A CPA firm that sends workpaper preparation to an offshore team or any other outside provider does not hand off responsibility. The AICPA Code of Professional Conduct treats the provider as an extension of the firm, and the firm answers for every schedule that comes back. This post maps the Code provisions that apply, so the engagement letter, the vendor contract and the review procedures line up with them.
The Code gives outsourcing its own interpretations. Three carry the same title or close to it, each under a different rule. A firm that reads only one misses the other two.
The rules at a glance
| Code reference | Rule it sits under | What it asks of the firm |
|---|---|---|
| ET 1.300.040, Use of a Third-Party Service Provider | General Standards | Ensure the provider has the professional qualifications required for the work, and plan and supervise it |
| ET 1.150.040, Use of a Third-Party Service Provider | Integrity and objectivity | Inform the client, preferably in writing, before confidential information goes to the provider |
| ET 1.700.040, Disclosing Information to a Third-Party Service Provider | Confidential Client Information Rule | Obtain client consent, or use a confidentiality contract that meets the interpretation's conditions |
| ET 1.295 | Independence, nonattest services | Keep any service the provider performs inside the nonattest framework for attest clients |
The first three come from the AICPA's outsourcing standards, adopted in 2004 and applicable to professional services performed on or after July 1, 2005. The definition of a third-party service provider is broad. It covers any third-party provider a member uses, including independent contractors (Accounting Today).
Competence and supervision: ET 1.300.040
The General Standards Rule requires professional competence, due professional care, adequate planning and supervision, and sufficient relevant data. ET 1.300.040 applies those standards to outsourcing. The firm ensures the provider has the required professional qualifications, and the firm plans and supervises the provider's work as it would the work of its own staff.
In practice, "ensure" means documented evidence at the start of the relationship:
- The provider's staff training in US GAAP, GAAS and the AICPA's documentation expectations, with the curriculum on file
- Defined roles: who prepares, who reviews inside the provider, who reviews at the firm
- Written instructions for each deliverable, including file naming, tick marks and cross-referencing conventions
- Evidence that firm reviewers inspected the work, not merely received it
Supervision is not satisfied by a clean final package. The supervising CPA reviews the work at the depth the risk calls for and records that review in the file. The review standard for the engagement is the same whether the preparer sits in the next office or on another continent. For audit engagements, documenting audit procedures is the discipline that proves it.
Client notice: ET 1.150.040
The Code requires the firm to tell the client, preferably in writing, that a third-party service provider will be used on the engagement. The notice comes before confidential client information is shared with the provider. Most firms place the statement in the audit engagement letter, which gives it a date and a signature in one step.
A sentence that names the category of provider and the work it performs fits the notice into the engagement letter. Add the location of the work; it is the first thing clients ask about, and the tax consent in the 7216 regulations requires it.
Confidentiality: ET 1.700.040
The Confidential Client Information Rule prohibits disclosing confidential client information without the client's specific consent, subject to listed exceptions. ET 1.700.040 addresses disclosure to a third-party service provider. The firm has two routes. It obtains the client's specific consent, or it enters into a contractual agreement with the provider to maintain the confidentiality of the information, and meets the other conditions in the interpretation. The 2004 outsourcing standards also called for reasonable assurance that the provider has appropriate procedures to prevent unauthorized release of the information (Accounting Today), so the provider contract and file should evidence them.
The contract route is the standard one for firms with several providers, and it needs real content. The companion post ET 1.700 confidentiality and client data offshore lists the clauses.
Independence: ET 1.295
Independence applies to the people who perform the work. When the firm audits a client, anything the provider does that resembles bookkeeping, preparing financial statements or journal entries is a nonattest service for independence purposes. ET 1.295 requires the firm to evaluate threats and apply safeguards before it performs a nonattest service for an attest client. The independence and nonattest services guide walks through the framework.
Workpaper preparation sits on the audit side of the line. Schedules prepared from client records for the auditor's use, such as a lead schedule, a roll-forward or a population for testing, are audit documentation. The distinction breaks down when the provider proposes entries to the client's books. Keep proposed adjustments as auditor documents and let management record its own entries.
Quality management: SQMS 1
For audit and attest practices, SQMS No. 1 adds a firm-level layer. Resources from service providers are part of the firm's system of quality management. The firm determines whether those resources are appropriate for use, addresses related quality risks and monitors them. See the SQMS 1 guide for the structure.
A working checklist
- Written provider agreement with confidentiality terms, security requirements and a right to audit or review the provider's controls
- Engagement letter language disclosing the provider, with client acknowledgement
- Documented qualification and training evidence for the provider's staff
- A supervision plan and a record of firm reviewer sign-off on each deliverable
- An independence assessment for each attest client
- Tax work: the separate consent rules under IRC 7216 apply. See Section 7216 consent for offshore tax return preparation
- The FTC Safeguards Rule vendor-oversight duties. See the FTC Safeguards Rule for CPA firms
For the commercial side of the model, see outsourced audit support for CPA firms.
Sources
- AICPA Code of Professional Conduct, ET 1.300.040, ET 1.150.040 and ET 1.700.040 as summarized in Journal of Accountancy, "Working with third-party experts" (November 2022): https://www.journalofaccountancy.com/issues/2022/nov/working-with-third-party-experts/
- Journal of Accountancy, "AICPA confidentiality rule" (March 2015), on Interpretation 1.700.040: https://www.journalofaccountancy.com/issues/2015/mar/aicpa-confidentiality-rule.html
- Accounting Today, "AICPA adopts new ethics requirements for members who outsource" (2004 standards, July 1, 2005 effective date): https://www.accountingtoday.com/news/aicpa-adopts-new-ethics-requirements-for-members-who-outsource
CORAA prepares ready-to-review audit files for US CPA firms from client accounting records; the firm keeps the client relationship, the review and the signature. See /us.
Part of CORAA University · Quality management and practice: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error