IT Audit

Tampa firm 360 Advanced finds its clients by being picky. It's all about finding a client who understands the value of the services it provides, which is hard when most firms would rather simply check a box to say they've completed a data security audit.

In the world of information security and compliance, companies' processes matter. For example, how they gather and transmit credit card data, or what their systems are for protecting clients' privacy and personal information — it all equates to how much liability and risk they and their clients bear — whether they know it or not.

Unlike most of its competition, 360 Advanced, a firm that specializes in IT security and compliance accounting, brings a heftier value proposition to the table — it helps companies leverage their data security to accomplish business goals. “We take the burden of compliance and translate it into risk management and revenue strategies,” says Dan Collins, president of 360 Advanced. “We know most of our competition treats it as a commodity.”

Those business goals could be helping a company go public, get acquired, gain additional clients, move into a new line of business or secure a significant round of funding.

The 20-person company has clients in five continents, more than 15 countries, and nearly 40 states. Since it started in 2007, 360 Advanced has averaged 63% year-over-year growth, maintaining a steady 30% growth over the last couple years. The company declined to share revenues.

The firm boasts Fortune 500 clients such as WellCare Health Plans, Carbonite and Shutterfly. Recently, the company worked with the New York Times to help it find ways to meet the payment card industry (PCI) data security standards.

Though the firm started as a traditional CPA firm in 2004, it separated into its own boutique IT professional accounting services company in 2009. Around 85% of the company's revenues are from business-to-business service providers that process data and facilitate transactions on behalf of clients.

“The world we live in today, everything is automated,” Collins says. “Your information and data are everywhere and the more that things become outsourced and the more automation that takes place, the higher the risk is to the individual or the business whose data is being managed by someone else. That's where we come in to play.”

It all started when Collins and his colleagues were working with a company on Sarbanes-Oxley work. The company, a large employer services company providing payroll and benefits out of Missouri, had a vendor that required a SAS 70 audit, essentially an audit on the company's controls. Collins and his team had previous experience doing the work, and offered to provide the service. “They thought our work was great, that led to the next referral, and next thing you know, things just started to transpire,” Collins says.

The company started with a solid book of clients by leveraging existing networks of the leadership team, according to Collins. The company kept profit margins tight to hire from the top down, investing in an experienced leadership team.

360 Advanced has worked with big-names such as the New York Times because it provides value without the price tag of a brand name, Collins says. “We're not charging an upcharge because we're a Big Four accounting firm and that's what you're paying for. You're getting generally more experienced professionals for a lower cost.”

Collins insists that there's not too much competition, for their qualification process makes it clear if a prospect is “a fit for us or a fit for them.” The company even has a referral relationship with one of the Big Four accounting firms, though they declined to share which one. Sometimes a job may be too big of a scope for 360 Advanced to handle, or it requires a specific expertise that could be better served by a large team, Collins says.

One of the company's biggest challenges is communicating its full value potential to clients. Many prospects tend to be in reactive mode because they are forced to meet a compliance standard. Collins says it can be difficult to transform that attitude, but “you need to consider this a strategic opportunity rather than a painful necessity.”

Collins says most people would guess potential data breaches are always on his mind, but he insists that's not the case: “I know that we do a really good job and it really doesn't keep me up at night.”