ET 1.700 Confidentiality and Client Data When Work Goes Offshore

Every audit file starts with client data: trial balances, general ledgers, bank statements, payroll registers, customer lists. When a firm gives a third party access to that data, the AICPA Confidential Client Information Rule decides what the firm must do first. This post covers the rule, its exceptions and the third-party service provider interpretation, ET 1.700.040.

The rule: ET 1.700.001

The Confidential Client Information Rule prohibits a member in public practice from disclosing confidential client information without the client's specific consent. The rule carries its own list of exceptions, which the firm reads in the Code itself. Third-party service providers are handled by a dedicated interpretation, so a firm cannot treat outsourcing as a free-standing exception to the rule.

Two points set the scope:

• Workpapers built from a client's ledgers, bank statements and payroll records carry the client's confidential information. Treat every file in the engagement folder as covered.
• The prohibition applies to disclosure. A vendor with read access to a client's accounting file or a shared drive receives the information, whether or not it downloads a copy.

The interpretation: ET 1.700.040

ET 1.700.040, titled Disclosing Information to a Third-Party Service Provider, lets a firm disclose confidential client information to a provider after doing one of two things (paragraph .02):

1. Contractual agreement. Enter into an agreement with the provider to maintain the confidentiality of the information, and provide reasonable assurance that the provider has appropriate procedures to prevent unauthorized release of it, or
2. Specific client consent. Obtain the client's specific consent before the disclosure.

The interpretation says the procedures needed for reasonable assurance depend on the facts, including how much public information exists about the provider's controls. The AICPA's outsourcing standards, applicable to services performed on or after July 1, 2005, also made the member responsible for all work the provider performs (Accounting Today). The definition of provider is broad and includes independent contractors a firm uses on engagements.

The firm picks the route per client or per class of client. The contract route requires no client signature on the disclosure itself, but the separate client notice under ET 1.150.040 still applies: the firm should inform the client, preferably in writing and before sharing the information, that it may use a provider. That interpretation excepts administrative support such as record storage, software hosting and e-file transmittal. The overview in offshore workpaper preparation and the AICPA Code places the three interpretations side by side.

What the provider contract needs

A one-line confidentiality promise is thin evidence of reasonable assurance. The agreement should address each of these:

• Definition of confidential information that covers all client data, workpapers and derived files, in any form
• Use limitation: the provider uses the data only for the firm's engagements, with no secondary use, benchmarking or model training
• Personnel obligations: named individuals or roles with signed confidentiality undertakings, and a defined access list
• Security controls: encryption in transit and at rest, multi-factor authentication, access logging, and secure disposal. These also satisfy the vendor-oversight duties in the FTC Safeguards Rule
• Subcontractors: no onward disclosure without the firm's written approval, with the same terms flowing down
• Incident notice: a fixed time to tell the firm about any unauthorized access, so the firm can meet its own notification duties
• Return and deletion: data returned or destroyed at termination, with written certification
• Assurance rights: the firm's right to receive control evidence, such as an independent assurance report, or to inspect the provider's controls. SOC 2 report anatomy shows how to read the report a provider hands over.
• Governing law and venue that give the firm a workable remedy in a US court

The assurance clause is what turns a promise into evidence. Request the provider's control documentation at onboarding, read it, and file your conclusion in the vendor file.

Where the data lives

Offshore work raises one question that domestic work does not: where does the data sit? A provider that works in a US-hosted environment through remote desktop, with downloads disabled, exposes the data far less than one that copies files to local machines abroad. Specify in the contract and in the onboarding file:

• the hosting location and the firm-controlled workspace the provider uses
• whether download, print, clipboard and removable media are blocked
• how the firm revokes access the same day an individual leaves the provider

The interpretation asks for reasonable assurance about the provider's procedures, and a recorded architecture is the evidence of it.

Tax data is a separate regime

The AICPA rule is one layer. Tax return information carries statutory limits under IRC 7216, with its own written consent requirement for disclosure to a preparer located outside the United States. Satisfying ET 1.700.040 does not satisfy 7216. See Section 7216 consent for offshore tax return preparation. A firm that does both audit and tax work for a client needs both sets of documents.

Engagement letter language

Place the disclosure in the audit engagement letter, and keep it plain. The clause names the category of provider, states that the provider works under written confidentiality obligations and under the firm's supervision, states the country where the work is performed, and confirms that the firm remains responsible for the work. If the firm relies on consent instead of a contract, the clause asks for the client's specific consent and records it with a signature.

File documentation

At the end of each engagement the file shows:

• the provider agreement in force during the engagement
• the client notice or consent
• the provider's current control evidence and the reviewer's conclusion
• the access list and the revocation record

Those four items answer the questions a peer reviewer or a client's counsel asks.

Sources

• Journal of Accountancy, "AICPA confidentiality rule" (March 2015), on Interpretation 1.700.040 (specific consent or contractual agreement; reasonable assurance): https://www.journalofaccountancy.com/issues/2015/mar/aicpa-confidentiality-rule.html
• Journal of Accountancy, "Working with third-party experts" (November 2022), on ET 1.700.040, paragraph .02, and ET 1.150.040: https://www.journalofaccountancy.com/issues/2022/nov/working-with-third-party-experts/
• Accounting Today, "AICPA adopts new ethics requirements for members who outsource" (July 1, 2005 effective date; notice, contract and reasonable assurance): https://www.accountingtoday.com/news/aicpa-adopts-new-ethics-requirements-for-members-who-outsource
• 26 CFR 301.7216-3, consent to disclosure of tax return information: https://www.ecfr.gov/current/title-26/chapter-I/subchapter-F/part-301/subpart-ZZ/section-301.7216-3

CORAA prepares ready-to-review audit files for US CPA firms from client books; you review and sign. See /us.

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error