Join the waitlist
Guides/Practice Management

ET 1.150.040 and Third-Party Service Providers: What a CPA Firm Must Disclose and Oversee Before Outsourcing

A working guide to the AICPA third-party service provider rules: client notice under ET 1.150.040, plan-and-supervise under 1.300.040, confidentiality under 1.700.040, and the order to do them in.

CORAA TeamUpdated November 5, 20267 min read

Three interpretations in the AICPA Code of Professional Conduct govern a firm that hands part of an engagement to someone outside the firm. ET 1.150.040 covers telling the client. ET 1.300.040 covers qualifications and supervision. ET 1.700.040 covers protecting confidential client information. Firms that treat them as one checkbox miss the sequence: the notice, the vetting and the contract all have to be in place before the first client file moves.

This post is the operating view. For the rule-by-rule map, see offshore workpaper preparation and the AICPA Code. For the confidentiality rule alone, see ET 1.700 confidentiality and client data offshore.

Who counts as a third-party service provider

The outsourcing rules cover any third-party service provider a member uses, including independent contractors a firm engages, and are not limited to an outside tax service bureau. Accounting Today reported in November 2004 that the AICPA had adopted the rules, for professional services performed on or after July 1, 2005.

The practical result: a freelance reviewer, a staffing arrangement, an offshore preparation team and a software-enabled preparation service are all third-party service providers. Employees of your own firm are not. The test is whether the provider is outside the firm, not where the person sits.

ET 1.150.040: tell the client

ET 1.150.040, "Use of a Third-Party Service Provider," is an interpretation of the Integrity and Objectivity Rule. The Journal of Accountancy summarizes the requirement this way: the firm should inform the client, preferably in writing, that it may use a third party, and should do so before sharing confidential client information with that provider.

Four points follow from that wording.

  1. Timing is fixed. The notice precedes the disclosure of confidential information. A notice sent after the files are already with the provider does not satisfy the interpretation.
  2. Writing is the standard. The text says preferably in writing. Firms that rely on a verbal heads-up cannot prove it later. Put the notice in the engagement letter.
  3. A client objection ends the plan. Under paragraph .02 of the interpretation, if the client objects, the member either does not use the provider for the services or declines the engagement.
  4. Administrative support is carved out. Paragraph .03 says the member need not inform the client when the provider supplies administrative support such as record storage, software application hosting or authorized e-file transmittal.

The notice does not transfer responsibility. The member remains responsible for the work the provider performs.

The AICPA Professional Ethics Executive Committee published sample client-disclosure language for this interpretation. The AICPA publishes it as a download, and it is the starting text for the engagement letter clause. The elements it needs to carry are covered in offshore consent and engagement letter language.

ET 1.300.040: qualifications and supervision

ET 1.300.040 carries the competence side of the same topic. Per the Journal of Accountancy, a firm using a third-party provider should ensure before using it that the provider has the required professional qualifications, technical skills and other resources, and must adequately plan and supervise the provider's work. The interpretation limits that supervision duty to what applicable professional standards require for the engagement. The same article advises vetting the provider independently even when the client chose it, and putting scope, responsibilities and timing in a written agreement with the provider.

Translate that into four firm actions:

  • Qualification check. Record who the provider's preparers are, their training, and the review layers inside the provider. Keep the record in the vendor file.
  • Written scope. Define the tasks, the deliverable format, the deadlines and what the provider does not do. Judgments stay with the firm.
  • Planning. Decide before work starts which schedules the provider prepares, which your staff prepares, and who reviews each.
  • Supervision. Direct, answer questions, and review the output against source. For audits, the engagement partner's duty to direct, supervise and review is set by AU-C 220 as revised by SAS 146. See supervision and review of outsourced work under AU-C 220.

ET 1.700.040: confidentiality

ET 1.700.040, "Disclosing Information to a Third-Party Service Provider," gives the firm two routes under paragraph .02. First, the firm enters into a contractual agreement with the provider to maintain the confidentiality of the information and provides reasonable assurance that the provider has appropriate procedures to prevent unauthorized release of it. The interpretation says the extent of procedures needed to obtain that assurance depends on the facts, including how much public information exists about the provider's controls. Second, the firm obtains specific consent from the client before disclosing the information. The Journal of Accountancy reported the revised confidentiality guidance as effective December 15, 2014.

Most firms choose the contract route and still keep the disclosure in the engagement letter, because 1.150.040 requires the notice regardless of which confidentiality route is used. Notice and confidentiality assurance are separate obligations that are met together.

The order of operations

Run the steps in this sequence for every new provider:

  1. Select and vet. Collect qualifications, security practices and references. Record the evaluation (1.300.040).
  2. Sign the provider agreement. Include confidentiality, data handling, return or destruction of files, and the scope document (1.700.040 and 1.300.040).
  3. Add the disclosure to the engagement letter. Name the category of provider, the work they perform and the location where relevant (1.150.040). Existing clients need an updated letter or written notice before their files go out.
  4. Apply the tax overlay. Where the work involves tax return information, IRC section 7216 and Treasury Regulation 301.7216-2 and -3 add written-consent requirements for disclosure to preparers outside the United States. See Section 7216 consent for offshore tax return preparation.
  5. Release client data. Only now does a file move.
  6. Supervise and document. Review output, record the review, and keep the evidence in the file.

What the firm's file needs

A peer reviewer or an insurer reading the file expects to find the vendor evaluation, the signed provider agreement, the client notice, and evidence of supervision on the specific engagement. The notice and the agreement are one-time items per client and per provider. The supervision evidence is per engagement. See documenting outsourced workpaper review under AU-C 230.

Where CORAA fits

CORAA prepares ready-to-review audit files from client books. The CPA firm keeps the client relationship, the review and the signature. A firm using that kind of service treats it as a third-party service provider under these interpretations: notice in the engagement letter, a provider agreement, and a documented review before sign-off. The firm's obligations do not shrink because the preparation is software-driven. For the wider picture of how firms use outside capacity, read outsourced audit support for CPA firms, and for how reviewers assess the quality system that surrounds it, SQMS 1 quality management.

Sources

CORAA prepares ready-to-review audit files for US CPA firms from client books; you review and sign. See /us.

Part of CORAA University · Quality management and practice: related guides, calculators and templates.

Share

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error

For US CPA firms

Join the CORAA waitlist

CORAA AI drafts audit working papers from your client’s QuickBooks books and does the first pass: lead schedules, tie-out, memos, draft notes and letters. CORAA Network reviewers clear every finding. Your firm reviews and signs.

  • First audit free, so you can judge the quality on a real file
  • Flat fee by entity size; messy books included
  • We work only with CPA firms, never their clients
See how it works →

* required

Keep reading
Schedule M-1 / M-2 / M-3
Book-Tax Differences: Schedules M-1, M-2 and M-3 and How They Tie to the Audit
2 CFR 200.303
2 CFR 200.303 Internal Controls Over Federal Awards: What Recipients Must Have and How Auditors Test It
2 CFR 200.332
2 CFR 200.331 and 200.332 Subrecipient Monitoring: Subrecipient vs Contractor and Pass-Through Duties