Under the new “Hosting Services” ethics interpretation in the AICPA’s Code of Professional Conduct (ET §1.295.143), effective July 1, 2019, CPA independence is impaired by taking responsibility for hosting a client’s data or records. As such, if the only way that the client can access its complete records is through the CPA firm, the CPA firm’s independence is deemed impaired.

Many CPA firms are therefore finding themselves potentially providing hosting services without intending to do so. For example, CPA firms need to tread carefully to ensure that they fully understand the nuances that give rise to stepping into the role of providing “hosting services” when rendering tax services

to attest clients.

Although not meant to be all-inclusive, the following safeguards are some best practices to consider:

• CPA firms need to ensure that all documentation that makes up a client’s books and records are made available to attest clients for the tax services provided to them. Firms would impair their independence if their attest clients were to rely on the firm to retain all, or even just a portion of, their tax records beyond a reasonable period of time after the engagement concludes.
• To avoid client “expectation gaps,” CAMICO strongly encourages firms to update their tax engagement letters with attest clients to address the limitations on the firm related to providing hosting services, and to clarify the clients’ responsibilities to retain and maintain their own records.
• CPA firms should also review and update, if necessary, their client portal agreements to avoid the perception of providing “hosting services.” The portal agreement should specify that the firm will terminate the client’s access to data or records in the portal within a “period of time established by the firm” after the conclusion of the engagement.
• Record retention and destruction policies should also be updated to clarify the role of the firm as it relates to providing hosting services to clients.