| EXECUTIVE
SUMMARY |
 THE AICPA HAS RECEIVED A
NUMBER of inquiries regarding
practitioners’ responsibilities in
outsourcing engagements. The applicable
guidance is found in the AICPA’s Code of
Professional Conduct, the
Gramm-Leach-Bliley Act and certain
Internal Revenue Code provisions.
THE CODE OF PROFESSIONAL
CONDUCT STATES that a member
remains responsible for ensuring the
accuracy and completeness of the
services rendered by the third-party
provider.
MEMBERS SHOULD SATISFY
THEMSELVES regarding the
competence, practices and procedures of
any third-party provider, regardless of
the type of services provided or the
location at which they are performed. At
a minimum, it seems advisable for
members to discuss with the third party
the specific controls in place to
safeguard the client’s information and
to satisfy themselves such controls are
adequate.
WHATEVER THE MEASURES
USED BY THE third-party
provider, the member should be satisfied
that reasonable efforts are undertaken
to assure the confidentiality of the
information to which the provider has
access. A confidentiality breach by the
outsourcer, even if all of the noted
steps were taken, will still be the
responsibility of the member.
THE CODE OF PROFESSIONAL
CONDUCT DOES NOT require
members to advise clients regarding
their use of a third-party provider.
Such disclosure is at the sole
discretion of the practitioner. Advising
clients of the use of third-party
providers, however, in no way relieves
members of their responsibilities to
comply with the code as discussed in the
article. | | RICHARD I. MILLER is general
counsel and secretary of the AICPA. His
e-mail address is
rmiller@aicpa.org . Alan W.
Anderson, CPA, is senior vice-president of
member and public interests at the AICPA.
His e-mail address is aanderson@aicpa.org
. |
 he Institute has received a number
of inquiries regarding the responsibilities of
members who use third-party service providers in
client engagements. Commonly known as
“outsourcing,” this practice has been employed by
members for decades to provide more effective
services to their clients. Examples of services
that may be outsourced include
 Tax preparation and processing.
Bookkeeping.
Certain audit procedures performed by
contract staff.
Outside specialist services in
connection with an audit.
Human resources services.
Investment advisory services.
Workpaper storage or destruction
services. This paper will discuss member
responsibilities in three areas: AICPA ethical
standards, the Gramm-Leach-Bliley Act (GLBA) and
certain Internal Revenue Code provisions.
AICPA ETHICAL STANDARDS
The AICPA’s professional ethics
division addressed the use of third-party
providers as early as 1973 in Ethics Ruling no. 1,
under the AICPA Code of Professional Conduct, Rule
301, Computer Processing of Client Returns (ET
section 391.001–.002). While that ethics ruling
specifically deals with using outside services to
process tax returns, it also would apply to any
use of third-party providers. The ruling advises
that members “must take all necessary precautions
to be sure the use of outside services does not
result in the release of confidential
information.” (Because of continuing questions
concerning the use of third-party providers, the
professional ethics executive committee [PEEC] in
its meeting on January 22, 2004, appointed a task
force to study whether this ruling needs to be
revised. Should any further guidance be issued by
the PEEC, it will be made available to members as
soon as practicable.) T he code also
states that a member remains responsible for
ensuring the accuracy and completeness of the
services provided by the third-party provider.
Specifically, it requires all professional
services to be performed with professional
competence and due professional care (see Rule
201, General Standards [ET section 201.01]).
Accordingly, using third-party providers to assist
in performing services for clients does not in any
way excuse practitioners from these or other
responsibilities under the code. In view
of these requirements, members should satisfy
themselves regarding the competence, practices and
procedures of any third-party provider, regardless
of the type of services provided or the location
at which they are performed. At a minimum, it
seems advisable for members to discuss with the
third party the specific controls in place to
safeguard the client’s information and to satisfy
themselves that such controls are adequate. For
example, where client information is transmitted
via the Internet, the member may want to inquire
as to specific security measures in place, such as
Encryption techniques.
The use of private leased lines or
virtual private networking connections with
authorized users.
The availability and processing
integrity of the information.
Whether the third-party provider has
had an engagement performed (internal or external)
on the security of their systems.
