integral to the consumer experience

According to comScore, 200 million people in the United States visited a social networking site in the second quarter of 2011. So it only makes sense that retailers are turning to social media to increase consumer loyalty and provide additional outlets for customer service.

For instance, in 2011, the teen-targeting retailer Aéropostale introduced a fully integrated Facebook store where customers can purchase items and inform their Facebook friends of these transactions.13

“We have over 5 million Facebook fans that are engaged and active with our brand on a daily basis,” Aéropostale Senior Vice President of Marketing and E-Commerce Scott Birnbaum told Mobile Commerce Daily. “Creating this shop was a natural step in completing the experience of liking and sharing with friends to then being able to buy right in this environment.”14

Social media is also gaining popularity among advertisers: In 2011, Facebook saw the number of paid brand advertising campaigns on its site increase by 104 percent between the first and second quarter, according to TBG Digital.15 As noted by comScore, 34 percent of all Internet ads are currently placed on social media websites.

Not that ads are the only way for retailers to reach customers through social media. For example, the fan pages on Facebook provide a viable outlet for retailers to inform customers of company news and promote special offers. However, the very nature of social media means that brand engagement often extends beyond a company’s efforts. Research by comScore has found that Facebook users spend most of their time on their home page or news feed — not on retail fan pages. In other words, most Facebook users will be more likely to discover a new brand if their friends are posting about it.

Social media risksThe credible word-of-mouth advertising that social media outlets like Facebook provide can be very beneficial to retailers, who gain insight into consumer preferences as sales grow. In fact, even when the feedback isn’t positive, finding out what people are thinking and saying about a product or service can be invaluable to a retailer. But when the social media buzz is extremely negative, word can travel fast.

“It’s wonderful for retailers when people post on their Facebook pages about a great interaction with a brand. But it can also be harmful when people use social media as an outlet for venting about their negative experiences,” cautions BAS IT Audit Managing Director Matt Thompson. “Facebook can definitely be a double-edged sword for retailers.”

12

Retailers should keep in mind that negative posts about a company can include everything from one-off individual comments to viral media such as video clips. Given how rapidly adverse publicity can spread through social media outlets, retailers should monitor them carefully and respond swiftly should problems occur.

“Ensuring that processes and resources are in place for responding to customers via social media is essential,” says Steven Stauffer, Audit partner. He adds: “Social media can be used to create a positive customer experience, but only if the interaction is managed appropriately. If a customer posts a question about product features or availability on Facebook, Yelp or Twitter, he or she needs to receive a prompt and informative reply.”

Social media considerations• Dowemotivatecustomerstointeractwithusviasocialmediaoutlets?

Forexample,doweupdateourcontentfrequently,sharecouponsandhost exclusive online events?

• Dowehaveadequateandscalableresourcestorespondtocustomerinteractions via social media?

• Haveweimplementedtrainingandpoliciesaboutemployees’social media activities?

• Dowemonitorsocialmediaregularlyandrespondtonegativecriticismswiftly and effectively?

SOCIAL MEDIA

Opportunities• Newchanneltoreachcustomers• Allowsconsumerstopromotebrandstofriendsandfamily• Waytointeractwithcustomersbefore,duringandaftertheirpurchases

Challenges and risks• Negativepublicitycangoviral• Requiresfastandeffectiveresponsetoconsumercommentsandquestions

13

16 McNaughton, Marissa. “Groupon Doubles Subscribers in 2011, But Only 20% Have Made Purchases,” The Realtime Report, Aug. 12, 2011. See therealtimereport.com/2011/08/12/groupon- doubles-subscribers-in-2011-but-only-20-have-made-purchases/.17 Goltz, Jay. “Doing the Math on a Groupon Deal,” The New York Times, Nov. 23, 2010. Available at boss.blogs.nytimes.com/2010/11/23/doing-the-math-on-a-groupon-deal/.18 Ibid.


