AICPA releases guidelines on outsourcing engagements.

• Position: American Institute of Certified Public Accountants - Code of Professional Conduct

In response to member inquiries regarding outsourcing engagements to third parties, AICPA General Counsel Richard I. Miller and Senior Vice President--Member and Public Interests Alan Anderson have developed a paper to help guide members through the issues. The paper, which has been posted to the AICPA's Web site, discusses the three subjects implicated by outsourcing: AICPA ethical standards, the Gramm-Leach-Bliley Act pertaining to privacy, and certain Internal Revenue Code provisions. Some of the main points are briefly outlined here.

On the first item, while Ethics Ruling 1, under the Code of Professional Conduct Rule 301 (Computer Processing of Client Returns), specifically deals with the use of outside services to process tax returns, the rule would apply to any use of third-party providers. The ruling advises that members "must take all necessary precautions to be sure that the use of outside services does not result in the release of confidential information." The Code also requires that a member and his/her firm remain responsible for ensuring the accuracy and completeness of the services performed by the third-party provider. Thus, professional services are to be performed with professional competence and due professional care, and the use of a third-party provider does not in any way alter a member's responsibility in this regard.

In addition to a member's responsibility under the Code to maintain confidentiality, the Gramm-Leach-Bliley Act must be considered. The Act includes protections that allow consumers to determine when personal financial information could be shared among financial service institutions. The Federal Trade Commission promulgated a set of rules to implement the Act's privacy requirements governing the use of "consumer financial information" (available at www.ftc.gov/privacy/privacyinitiatives/ financial_rule_lr.html). As currently interpreted, the GLBA requires practitioners who provide, among other things, tax planning and tax preparation services to individual clients, to give notice of the practitioner's policy regarding disclosure of private information at the start of an engagement, and annually thereafter. While these notices generally are required to disclose categories of nonaffiliated third parties to whom there is disclosure of non-public information, the GLBA does not require that a practitioner...