Whether the third-party provider has
obtained an independent security attestation
regarding their systems. Once satisfied
there are sufficient procedures in place to ensure
the security of information transmitted
electronically to a third-party provider, members
also should satisfy themselves that controls are
in place to ensure the information remains
confidential. There are many ways by which
third-party providers might satisfy a practitioner
in this regard. For example, they may use
nondisclosure agreements with their employees;
implement certain computer protections that
prohibit downloading, printing, scanning or
copying a client’s financial information; and
incorporate firewall security to prevent outsiders
from hacking into the system. Periodic testing of
these security measures could also provide more
comfort to the practitioner. Whatever the measures
used by the third-party provider, the member
should be satisfied that reasonable efforts are
undertaken to assure the confidentiality of the
information to which the provider has access. A
confidentiality breach by the outsourcer, even if
all of the above steps were taken, still will be
the responsibility of the member. (The subjects of
security, privacy, confidentiality, online
processing and availability, among others, are
covered in the AICPA/CICA Trust Services
Principles and Criteria Framework, available at
www.aicpa.org/trustservices ). A s
part of their overall responsibility to ensure
that all professional services are performed with
professional competence and due professional care,
members are responsible for adequate supervision
of all such professional services. The member
should review all work performed by a third-party
provider since he or she will remain fully
responsible for the accuracy and completeness of
the services provided. Should a question
be raised regarding a member’s compliance with any
of his or her professional responsibilities,
including those discussed above, the member may be
in a better position if he or she can demonstrate
that he or she took reasonable steps to meet those
obligations. The code does not require
members to advise clients regarding their use of a
third-party provider. Therefore, advising the
client of such use is at the sole discretion of
the member unless the client questions the member
regarding such practice. However, whether or not
clients are advised of the use of third-party
providers, members are not relieved of their
responsibilities to comply with the code as
outlined above.
GRAMM-LEACH-BLILEY ACT
In addition to the member’s
responsibilities under the code to maintain
confidentiality, the Gramm-Leach-Bliley Act of
1999 needs to be considered as well. In GLBA,
Congress included protections that allowed
consumers to determine when personal financial
information could be shared among financial
service institutions. The Federal Trade Commission
(FTC), one of the federal agencies charged with
implementing the privacy requirements of the GLBA,
promulgated a set of rules that govern the use of
consumer financial information (
www.ftc.gov/privacy/privacyinitiatives/financial_rule_lr.html
). These rules, particularly 16 CFR
[Code of Federal Regulations] section 313.4,
require persons or businesses offering financial
services for personal, family or household
purposes to provide notices regarding their
information-sharing policies and practices. The
notices must be provided to ongoing customers at
the time the customer relationship begins and,
according to 16 CFR section 313.5, annually
thereafter. A person who provides personal,
nonpublic information to obtain financial,
investment or economic advisory services,
regardless of whether there is a continuing
customer relationship, is also entitled to notice
prior to, and the ability to opt out of, any
actual disclosure of such information to a
nonaffiliated third party. Therefore, as currently
interpreted, GLBA requires practitioners who
provide, among other things, tax planning and tax
preparation services to individual clients, to
give notice of the practitioner’s policy regarding
disclosure of private information at the start of
an engagement, and annually thereafter. T
he notices required by GLBA generally require
disclosure to the client of categories of
nonaffiliated third parties to whom there is
disclosure of nonpublic information, under section
313.6. GLBA does not, however, require that a
practitioner specifically disclose to a client the
fact that independent third-party providers are
used in performing services for clients. Section
313.14 provides an exception to the notice and
opt-out requirements for “processing and servicing
transactions.” In summary, the notice and opt-out
requirements described above do not apply if (1)
the practitioner shares nonpublic personal
information in connection with servicing or
processing a financial product or service that a
consumer requests or authorizes or (2) the sharing
of information with the third party is required,
or is a usual, appropriate or acceptable method to
carry out the transaction or service of which the
transaction is a part, or to record, service or
maintain the consumer’s account in the ordinary
course of providing the financial service or
product. In other words, if the
third-party provider is connected to or involved
in the provision (or processing) of the services
offered by the practitioner, there is no
requirement to disclose to the client the fact
that information is shared with that third party.