Internet coupons gain popularity

Launched in 2008, Groupon has become an important player in the multichannel landscape. Its competitors are popular, too. Groupon, LivingSocial and Scoutmob, among other such sites, negotiate substantial discounts with businesses in markets worldwide and send these special offers to their subscribers via daily emails. Once a certain number of subscribers sign up for the deal, the coupon goes live.

By 2011, Groupon had acquired 115 million subscribers,16 and its many competitors have been growing rapidly as well. According to comScore, 46 million U.S. consumers visited a coupon site in the second quarter of 2011. These sites are especially popular with young consumers.

Partnering with these brands can be an effective method of supplementing existing promotional efforts. “The Groupon concept has merged the functions of advertising and merchandising. The power of merging these functions will resonate with retailers for a long time,” says Retail Tax Practice Leader Giles Sutton.

Potential downsides to daily dealsDespite the popularity of daily deal websites, they come with a number of risks to retailers.

As small business owner Jay Goltz explained in The New York Times, “The [subscribers] who buy the coupon get 50 to 70 percent off on a product or service, and Groupon splits the proceeds with the retailer — usually leaving the retailer with about 20 to 25 cents [for every] dollar of retail value.”17

Goltz believes that partnering with coupon sites is likely a bad idea for retailers who think large discounts could damage their brand. It’s also probable that business will surge after their coupon goes live, and retailers must ensure that they are ready for the additional customers. Consumers brought in by a deep discount will not return if they receive poor service or have a negative experience.

Of course, many of the customers who are brought in by the discount price may not return regardless. Goltz wrote, “Is it possible 90 percent won’t return? Sure.”18

Applicability of gift card rulesAnother issue that may become problematic for retailers relates to the treatment of Internet coupons as gift cards under state law. Coupon sites including Groupon and LivingSocial have been sued under various state and federal gift card statutes. In Groupon’s IPO filing, the company disclosed that it faces more than 15 class action suits concerning this issue; a number of its merchant partners are co-defendants in the litigation.

14

In the United States and Canada, merchants currently benefit if Internet coupons are not redeemed before their expiration date. But if states begin regulating daily deals, merchants may have to redeem the coupons long after their expiration date, in keeping with the gift card rules. In some states, gift cards can’t expire within five years; in other states, they never expire.

Before deciding to partner with a coupon site, retailers need to be fully aware of the potential downsides. Retailers should also talk with daily deal sites that operate in their geographic and/or product area in order to find the most favorable partnership terms.

Daily deal partnership considerations• Doourproductsandserviceslendthemselveswelltoapromotionaldeal?• Willtheexposureandnewcustomertrafficbeworththeinitiallosswewill

take because of the deep discount?• Areweabletodealwithaswiftandpotentiallylargeincreasein

customers for the duration of the offer?

INTERNET COUPONS

Opportunities• Powerfulmeansofpromotingbrandsandreachingnewcustomers

Challenges and risks• Financialcostofapromotioncanbesteep• Canbedifficulttohandlelarge-scaleuptakeofapromotion• Littlelong-termcustomerretention• Dailydealsmaybecomesubjecttogiftcardregulations

15

19 Grant Thornton LLP. Puzzled about SOC reports? Clarifying the decision-making process. Available at www.gt.com/staticfiles/GTCom/Advisory/IT/BAS%20-%20puzzle%20article%20-%20FINAL.pdf.


Multichannel retailing gives rise to more third-party vendor relationships

As multichannel retailing has allowed businesses to expand into new areas, many retailers have decided to outsource business functions such as website hosting, shipping and credit card processing. Relationships with third-party vendors provide a viable means for many retailers to cost-effectively grow their businesses and better manage their resources.

BAS Cybersecurity Senior Manager David Glod notes: “Creating relationships with third-party vendors can be a great business solution for small retailers from a cost-efficiency and expertise perspective. However, retailers must be certain that their service providers take the precautions needed to keep customer information safe.”

