Hosting services impair a CPA’s independence, so says the AICPA. And most firms are providing hosting services (though they may not know it). This article explains why your possession of client records, whether electronic or hard-copy, can affect your independence.
Hosting Services Impair a CPA’s Independence
Starting September 1, 2018, your possession of client documents (e.g., tax records) or information (e.g., the housing of QuickBooks files on our server) can, in some instances, create an independence impairment. (If you temporarily possess original documents (e.g., tax records) but return them to the client in a short period, then the possession of the original documents does not impair your independence.)
Why would possessing documents or information potentially impair independence? Because you accepted the responsibility for designing, implementing or maintaining internal controls for the records in your possession. And this is considered a management function.
In effect, the AICPA is saying there is an implicit understanding that you (the CPA) will safeguard the client’s records. And to safeguard the information, you agree to create controls to ensure the safety of the information in your possession.
To understand the actions that would impair your independence, see Catherine Allen’s article in the Journal of Accountancy. Specifically, look at her examples of where independence is impaired and where it is not.
Hosting Services that Impair Your Independence
Here are a few other examples of hosting services that impair your independence:
Scenario 1: Charles Hall, CPA, maintains MedStop, Inc.’s accounting records on Accounting CS software which are stored on his firm’s server. Charles keys monthly entries into Accounting CS based on the information provided by MedStop. MedStop does not have access to the general ledger via Accounting CS. Charles provides monthly financial statements, copies of the general ledger, and bank reconciliations to his client.
Scenario 2: Shirley Jones, CPA, agrees to maintain the original hard copies of her client’s legal contracts at her CPA firm’s office.
Scenario 3: Joan Banks, a partner at Jones, Banks, CPAs, provides disaster recovery services to a bookkeeping client.
1.295.143.01 of the Code says:
For the purpose of this interpretation, hosting services are nonattest services that involve a member accepting responsibility for the following:
a. Acting as the sole host of a financial or non-financial information system of an attest client
b. Taking custody of or storing an attest client’s data or records whereby, that data or records are available only to the attest client from the member, such that the attest client’s data or records are otherwise incomplete
c. Providing electronic security or back-up services for an attest client’s data or records
When a member provides hosting services, the member is maintaining the attest client’s internal control over its data or records. Accordingly, the management participation threat to the member’s compliance with the “Independence Rule” [1.200.001] would not be at an acceptable level, and could not be reduced to an acceptable level by the application of safeguards, and independence would be impaired.
Examples of activities that are considered hosting services, and as such will impair independence if performed for an attest client, include accepting responsibility for the following:
a. Housing the attest client’s website or other non-financial information system
b. Keeping the attest client’s data or records on the attest client’s behalf, for example, the attest client’s general ledger information, supporting schedules (such as, depreciation or amortization schedules), lease agreements or other legal documents are stored on the member’s firm’s servers or servers licensed by the member’s firm or the member is responsible for storing hard copy versions of the data or records
c. Being the attest client’s business continuity or disaster recovery provider
Are You Independent if You Provide a Copy of the G/L to Your Client?
When I originally wrote this hosting services article (it has now been amended), I said that a CPA would be independent if they performed bookkeeping on their software and server (as the sole host) but provided a copy of the general ledger to the client. (My thinking was that the client would have access to their general ledger, so the CPA would be independent.) Afterwards, I received an email from Cathy Allen, a member of the AICPA’s Professional Ethics Executive Committee advising that providing a physical copy of the general ledger to the client would not remove the independence impairment. Excerpts from the emails follow.
My Email to Cathy Concerning Independence when the G/L is Provided to a Client
Are you saying that a firm’s independence is impaired if a firm does bookkeeping on its server, even if a copy of the general ledger is given to the client? If yes, then almost every firm in the country will lack independence for their small clients.
