Legal and Ethical Considerations regarding Outsourcing: Members Must Comply with the Code of Professional Conduct and Other Pronouncements

The Institute has received a number of inquiries regarding the responsibilities of members who use third-party service providers in client engagements. Commonly known as "outsourcing," this practice has been employed by members for decades to provide more effective services to their clients. Examples of services that may be outsourced include * Tax preparation and processing. * Bookkeeping. * Certain audit procedures performed by contract staff. * Outside specialist services in connection with an audit. * Human resources services. * Investment advisory services. * Workpaper storage of destruction services. This paper will discuss member responsibilities in three areas: AICPA ethical standards, the Gramm-Leach-Bliley Act (GLBA) and certain Internal Revenue Code provisions. AICPA ETHICAL STANDARDS The AICPA's professional ethics division addressed the use of third-party providers as early as 1973 in Ethics Ruling no. 1, under the AICPA Code of Professional Conduct, Rule 301, Computer Processing of Client Returns (ET section 391.001-.002). While that ethics ruling specifically deals with using outside services to process tax returns, it also would apply to any use of third-party providers. The ruling advises that members "must take all necessary precautions to be sure the use of outside services does not result in the release of confidential information. " (Because of continuing questions concerning the use of third-party providers, the professional ethics executive committee [PEEC] in its meeting on January 22, 2004, appointed a task force to study whether this ruling needs to be revised. Should any further guidance be issued by the PEEC, it will be made available to members as soon as practicable.) The code also states that a member remains responsible for ensuring the accuracy and completeness of the services provided by the third-party provider. Specifically, it requires all professional services to be performed with professional competence and due professional care (see Rule 201, General Standards JET section 201.01]). Accordingly, using third-party providers to assist in performing services for clients does not in any way excuse practitioners from these or other responsibilities under the code. In view of these requirements, members should satisfy themselves regarding the competence, practices and procedures of any third party provider, regardless of the type of services provided of the location at which they are performed. At a minimum, it seems advisable for members to discuss with the third party the specific controls in place to safeguard the client's information and to satisfy themselves that such controls are adequate. For example, where client information is transmitted via the Internet, the member may want to inquire as to specific security measures in place, such as * Encryption techniques. * The use of private leased lines or virtual private networking connections with authorized users. * The availability and processing integrity of the information. * Whether the third-party provider has had an engagement performed (internal of external) on the security of their systems. * Whether the third-party provider has obtained an independent security attestation regarding their systems. Once satisfied there are sufficient procedures in place to ensure the security of information transmitted electronically to a third-party provider, members also should satisfy themselves that controls are in place to ensure the information remains confidential. There are many ways by which third-party providers might satisfy a practitioner in this regard. For example, they may use nondisclosure agreements with their employees; implement certain computer protections that prohibit downloading, printing, scanning or copying a client's financial information; and incorporate firewall security to prevent outsiders from hacking into the system. …