Third-party vendor security risksGlod points to an example of a third-party security violation with far-reaching implications: the Epsilon breach of April 2011. In this incident, hackers accessed the databases at Epsilon, a company that managed email services for banks such as JPMorgan Chase and large retailers such as Best Buy and Walgreens. The hackers were able to intercept customer names and email addresses that had been stored by more than 50 brands. While Epsilon stressed that no sensitive data such as credit card information was retrieved, the company warned consumers that their information might be used to generate targeted phishing attacks. The breach was widely publicized, hurting not only Epsilon but also the brands of ccompanies that hired it.

A good way for retailers to learn about a prospective vendor’s security practices is to take a lesson from a draft contract. For example, retailers can not only decline to store credit card information, but also contractually require their third-party vendors to follow that same precaution in order to keep customer data safe.

Lawrence Griff, Audit partner, observes: “It is important for retailers to request an independent auditor’s report on third-party financial and security controls. SOC 1, SOC 2 and SOC 3 reports are replacing the SAS 70 report that many retailers are familiar with.”

Following are the main functions of the three individual SOC reports:• SOC1reportsaddresstheserviceorganization’sfinancial

reporting controls. These reports are intended as auditor- to-auditor communications.

• SOC2reportsdealwiththeserviceorganization’scontrolsrelated to security, availability (of data and computing services), processing integrity, confidentiality and privacy. A SOC 2 report is intended for the user organization’s management and other stakeholders (e.g., business partners and customers).

• SOC3reportsfocusonthesamecontrolsasSOC2but do not include a detailed description of tests of controls or related test results. These reports are released as short-form, publicly available documents.19

16

Glod notes that SOC 2 and SOC 3 reports need not be comprehensive. Retailers can ask for a report that relates specifically to confidentiality or security, for example. Many retailers choose to obtain both SOC 2 and SOC 3 reports in order to share them with stakeholders (SOC 2), post them to their website (SOC 3) or use them in other public communications (SOC 3). The reports can not only help retailers select their third-party vendors wisely, but also go a long way toward assuring customers and other interested parties that the retailer is taking sufficient precautions to shield their information.

Other best practices for retailers employing third-party vendors include keeping backups of critical data and having business interruption contingency plans in place. Glod cites the case of a Virginia-based data center that was raided for hosting child pornography websites, unbeknownst to the many legitimate businesses whose data was also stored there. These businesses experienced website interruptions and in many instances lost irretrievable data. While most retailers will not unwittingly find themselves in the middle of a federal raid, they must take precautions concerning third-party service outages.

Finally, retailers should share only the information their vendors need. BAS IT Senior Manager Brian Browne warns: “Retailers should never give their third-party associates a big file dump. Likewise, they shouldn’t accept reams of information they don’t need. Doing so increases unnecessary liability.”

Third-party vendor considerations• HaveweaskedforaSOC1,SOC2and/orSOC3reportfromour

third-party vendors, as appropriate?• Havewetakenallnecessaryprecautionstoensurethatthird-party

vendors are keeping customer information safe?• Dowehaveon-sitebackupofalldatagiventoourthird-partyvendors?• Haveweensuredthatweareexchangingonlyrelevantinformationwith

our third-party vendors? • Arewefamiliarwithstatetaxlawsandregulationsconcerningthesale

of digital and other intangible products?• Doourcontractswiththird-partyvendorsclearlystipulatetax

responsibility?

Taxes and third-party relationships Thanks to multichannel retailing, more companies are selling digital products through third-party vendors. For example, a software company might have its products available for download through a third-party website. In this case, it can be unclear how to source the income for tax purposes. According to Sutton, this determination hinges largely on the retailer’s contract with its third-party vendor.

Sutton advises retailers to understand the tax laws of the state or states in which they operate. “Depending on where retailers are doing business, taxes could be collected based on the ownership of the digital item, the sale of the digital item, or the ownership of tangible personal property,” he says. A retailer’s contracts with third parties should reflect its adherence to state laws and regulations.