In your article, you provide an example of the CPA providing a copy of the depreciation schedule to the client. In that example the firm is independent. I am confused about why a firm would impair its independence by performing bookkeeping if it provides a copy of the general ledger to its client—and would not impair its independence if it maintained depreciation records on its software but provides a copy of the depreciation schedule to the client.
Cathy’s Response Concerning Independence when the G/L is Provided to a Client
I can see how you might think maintaining the GL is okay as long as you give copies of it to the client. In fact, a CPA attended two PEEC meetings trying to make the case that that would be sufficient to maintain Independence but he was unsuccessful.
The distinction the PEEC made was that you could maintain discrete portions of the general ledger like depreciation or amortization schedules and provide the details to the clients so their books and records are complete, but you would not be able to do the same with G/L software if the software is solely maintained by you.
(I appreciate Cathy helping me understand this part of the interpretation.)
Independence is Impaired if Your Firm is the Sole Host of the General Ledger
So, if a CPA firm is the sole host of an attest’s client general ledger, independence is impaired.
See 1.295.143.01 a. of the Code; it says:
Hosting services are nonattest services that involve a member accepting responsibility for the following:
a. Acting as the sole host of a financial or non-financial information system of an attest client
(There are situations where maintaining a client’s general ledger does not impair independence; see the section below titled Maintaining Independence When Using General Ledger Software.)
Situations that Don’t Create Hosting Services
Here are situations that are not considered hosting services (and don’t impair your independence):
Scenario 4: XYZ uses the cloud-based version of QuickBooks to maintain its general ledger and other accounting records. XYZ gives Tee Kite, CPA, permission to access XYZ’s online books to perform bookkeeping services.
Scenario 5: Dawgs, Inc. provides a copy of their QuickBooks files to Bill Allen, CPA. Bill uses the QuickBooks file to review their bookkeeping records for the year. Bill provides journal entries to Dawgs, Inc. to post to their QuickBooks file. Dawgs, Inc. has the required skill, knowledge, and experience to review and accept responsibility for the journal entries and has agreed to do so.
Scenario 6: Pat Muse, CPA, and Mirage Corp. exchange data and records using Sharefile. All their exchanges relate to the performance of an audit. To avoid hosting services, Pat terminates Mirage Corp.’s access to the information in Sharefile once the engagement is complete.
Scenario 7: Sheila Thatcher receives client tax information (e.g., W-2s, 1099s) for preparation of the tax return but returns the original information once the engagement is complete. For a multi-year engagement, the information has to be returned at least annually.
Retaining copies of client information does not impair a CPA’s independence.
Maintaining Independence When Using General Ledger Software
About using general ledger software, 1.295.143.04 of the Code says:
Examples of activities that are not considered to be hosting services, and as such will not impair independence…include these:
Using general ledger software to facilitate the delivery of bookkeeping services when either of the following occurs:
i. The member and the attest client maintain separate instances of the software on their respective servers, and the member provides updated financial information electronically to the attest client.
ii. The attest client enters into an agreement with a third-party service provider to maintain its software in a cloud-based solution and grants the member access to the software so that the member can perform the bookkeeping service for the attest client.
Here are the critical points of this new interpretation:
- If you retain original documents for an extended period of time, your independence may be impaired.
- Retaining copies of original documents will not impair your independence.
- If you act as the “sole host” of a client’s financial information (e.g., general ledger), you are not independent.
- Client access to electronic portals (e.g., Sharefile) should be terminated once an attest engagement is complete. If access is not terminated, independence is impaired.
- If your client contracts with your firm for backup recovery services, you are not independent.
- If your independence is impaired, then disclose the lack of independence in your compilation report.
- If your independence is impaired, then you cannot perform review or audit services (for that client).
The effective date for the Hosting Services standard is September 1, 2018.
Graphic Summary of Hosting Services
The following graphic is not comprehensive but provides an overview of the Hosting Services interpretation.
Learn from the CPA Scribo newsletter!
Get my free weekly accounting and auditing digest with the latest content.