Outsourced Audit Support for CPA Firms: Using Offshore Accounting and Audit Staffing Responsibly

Staffing busy season with experienced audit staff is a recurring problem for small and mid-size CPA firms. Some use contract auditors, some use staffing firms, and some use offshore teams to prepare workpapers, roll forward schedules or perform routine testing. None of that is prohibited. But each arrangement brings obligations under the AICPA Code of Professional Conduct, the quality management standards and the auditing standards, and the firm signing the report remains responsible for all of the work.

This guide covers the rules that apply when a firm uses outside help on audit and accounting engagements, and how to set up the arrangement so it holds up in peer review. It is written for firm partners and quality management leaders. It paraphrases the professional standards.

What counts as a third-party service provider?

The AICPA Code uses the term third-party service provider for an entity or individual that the member does not control and that the member uses to assist in providing professional services to clients. Examples include offshore staffing companies, outsourced workpaper preparation services, independent contractors, cloud-based processing services that handle client data, and other CPA firms engaged to help on an engagement.

The distinction matters because the Code treats people the firm controls, such as employees, differently from providers it does not control, and because the firm's quality management system must address both.

AICPA Code: informing the client and supervising the work (ET 1.150.040 and ET 1.300.040)

The Code addresses the use of a third-party service provider in more than one place. In summary:

• Under the integrity and objectivity rule (ET 1.150.040), before disclosing confidential client information to a third-party service provider, the member informs the client, preferably in writing, that a provider may be used.
• Under the general standards rule (ET 1.300.040), the member should be satisfied that the provider has the professional qualifications, technical skills and other resources needed for the work, and should adequately plan and supervise it. The member remains responsible for the provider's work and for ensuring it complies with professional standards.

Some firms put the disclosure in the engagement letter so it is agreed at the start of each engagement. See the audit engagement letter template and audit engagement letters. The interpretation does not require client consent for the use of the provider itself, but the confidentiality rule below can.

AICPA Code: confidentiality (ET 1.700.040)

The confidential client information rule generally prohibits disclosing confidential client information without the client's consent. The interpretation on disclosing information to a third-party service provider (ET 1.700.040) allows disclosure to a provider without specific client consent if the member has a contractual agreement with the provider to maintain the confidentiality of the information and is reasonably assured that the provider has appropriate procedures in place to prevent unauthorized release. Without such an agreement, the member needs the client's specific consent before disclosing.

In practice, firms address this with:

• a written agreement with each provider that covers confidentiality, data handling, use restrictions, subcontracting, return or destruction of data, and breach notification
• due diligence on the provider's security practices before engagement, refreshed periodically
• a register of which providers have access to which clients' data

Tax information

For tax work, there are separate federal rules. Internal Revenue Code Section 7216 and its regulations restrict the use and disclosure of tax return information by return preparers, and disclosure to a preparer located outside the United States generally requires specific taxpayer consent in a prescribed form. These requirements are separate from the AICPA confidentiality interpretation and apply in addition to it.

SQMS 1: service providers in the system of quality management

SQMS No. 1 requires a firm to design, implement and operate a system of quality management that addresses, among other components, resources. Resources include human resources from outside the firm and resources obtained from service providers. In summary, the standard expects the firm to:

• determine whether resources from service providers are appropriate for use in the system or on engagements, considering their competence and capabilities
• establish quality objectives and responses that address the use of those resources
• monitor and remediate, including identifying deficiencies that involve service providers

A firm that relies on an outside provider for audit work should document in its quality management risk assessment the quality risks that arise from that reliance, such as inconsistent methodology, insufficient competence, confidentiality breaches or independence gaps, and its responses to them. See SQMS 1 for small CPA firms.

Independence

Individuals who participate on an attest engagement team are generally covered members under the AICPA independence rules. The definition of the attest engagement team includes contractors and others retained by the firm who participate in the engagement, with specific exclusions, such as certain specialists. In practice, that means outside staff who perform audit procedures should be treated like firm staff for independence purposes:

• obtain an independence confirmation from each individual before work begins
• check for financial interests in, and employment or family relationships with, the client
• include them in the firm's annual independence confirmation process

The firm should also consider whether the provider itself, as an entity, has relationships with the client that create threats, such as providing bookkeeping or other services to the same client. The conceptual framework for independence applies to situations the specific rules do not address.

Supervision and review under GAAS

The auditing standards do not distinguish between work performed by firm employees and by others assisting the engagement team. AU-C 220, as revised by SAS No. 146, places responsibility on the engagement partner for managing and achieving quality on the engagement, including direction, supervision and review of the work of all engagement team members. AU-C 230 requires the documentation to show who performed and who reviewed the work, and when.