THIRD-PARTY VENDORS

Opportunities• Abilitytotapintothird-partyexpertisewhilefocusingoncorecapabilities• Speedtomarket• Scalability• Potentialcostsavings

Challenges and risks• Datasecurity• Servicereliability• Costandreputationalimpactofthird-partyerrorsorfailures• Taxuncertaintieswithrespecttodigitalandotherintangiblegoods

17


Closing thoughts: Be dynamic, maintain focus

Making use of multiple channels creates significant opportunities for retailers to grow revenues and better target and interact with customers. At the same time, company leadership must understand and manage a host of challenges and risks, many of which pertain to operations, data security, fraud prevention and taxes. Retailers that survive and prosper must be dynamic enough to adapt to evolving multichannel demands and focused enough to deal with the attendant issues.

While the multichannel landscape is always changing, the path ahead is clear. Retail channels will continue to widen, offering customers more autonomy over their shopping practices. In an uncertain economy, one of the safest bets for enhancing revenues may be providing consumers with a comprehensive and effective multichannel experience.

18


Grant Thornton offices

National Office 175 W. Jackson Blvd., 20th FloorChicago, IL 60604-2687312.856.0200

Washington National Tax Office1250 Connecticut Ave. NW, Suite 400Washington, DC 20036-3531202.296.7800

ArizonaPhoenix 602.474.3400

CaliforniaIrvine 949.553.1600Los Angeles 213.627.1717Sacramento 916.449.3991San Diego 858.704.8000 San Francisco 415.986.3900San Jose 408.275.9000Woodland Hills 818.936.5100

Colorado Denver 303.813.4000

Connecticut Glastonbury 860.781.6700

FloridaFort Lauderdale 954.768.9900Miami 305.341.8040Orlando 407.481.5100Tampa 813.229.7201

GeorgiaAtlanta 404.330.2000

IllinoisChicago 312.856.0200Oakbrook Terrace 630.873.2500Schaumburg 847.884.0123

KansasWichita 316.265.3231

MarylandBaltimore 410.685.4000

MassachusettsBoston – N Station 617.723.7900Boston – Fin Distr. 617.226.7000Westborough 508.926.2200

MichiganDetroit 248.262.1950

MinnesotaMinneapolis 612.332.0001

MissouriKansas City 816.412.2400St. Louis 314.735.2200

NevadaReno 775.786.1520

New JerseyEdison 732.516.5500

New YorkAlbany 518.427.5197 Long Island 631.249.6001Downtown 212.422.1000Midtown 212.599.0100

North CarolinaCharlotte 704.632.3500Raleigh 919.881.2700

OhioCincinnati 513.762.5000Cleveland 216.771.1400

OklahomaOklahoma City 405.218.2800Tulsa 918.877.0800

OregonPortland 503.222.3562

PennsylvaniaHarrisburg 717.265.8600 Philadelphia 215.561.4200

Rhode IslandProvidence 401.274.1200

South CarolinaColumbia 803.231.3100

TexasAustin 512.391.6821 Dallas 214.561.2300Houston 832.476.3600San Antonio 210.881.1800

UtahSalt Lake City 801.415.1000

VirginiaAlexandria 703.837.4400McLean 703.847.7500

WashingtonSeattle 206.623.1121

Washington, D.C.Washington, D.C. 202.296.7800

WisconsinAppleton 920.968.6700Madison 608.257.6761Milwaukee 414.289.8200

© Grant Thornton LLPAll rights reservedU.S. member firm of Grant Thornton International Ltd

Contentinthispublicationisnotintendedtoanswerspecificquestionsorsuggestsuitability of action in a particular case. For additional information on the issues discussed, consult a Grant Thornton client service partner.

multichannel retail: more than clicks and bricks

Business

retailers havefor retailers

new customers

customer service

customers implication

growing number of retailers

new opportunities

customer awareness

customer questions