---

AICPA Issues Outsourcing Rules
Take Effect July 1

By Simon Eskow

The American Institute of CPAs late last year finalized new rules for its members that use any third-party entities.

The AICPA’s Professional Ethics Executive Committee last October adopted two new rules and one rule revision that generally broaden the definition of third-party service providers and require AICPA members to inform their clients, before disclosing private information to such providers, that the member “may use a third-party service provider.”

Members also must enter into a contractual agreement with the third-party service provider to ensure confidentiality of clients’ private information and to be reasonably assured that the provider will not release confidential information without authorization.

The new rules are effective for all new professional service agreements performed on or after July 1, except for agreements already in existence on June 30 and completed by Dec. 31.

The rules were finalized at the end of a year that saw outsourcing become a buzzword in the general public, as more American companies outsourced services, such as customer-support call centers, to foreign shores. Guidance before the new rules were issued was limited.

Getting Consent

The AICPA’s PEEC issued Ruling 112 under Rule 102, which defines a third-party service provider as “an entity that the member…does not control (as defined by accounting principles generally accepted in the United states)…or an individual not employed by the members…to assist the member in providing professional services (for example bookkeeping, tax return preparation, consulting, or attest services, including related clerical and data entry functions) to clients.”

The ruling states that “before disclosing confidential information to a third-party service provider, a member should inform the client, preferably in writing, that the member may use a third-party service provider.”

Ethics Ruling No. 12, under Rule 201—General Standards and Rule 202—Compliance with Standards, essentially reinforces the member’s responsibility “for oversight of all services performed by the third party…and for ensuring that all professional services are performed with professional competence and due professional care.” The member must plan and supervise those services, obtain data to support the product and comply with applicable technical standards.

Finally, Ethics Ruling No. 1, under Rule 301—Confidential Client Information, changes the scope of the rule beyond “Computer Processing of Clients’ Returns” to “Third-Party Service Provider to Provide Professional Services to Clients or Administrative Support Services to the Member.” According to Ruling No. 1, 301 is not intended to prohibit a member from disclosing client information to a third party. However, the ruling states that before using such a service the member “should enter into a contractual agreement with the…provider to maintain the confidentiality of the information and be reasonably assured that the…provider has appropriate procedures…to prevent the unauthorized release of confidential information to others.”

Ruling No. 1 later states that, “in the event the member does not enter into a confidentiality agreement with a third-party service provider, specific client consent should be obtained before the member discloses confidential client information to the…provider.”

Communicating with Clients

Richard Hecht, a member of the New York State Society of CPAs’ Tax Division Oversight Committee, said the rules were a little confusing in that, on the one hand, they state that you are supposed to inform your client about outsourcing, while on the other hand, Ruling No. 1 under Rule 301 seems to contradict that.

“If you have an agreement that they will keep the information confidential, the AICPA says that if you’ve got a contractual agreement with a third-party provider, you don’t need the written consent to do so,” Hecht said.

However, Hecht said this topic came up during the Society’s Annual Tax Plenary Conference last year, centering on how to communicate to a client that you are using third-party outsourcing service providers.

“The people who seem most successful were the ones who were the most forthright and gave their clients the option to say no, and the firm should comply,” he said.