For CPAs who provide certain ancillary services, such as hosting, the AICPA’s new ethics interpretation could have major implications. Under the new interpretation, CPAs risk compromising their independence by hosting clients’ websites or internal data.
Reasons for the New Interpretation
CPAs are supposed to be independent third parties. Their job is to attest to the financial positions of their clients. The client prepares financial statements; the CPA reviews them. After review, the CPA issues an opinion on whether the statements accurately reflect the client’s financial situation. When a CPA also performs duties for clients typically done by management, independence is impaired. The CPA ends up auditing its own work.
In addition to providing audits, many CPAs offer ancillary services. With the proliferation of cloud technology, hosting and storage have become popular subniches for CPAs. The AICPA feels this creates a conflict of interest, as it gives the CPA too much control over client operations.
Who It Includes
The new interpretation applies to CPAs who provide both attest and nonattest services to clients. Attest services refer to third-party audits, or CPAs "attesting" to the accuracy of their clients’ financials. When a CPA helps clients prepare tax returns or devise internal controls, or otherwise works alongside management, it’s performing nonattest services.
If a CPA wishes to offer nonattest services to an attest client, it must follow strict guidelines. Specifically, the CPA must be supervised by a member of management with the skill and knowledge to review and take ownership of the work.
Situations It Covers
The guidelines cover any scenario where a CPA accepts primary responsibility for handling, storing, or safeguarding a client’s data and records. This would seem to include web hosting, considering that a CPA effectively takes ownership of a client’s data when it hosts the client’s website.
But not all situations where a CPA has access to a client’s data present a problem. After all, CPAs have to be able to access client information to perform attest services. And it would be a massive pain for a CPA to have to run to management every time they need a simple document.
Consider two scenarios. In the first, your firm decides to offer full web hosting as an ancillary service. Several of your attest clients sign up. Your firm then has all of these clients’ information and data on your server at all times. In the second, your firm is auditing a client. During the audit, the client transfers certain records, such as payroll and inventory, to your firm’s servers. You then review these records to get the information you need, after which you return them to the client.
In the second scenario, independence is not impaired, as your firm retains control of client records only long enough to do its job. But in the first scenario, your constant control of client information creates a potential conflict of interest.
With modern technology, you can grow your CPA business through a variety of ancillary services. But new innovations also make it harder to maintain the appearance of independence. Walking this line presents a significant challenge to CPAs going forward.