Accordingly, if you disclose only to nonaffiliated
third parties covered by the exceptions described
above, the FTC, in section 313.6 and its “Sample
Clauses” (in appendix A), states the following
language must be placed in the notices: “We do not
disclose any nonpublic personal information about
our customers or former customers to anyone,
except as permitted by law.” If you disclose to
nonaffiliated third parties that are not covered
by the exceptions, then you are required to list
in your notices, by category, the nonexempt third
parties (such as insurance agents, retailers or
marketers), and the FTC states the following
clause should also be added: “We may also disclose
nonpublic personal information about you to
nonaffiliated third parties as permitted by law.”
The FTC’s rules do, however, limit the
extent to which a nonaffiliated third party may
use and reuse the information that has been
disclosed. Specifically, a nonaffiliated third
party may disclose the information only to the
financial institution itself, the third party’s
affiliates (who are also bound by the same
restrictions as the third party) or pursuant to
the exceptions outlined above—that is, to obtain a
service in connection with the service or the
function the outside firm is performing. F
urthermore, the FTC promulgated safeguard rules
that require a financial institution, which,
again, could be anyone offering financial
services, to oversee the third-party provider’s
use of the information and ensure compliance with
GLBA. This rule (16 CFR section 314.4) requires
that institutions develop, implement and maintain
an information security program. In doing so, an
institution must oversee service providers by
taking reasonable steps to select and retain
service providers that are capable of maintaining
appropriate safeguards for the customer
information at issue and requiring service
providers by contract to implement and maintain
such safeguards. (AICPA/CICA Trust Services
Principles and Criteria Framework may be useful as
a benchmark when determining the appropriate
safeguards for service providers.)
INTERNAL REVENUE CODE
IRC section 7216 prohibits anyone
who is involved in the preparation of tax returns
from knowingly or recklessly disclosing or using
the tax-related information provided other than in
connection with the preparation of such returns.
Anyone who violates this provision may be subject
to a fine or even imprisonment. The regulations
under section 7216 provide an exemption from this
law for tax return preparers who disclose taxpayer
information to a third party for the purpose of
having that third party process the return.
Nevertheless, members should make third-party
providers to which they have supplied protected
client information aware of this requirement. Note
there is no requirement in section 7216 or its
regulations for a member to inform the client that
a third-party provider is being used. In
addition, IRC section 7525 provides a client with
a privilege similar to an attorney-client
privilege when they make certain tax-related
disclosures to, among others, CPAs. Care needs to
be taken to assure that a third-party provider
does not do anything that adversely affects a
client’s rights under this provision. B
ecause of the requirements of federal law as
outlined above, it is important for practitioners
to be aware of their continuing obligations to
safeguard client data. In this regard, it would be
advisable—indeed likely necessary—to perform due
diligence before disclosing information to a
third-party provider to ensure the provider is
capable of adequately protecting nonpublic
information. (As noted earlier, the Code of
Professional Conduct imposes similar obligations.)
This seems particularly imperative where the
provider is located in an unfamiliar location, or
where enforcement of privacy laws and the
prosecution of those who misappropriate private
information may be more difficult. Thus, the
contract between the practitioner and the
third-party provider should contain appropriate
provisions for the protection of consumer privacy.
THE PRACTITIONER’S DUTY
Whether they derive the
regulations from the Code of Professional Conduct,
the Internal Revenue Code or the
Gramm-Leach-Bliley Act, practitioners and their
firms are responsible for maintaining the security
and confidentiality of client information. In
addition, in performing any service for a client,
practitioners must do so with professional
competence, with due professional care and in
compliance with all provisions of the Code of
Professional Conduct. Even after the practitioner
is satisfied that a third-party provider is
properly structured to ensure continued compliance
with all laws and regulations and ethical
requirements, a practitioner’s duties do not end.
Monitoring procedures should be established to
ensure the procedures that third-party providers
have put into place remain effective.
Practitioners and their firms should consult
their own legal advisers for additional guidance
on this subject. |
Get Clients Ready for Tax Season