What it is
When a firm uses a third-party service provider, whether a staffing firm, an independent contractor or an offshore team, the AICPA Code’s confidentiality rule applies to what the provider sees. The Code addresses notice to the client and a confidentiality agreement or consent, and independence rules can reach provider staff who work on attest engagements.
For tax return information, IRC section 7216 and the Treasury regulations require taxpayer consent before disclosure to a preparer outside the United States, with special limits on social security numbers. The checklist covers these points and adds data security, contract and supervision items. It is not legal advice: confirm with counsel and read the current Code, regulations and state rules.
When to use it
- Before engaging an outsourced or offshore provider.
- When reviewing an existing arrangement at renewal.
- When writing client notices and consent language with counsel.
What’s inside
- Scope and quality management responsibility
- AICPA confidentiality: notice, agreement or consent, controls
- Independence for attest engagement staff
- Section 7216 consent triggers and SSN limits
- Security, data location, breach terms, contract and exit
Standard cited
This template follows AICPA Code ET 1.700 / IRC 7216. It is written in our own words, except for phrases the standard requires the document to contain, with [bracketed placeholders] for client details, amounts in USD and dates as MM/DD/YYYY. Check it against the current standard and your firm’s methodology before use.
Questions
Do we have to tell clients we use a service provider?
The third-party service provider interpretation of the AICPA confidentiality rule (ET 1.700.040) calls for informing the client, preferably in writing and before sharing confidential information, that a provider will be used, and for either a confidentiality agreement with the provider or the client’s specific consent. State rules may add requirements.
When is consent needed for tax returns?
Treasury regulation 301.7216-3 requires the taxpayer’s consent before tax return information is disclosed to a preparer located outside the United States. The consent must be signed and dated and must name the preparer, the recipient, the purpose and the information. For individual returns, consent cannot cover disclosure of the SSN abroad except through an adequate data protection safeguard described in IRS guidance. A consent with no stated duration lasts one year, and a U.S.-based provider doing non-substantive auxiliary work is covered by a separate exception (301.7216-2(d)).
Does an offshore provider affect independence?
If provider staff perform procedures on an attest engagement, evaluate whether the independence rules for the engagement team apply to them. Obtain written confirmations and keep a list of assigned staff.
Related templates
- Engagement Independence Confirmation (AICPA Code ET 1.200)
- Engagement Kickoff Checklist
- Vendor Management and Service Organization Checklist
Last updated 11/05/2026. All free templates.