The New 'Hosting Services' Interpretation

Under the new "Hosting Services" ethics interpretation in the AICPA's Code of Professional Conduct (ET §1.295.143), effective July 1, 2019, CPA independence is impaired by taking responsibility for hosting a client's data or records. As such, if the only way that the client can access its complete records is through the CPA firm, the CPA firm's independence is deemed impaired.

Many CPA firms are therefore finding themselves potentially providing hosting services without intending to do so. For example, CPA firms need to tread carefully to ensure that they fully understand the nuances that give rise to stepping into the role of providing "hosting services" when rendering tax services to attest clients.

Although not meant to be all-inclusive, the following safeguards are some best practices to consider:
  • CPA firms need to ensure that all documentation that makes up a client's books and records are made available to attest clients for the tax services provided to them. Firms would impair their independence if their attest clients were to rely on the firm to retain all, or even just a portion of, their tax records beyond a reasonable period of time after the engagement concludes.
  • To avoid client "expectation gaps," CAMICO strongly encourages firms to update their tax engagement letters with attest clients to address the limitations on the firm related to providing hosting services, and to clarify the clients’ responsibilities to retain and maintain their own records.
  • CPA firms should also review and update, if necessary, their client portal agreements to avoid the perception of providing “hosting services." The portal agreement should specify that the firm will terminate the client’s access to data or records in the portal within a "period of time established by the firm" after the conclusion of the engagement.
  • Record retention and destruction policies should also be updated to clarify the role of the firm as it relates to providing hosting services to clients.


Share this post

Leave a comment

Filtered HTML

  • Web page addresses and e-mail addresses turn into links automatically.
  • Allowed HTML tags: <a> <em> <strong> <cite> <blockquote> <code> <ul> <ol> <li> <dl> <dt> <dd>
  • Lines and paragraphs break automatically.

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.

Latest Articles

  • 05 Dec

    Six Tips for Safe Holiday Celebrations

    Employer-hosted events to celebrate the holidays and thank employees for jobs well done often come with liability and other risks when the events include alcohol.

    "Impaired judgment and lowered inhibitions as a result of alcohol consumption give rise to a variety of dangers,... read more

  • 13 Nov

    How to respond to subpoenas

    CPA firms are often uncertain about whether or how to respond to a subpoena, as they also need to comply with a number of rules and regulations that are intended to protect client confidentiality. The following Q&A focuses on understanding the nature of subpoenas and how CPA firms can ... read more

  • 13 Nov

    The New 'Hosting Services' Interpretation

    Under the new "Hosting Services" ethics interpretation in the AICPA's Code of Professional Conduct (ET §1.295.143), effective July 1, 2019, CPA independence is impaired by taking responsibility for hosting a client's data or records. As such, if the only way that the client can access its... read more