Skip to main content

Agency problems in the PCI world?

Posted by: admin 15 years ago

If you are a PCI QSA or a PCI merchant or processor, you might enjoy this article about the relationship between the QSA and the client.  The entire PCI eco-system is quite fascinating.  There's definitely potential for an agency issue in that QSAs are paid by their clients to enforce the PCI Counsel's regulations. 

This situation is reminiscent of the real estate appraisal market.   Appraisers are independently certified and registered with the state. Their fees are paid at closing by the buyer, though they work for the bank.  The key is that they are chosen by the real estate agent.  And if the appraiser kills a deal because his valuation is too low, they don't get any more deals.

The PCI Council could take steps to minimize or offset the agency issue.  For example, they could forbid the use of the same QSA more than one year in a row.  Enforcing a short-term view might help with that problem, but it might not stop merchants from choosing "easy graders".

If I were a behavioural economist, I would be very interested in the PCI market.  One reason is that you should be able to measure improvements over time based on breach data.  In the real estate market that would be a lot harder because the pressure to have appraised values meet the purchase price affects the market itself.  You would have to statistically analyze sale prices prior to the closing date for a specific property and know the appraised value, which is not readily available. 

Current rating: 1

Recent Posts

Archive

2024
2022
2021
2019
2018
2017
2016
2015
2014
2013
2012
2011
2010
2009
2008

Categories

Tags

Authors

Feeds

RSS / Atom