request for records – a guide for cpa firms

A CNA RISK CONTROL GUIDE FOR CPA FIRMS

Request for Records – A Guide for CPA Firms

ACCOUNTANTS

2 CNA RISK CONTROL RequestforRecords–AGuideforCPAFirms

Table of Contents

Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3

1 . The Basics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

1.1.KeyDefinitions–RecordsandWorkingPapers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .5

1.2.ExamplesofRecordsandWorkingPapers.........................................6

1.3.KeyDefinitions–RequestingParties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .6

2 . Professional Standards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

2.1.RecordRequests–ET Section 501 ofthe AICPA Professional Code of Conduct . . . . . . . . .7

2.2.Confidentiality–ET Section 301oftheAICPA Professional Code of Conduct . . . . . . . . . . .8

2.3.Ownership. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .8

3 . Law, Rules, and Regulations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

3.1.FederalandStateLaws . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .9

3.1.1Privacy,ConfidentialityandSecurity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .9

3.1.2.InternalRevenueCode. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .9

3.2.StateBoardofAccountancyRulesandRegulations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .10

4 . Responding to Requests from Current Clients, Former Clients, and Third Parties . . . . . . 11

4.1.RequestsfromCurrentandFormerClients. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11

4.2.RequestsfromThirdParties. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .13

4.3.RequestsfromRegulatoryBodies,AdministrativeAgenciesandGovernmentalEntities. . .14

4.3.1.MiscellaneousRegulatoryBodiesandAdministrativeAgencies. . . . . . . . . . . . . . . . .14

4.3.2.RequestsfromtheIRSandStateRevenueDepartments . . . . . . . . . . . . . . . . . . . . . .14

5 . Other Request Considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

5.1.MaritalDisputes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .15

5.2.BusinessOwnerDisputes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .15

5.3.RequestsfromClientswithOutstandingFees . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .16

6 . Special Topics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

6.1.AuditEngagements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .17

6.1.1.RequesttoFurnishPreviouslyIssuedAuditReports. . . . . . . . . . . . . . . . . . . . . . . . . . .17

6.1.2.SuccessorAuditorRequests. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .17

6.2.OtherRequestsforAccesstoAuditandOtherWorkingPapers . . . . . . . . . . . . . . . . . . . . .18

6.3.Litigation–RecordRetention. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .18

6.3.1.SubpoenaorAdministrativeSummons. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .18

6.3.2.ContactingLegalCounselandProfessionalLiabilityInsuranceCarrier. . . . . . . . . . .19

6.3.3.TimeLimitations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .19

Appendix A – Sample Transmittal Letter Accompanying Copies of Working Papers Furnished to a Client . . . . . . . . . . . . . . . . . . . . . 20

Additional Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

CONTRIBUTING AUTHOR:

RichardG.Witkowski,JD,Nicola,Gudbranson&Cooper,LLC


Executive SummaryCPAfirmseithermaintainorhaveaccesstonumeroustypesofclientrecordsandrelatedworking

papers,whichmayconstituteconfidentialbusinessandtaxrecordsand/ortradesecrets.Requests

foraccesstocopiesofsuchrecordscanarisefrommultiplesources,includingsuccessorCPAs,cur-

rentandformerclients,lawyers,civilandcriminalinvestigators,regulators,lenders,adverseparties

inlitigation,dissidentshareholders,andothers.

Thedutytorespondtotheserequestsisgovernedbyprofessionalstandards,stateboardofaccount-

ancyregulations,stateandfederallaw,andregulatorybodies.Beforerespondingtotheserequests,

CPAfirmsshouldconsiderallapplicableprofessionalstandards,laws,rules,andregulations.

Respondingtorequestscanbechallenging,regardlessofwhethertheclientconsentstotheproduc-

tion.TheCPAshouldconsiderthescopeofanyauthorizationprovidedbytheclient,thetypesof

recordsrequested,thetimeframessoughttoproducetherecords,theformatofthedocumentsbeing

requested,andtheresourcesnecessarytoidentify,retrieve,reproduceandsubmitcopiesofrecords.

Reviewthetermsofthefirm’sprofessionalliabilityinsurancepolicy.Somepoliciesproviderelated

coverageapplicabletothelegalcostsassociatedwithrespondingtosubpoenasrequestingclient

records.Asubpoenashouldpromptlybereportedtotheclaimdepartmentofthefirm’sprofessional

liabilityinsurancecarrier,regardlessofwhetherornotitwasissuedinconnectionwithalawsuit.If

yourprofessionalliabilitypolicycoversresponsestosubpoenas,youwillbeappointedanattorney

whowillassistyouwithyourresponse.

