The AICPA Code of Professional Conduct provides guidance to CPAs and CPA firms related to the ability to perform non-attest services to attest (audit, review, and compilation) clients.
Examples of non-attest services that practitioners, including us, provide are:
- Financial statement preparation
- Maintaining book and tax depreciation schedules
- Preparation of the company’s tax return
- Cash-to-accrual conversions
As part of us performing an attest engagement, we can perform these non-attest services so long as a member of your senior management team, with suitable skills, knowledge and expertise, oversees these services and accepts responsibility.
However, if a CPA takes responsibility for maintaining control over your data or records for non-attest services, referred to as hosting services, it could technically impair independence of the CPA, which would preclude the CPA from performing the attest engagement.
The following are instances where hosting services would impair a CPA’s independence:
- The CPA is the sole host of a client’s financial or nonfinancial information system.
- The CPA is a custodian for the client’s data, meaning the information is only accessible through the CPA.
- The CPA provides business continuity or disaster recovery services to the client.
On the contrary, CPA firms who provide attest services to clients, like our firm, do not jeopardize auditor’s independence when copies of attest client data or records are held for services provided. Some examples of client data and records held include the following:
- A bank reconciliation that supports our audit procedures for your company’s cash account.
- Retaining, for our records, a copy of ending work product prepared as part of an attest service to you (for example, a tax return).
- If general ledger software is used to facilitate the delivery of bookkeeping services, both you and us maintain separate instances of the software on respective servers and the financial information is communicated between you and us.
- You, as the client, hire a third-party to maintain your general ledger over a cloud-based system and grant us, as your CPA, access to the software to perform bookkeeping services.
If, by chance, your company uses a cloud-based system to share documents with your CPA during an attest engagement, we highly recommend that you terminate access to the online portal upon completion of the engagement. Also, if your CPA provides non-attest services to you as an additional service to the attest engagement, it is important that you take full responsibility of these services as your own and keep copies of the work product provided as part of your own set of books and records. As your CPA, we are available to provide assistance on these services as needed, but it is imperative to understand that ownership of these services are solely your responsibility as the client and you can no longer rely on your CPA to house your books and records.
At Henry+Horne, we have been at the forefront of the changes related to hosting services and addressed these well before their effective date. While it may be a minor inconvenience for you, taking ownership of our non-attest services work products is an important part of your internal control system and ensures that there are no independence issues related to perceived hosting services.
As always, feel free to contact us with any questions.