Independence interpretation on hosting services gets new effective date

The effective date of the new “Hosting Services” interpretation (ET §1.295.143) in the AICPA’s “Independence Rule” (ET §1.200.001) has been extended 10 months by the AICPA Professional Ethics Executive Committee (PEEC).

PEEC voted last week to move the effective date to July 1, 2019; the ethics interpretation originally was scheduled to take effect on Sept. 1, 2018. The additional time is being provided to allow AICPA members to work with their third-party vendors and clients to implement any necessary changes resulting from the new interpretation.

Although the extension provides more time for implementation, CPAs who have not addressed the need to make changes as a result of the interpretation may wish to focus on this issue now. In particular, the interpretation requires an evaluation of the possibility of management participation threat for CPAs that provide software solutions, including cloud-based tools, to store, move, and manipulate data.

The new interpretation to the “Independence Rule” in the AICPA Code of Professional Conduct explains that taking responsibility for hosting an attest client’s data or records impairs a CPA’s independence. Examples of situations in which a CPA takes responsibility for hosting a client’s data include:

• Becoming the sole host of a client’s financial or nonfinancial information system.
• Serving as custodian for the client’s data in such a way that the client’s data are incomplete and accessible only through the CPA.
• Providing business continuity or disaster recovery services to the client.

The interpretation follows the fundamental principle in the independence rules that states that CPAs should not perform for attest clients activities that are management’s responsibility.

The AICPA staff is developing resources to assist CPAs with implementing the standard; the resources are scheduled to be available by the end of this year. Questions also can be directed to the Professional Ethics hotline via email at ethics@aicpa.org.

— Ken Tysiac (Kenneth.Tysiac@aicpa-cima.com) is JofA editorial director.