That has practical consequences:

• Planning stays with the firm. Risk assessment, materiality, the audit strategy and the response to significant risks are judgments for the engagement team, not a provider. See AU-C 315 and AU-C 320.
• Clear instructions. Each assignment should specify the objective, the procedure, the population, the sample basis and the documentation standard. Providers should use the firm's methodology and templates.
• Real review. A reviewer must be able to evaluate the work as if a staff member had prepared it. Review notes, responses and clearance should be in the file.
• Judgment calls come back. Exceptions, misstatements, unusual items and anything that might change the risk assessment should be escalated to the firm, not resolved by the provider.

The same approach applies to AI-assisted work; see AI in auditing for small CPA firms and the review checklist for AI-assisted work.

Data security

Using outside help increases the number of people and systems that touch client data. Reasonable practices include:

• access only to the clients and folders needed for the assignment, removed when the assignment ends
• work performed inside firm-controlled systems rather than on provider devices or email where possible
• multi-factor authentication and logging of access
• no local copies of client files, and clear rules on personal devices
• written incident response steps that cover the provider

Firms also have obligations under applicable federal and state law. For example, the Federal Trade Commission's Safeguards Rule applies to tax preparers, and state data breach laws apply to many firms. Which of these apply depends on the services the firm provides and the states where its clients are located.

Peer review considerations

Peer review evaluates the firm's system of quality management and selected engagements. Evidence that the system addresses service providers, that independence was confirmed for everyone who worked on the engagement, that the work followed the firm's methodology and that review was substantive supports the firm's position on an engagement where a provider prepared part of the file. See AICPA peer review for small firms.

Setting up an arrangement: a checklist

1. Define the scope: which engagements, which procedures, and which judgments stay in-house.
2. Perform due diligence on the provider's competence, methodology, staff training and security.
3. Sign a written agreement covering confidentiality, data handling, subcontracting, quality expectations and termination.
4. Inform clients, preferably in writing, and obtain specific consent where required.
5. Obtain independence confirmations from each individual assigned.
6. Train provider staff on the firm's methodology, templates and documentation standard.
7. Assign a firm reviewer for each engagement and track review notes.
8. Include the arrangement in the firm's SQMS 1 risk assessment and monitoring.
9. Evaluate the arrangement each year and remediate deficiencies.

Frequently asked questions

Can a CPA firm use offshore staff on audit engagements?

Yes. The AICPA Code does not prohibit it, but the firm must inform clients before sharing confidential information, protect confidentiality through a contract or client consent, confirm independence of the individuals involved, and supervise and review the work.

Do clients have to consent to the use of a third-party service provider?

The Code calls for informing the client, preferably in writing, before confidential information is disclosed. Specific client consent is needed if the firm does not have a contractual confidentiality agreement with the provider. Separate consent rules apply to tax return information under Section 7216.

Are outsourced staff subject to independence rules?

Individuals who participate on an attest engagement team, including contractors retained by the firm, are generally covered members under the AICPA independence rules, so their independence should be confirmed before they work on the engagement.

Who is responsible for work performed by an outsourced provider?

The firm and the engagement partner. The Code (ET 1.300.040) states that the member remains responsible for the provider's work, and AU-C 220 places responsibility for direction, supervision and review on the engagement partner.

How does SQMS 1 address service providers?

SQMS 1 treats resources from service providers as part of the firm's resources. The firm determines whether they are appropriate for use, addresses related quality risks in its system and monitors them.

CORAA prepares ready-to-review audit files for US CPA firms; see /us.

Sources

• AICPA Code of Professional Conduct: ET 1.150.040 (third-party service providers, integrity and objectivity), ET 1.300.040 (general standards), ET 1.700.040 (disclosing information to a third-party service provider)
• AICPA Code of Professional Conduct: ET 0.400 (definitions of attest engagement team and covered member) and the independence conceptual framework (ET 1.210.010)
• AICPA, SQMS No. 1, A Firm's System of Quality Management (resources, including service providers)
• AICPA, SAS No. 146 (AU-C Section 220, Quality Management for an Engagement Conducted in Accordance With GAAS); AU-C Section 230
• Internal Revenue Code section 7216 and Treas. Reg. 301.7216-3 (disclosure of tax return information, including to preparers outside the United States): https://www.law.cornell.edu/uscode/text/26/7216
• FTC Safeguards Rule, 16 CFR Part 314: https://www.ecfr.gov/current/title-16/part-314

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error