'Hosting Services' tips.

Author:Tysiac, Kenneth

CPAs with attest clients should know about the new "Hosting Services" interpretation in the AICPA Code of Professional Conduct, which accounts for new technologies. Here's how AICPA members can comply:

Understand the interpretation. The principle underpinning the "Hosting Services" interpretation (ET [section]1.295.143) of the "Independence Rule" (ET [section]1.200.001) is that AICPA members should not perform activities for attest clients that are management's responsibility. Taking responsibility for hosting an attest client's data or records impairs independence. Examples of taking responsibility for hosting a client's data include: (1) becoming the sole host of a client's financial or nonfinancial information system; (2) serving as custodian for the client's data to the extent that the client's data is incomplete and accessible only through the member; or (3) providing business continuity or disaster recovery services for a client. If the client could not change service providers without needing to contact the member, the member is likely providing hosting services.

Terminate attest clients' access to records and data in a portal. According to the interpretation, this should be done within a reasonable time. CPAs should use professional judgment to determine a period of time that is reasonable. More information is available on AICPA ethics FAQs available at tinyurl. com/y4ar9hmw. The "Hosting Services" interpretation is not meant to discourage cloud- or technology-based means of exchanging files and documents with clients. Such exchanges do not violate the interpretation, but when a member stores a client's documentation rather than sharing it, the member is likely providing hosting services, and independence may be impaired. To prevent a portal from becoming a place to store information, the interpretation requires members to "cleanse" the data or records from the...

To continue reading