Two different instruments carry the client conversation about outsourced preparation. The first is a disclosure: the notice that the firm uses third-party service providers. It applies to every client, attest or non-attest. The second is a consent: the signed, specific authorization that federal tax law requires before tax return information goes to a preparer outside the United States. Firms mix them into one paragraph and satisfy neither. This post separates them and lists the elements each needs.
It is a drafting guide built on the rules, not a template.
Instrument one: the disclosure (all clients)
ET 1.150.040, "Use of a Third-Party Service Provider," an interpretation under the Integrity and Objectivity Rule, requires the firm to inform the client that it uses a third-party provider, preferably in writing, before sharing confidential client information with that provider (Journal of Accountancy, November 2022). The AICPA Professional Ethics Executive Committee published sample language for this notice. Start from that text.
A complete disclosure clause carries these elements:
- The fact of use. State that the firm uses third-party service providers, including independent contractors and outside firms, to assist with engagement work.
- The kind of work. Name the category: preparation of workpapers and schedules, data entry, tick-and-tie, tax return preparation. Name what stays with the firm: review, judgments, conclusions, the signed report.
- The location. If any provider personnel work outside the United States, say so in the letter. The location is the fact clients ask about first, and the tax consent below requires it.
- Confidentiality protection. State that the firm has a written agreement with each provider requiring confidentiality and that the firm has taken steps to be reasonably assured the provider has appropriate procedures. This tracks ET 1.700.040, which allows a contractual agreement with the provider as an alternative to obtaining the client's specific consent (Journal of Accountancy, March 2015).
- Responsibility. State that the firm remains responsible for the work the provider performs. The AICPA outsourcing rules, as reported by Accounting Today, hold the member responsible for all work the provider performs.
- Timing. The letter reaches the client, and the client has the opportunity to respond, before any file moves to the provider. For existing clients, send an amended letter or written notice first.
Add a contact line for client questions about the arrangement. A clause without a named point of contact reads as boilerplate.
Attest clients
For an audit client, the disclosure belongs in the engagement letter alongside the AU-C 210 terms. See audit engagement letter: required elements. Two additions for attest work:
- Access to client data. Audit preparation from client books involves the general ledger, bank activity and payroll detail. List the categories of client information the provider receives so the confidentiality statement matches the data.
- Supervision statement. State that provider-prepared work is reviewed by the firm's engagement team under the engagement partner's direction. This reflects the engagement partner's responsibility under AU-C 220 as revised by SAS 146. See supervision and review of outsourced work under AU-C 220.
Non-attest clients
For bookkeeping, compilation, preparation and advisory clients, the same six elements apply. The compilation and preparation letters under SSARS should carry the same disclosure clause as the audit letter. See compilation engagements and preparation engagements.
Instrument two: the Section 7216 consent (tax return information)
When the work includes tax return information, Treasury Regulation 301.7216-3 governs the consent, and 301.7216-2 governs when consent is needed. The relevant points from the eCFR text:
- When consent is required. Under 301.7216-2(c)(2), a preparer in the United States who shares information with its own employees for auxiliary services needs no consent unless the recipient is outside the United States, in which case the taxpayer's consent under 301.7216-3 is required before any disclosure. Under (d)(1), disclosure to another U.S. preparer for auxiliary services is allowed without consent only where the services are not substantive determinations.
- Form of consent. The consent must be written and knowing and voluntary (301.7216-3(a)(1)). Conditioning services on the consent makes it involuntary, with a narrow exception for preparer-to-preparer disclosures in (a)(2).
- Contents. The consent names the preparer and the taxpayer, states the purpose and the specific recipients (or, for filers outside the Form 1040 series, a descriptive class of recipients), identifies the specific tax return information, and is signed and dated by the taxpayer (301.7216-3(a)(3)(i) and (iii)).
- Disclosure outside the United States. Consent is required before any disclosure to a preparer located outside the United States (301.7216-3(a)(3)(i)(D)). The regulation's Example 2 in (a)(3)(iv) shows an engagement-letter statement acknowledging that information goes to preparers abroad. The example is illustrative; the regulation prescribes no mandatory wording in this paragraph.
- Before disclosure. The consent is obtained before the preparer discloses or uses the information. Retroactive consent is not allowed (301.7216-3(b)(1)).
- Duration. The consent sets its own duration. If it states none, it is effective for one year from the date the taxpayer signed (301.7216-3(b)(5)).
- Copy. The preparer gives the taxpayer a copy of the executed consent at the time of signing (301.7216-3(c)(3)).
- Social Security numbers. A U.S. preparer cannot obtain consent to disclose a Form 1040-series filer's SSN to a preparer outside the United States. The SSN is redacted or masked before the rest of the information goes abroad. An exception in (b)(4)(ii) applies only when the disclosure uses an adequate data protection safeguard defined in IRS guidance and the consent request verifies that the safeguard will be maintained.
The detailed walk-through is in Section 7216 consent for offshore tax return preparation.
Keeping the two instruments apart
| Item | Disclosure (ET 1.150.040) | Consent (7216) |
|---|---|---|
| Applies to | All clients | Tax return information |
| Form | Preferably written; engagement letter | Written, signed and dated by the taxpayer |
| Standalone | Clause in the letter | Separate consent with the required contents |
| Covers location | Name it | Required for disclosure outside the U.S. |
| Voluntary | Notice | Cannot be a condition of service (with the stated exception) |
For clients who receive both audit or accounting services and tax services, send both: the disclosure in the engagement letter and the consent as a separate document with its own signature block.
What goes in the firm's file
Retain the signed engagement letter, the signed consent where required, the date each was sent and returned, the provider agreement, and a record showing no file moved before the paper was in place. The sequence and supporting rules are in ET 1.150.040 third-party service provider disclosure and oversight and ET 1.700 confidentiality.
Sources
- Journal of Accountancy, "Working with third-party experts" (November 2022), on ET 1.150.040: https://www.journalofaccountancy.com/issues/2022/nov/working-with-third-party-experts.html
- Journal of Accountancy, "AICPA confidentiality rule" (March 2015), on ET 1.700.040: https://www.journalofaccountancy.com/issues/2015/mar/aicpa-confidentiality-rule.html
- Accounting Today, "AICPA adopts new ethics requirements for members who outsource": https://www.accountingtoday.com/news/aicpa-adopts-new-ethics-requirements-for-members-who-outsource
- AICPA, Sample client disclosure language for outsourcing rules: https://www.aicpa-cima.com/resources/download/sample-client-disclosure-language-for-outsourcing-rules
- 26 CFR 301.7216-2, Disclosure or use permitted without consent of the taxpayer (eCFR): https://www.ecfr.gov/current/title-26/part-301/section-301.7216-2
- 26 CFR 301.7216-3, Disclosure or use permitted only with the written consent of the taxpayer (eCFR): https://www.ecfr.gov/current/title-26/part-301/section-301.7216-3
CORAA prepares ready-to-review audit files for US CPA firms from client accounting records; the firm keeps the client relationship, the review and the signature. See /us.
Part of CORAA University · Quality management and practice: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error