Uponbecomingawareofactualoranticipatedlitigationrelatedtoadocumentrequest,consult

promptlywiththefirm’sprofessionalliabilityinsurancecarrierpriortotakingfurtheraction.Inmost

situations,documentsshouldnotbeproducedwithoutavalidsubpoena.

Thisarticleshouldbeusedasaguidelinebypractitionersindetermininganappropriateresponse

toarecordrequest.Innowayshouldthisarticlebemisconstruedasprovidinglegaladvicetoyou

oryourfirminmaintainingrecordsandrespondingtosubpoenas.

ThisguidelinealsohighlightsRisk Management Tips.Thesetipsshouldbereadandappliedwithin

thecontextoftheguide,applyingprofessionaljudgmentinconsultationwithcompetentlegalcounsel.


Risk Management Tips:

-Whenarequestforrecordsismade,theCPAshoulddeterminewhethertherequestis

fromaclientorathirdparty.

-Forrequestsmadefromclients,whethercurrentorformer,CPAsshouldrequiretheclient

toprovidetherequestinwritingfordocumentationpurposes.

-Forrequestsfromthirdparties,CPAsshouldnotifytheclient,inwriting,oftherequest,

providetheclientwithacopyoftherequest,anddeterminewhethertheclienthasan

objectiontotheproduction.Generally,theCPAmusthonortheinstructionsoftheclient

inrespondingtothedocumentrequest.Lawsandregulationsmayrequiretheproduction

ofdocumentstoathirdpartydespiteclientobjections.

-Allsubpoenasorsummonsshouldbeimmediatelyreportedtothefirm’sprofessional

liabilityinsurer,andshouldberespondedtoonlybylegalcounselretainedtorepresent

theinterestsofthefirm.

-Althoughthepartner,principalormanagerresponsiblefortheclientneedstobeinvolved

inpreparingtheproduction,CPAfirmsshouldconsiderdesignatingarecordscustodianto

coordinateresponsestoallsuchrequests.Overtime,adesignatedcustodiancoulddevelop

anunderstandingoftheapplicableprofessionalstandards,laws,rules,andregulations,

ensurethatallrequestsaredocumentedinwriting,andspecifythedocumentsneeded.

-Expertisewillbedevelopedovertimeifthefirmhasadesignatedrecordscustodian

whichwillincreaseefficiencyaswellasminimizeerrors.Legalcounselshouldbeconsulted

iftheclientindicatestheywillnotconsenttotheproductionandtheCPAbelievesthe

individualorentitymakingtherequestmaybeentitledtotheinformation.

-Responsestorequeststoproducerecordsaresubjecttotimelimitationsgovernedbylaw,

regulation,andprofessionalstandards.Establishadocketingsystemtomonitorthetimely

responsetorequests,andtrainadministrativeandprofessionalstaffontheimportance

ofidentifying,maintainingandretrievingrecordsrequestedbythefirmrecordscustodian

inatimelymanner.


1. The Basics1 .1 . Key Definitions – Records and Working Papers

ET Section 501oftheAICPA Professional Code of Conductdefinesthefollowingkeytermsfor

recordsandworkingpapers:

“Client-provided recordsareaccountingorotherrecordsbelongingtotheclientthatwereprovided

tothemember,byoronbehalfoftheclient,includinghardcopyorelectronicreproductionsof

suchrecords.

Member-prepared recordsareaccountingorotherrecordsthatthememberwasnotspecifically

engagedtoprepareandthatarenotintheclient’sbooksandrecordsorareotherwisenotavailable

totheclient,withtheresultthattheclient’sfinancialinformationisincomplete.Examplesinclude

adjusting,closing,combining,orconsolidatingjournalentries(includingcomputationssupporting

suchentries)andsupportingschedulesanddocumentsthatareproposedorpreparedbythemem-

beraspartofanengagement(forexample,anaudit).

Member’s work productsaredeliverablesassetforthinthetermsoftheengagement,suchas

taxreturns.

Member’s working papersareallotheritemspreparedsolelyforpurposesoftheengagementand

includeitemspreparedbythe

-member,suchasauditprograms,analyticalreviewschedules,andstatisticalsamplingresults

andanalyses,and

-client,attherequestofthememberandreflectingtestingorotherworkdonebythemember.”

Hereafter,forpurposesofthisguide,client-provided recordswillbereferredtoasclient records.


1 .2 . Examples of Records and Working Papers

Commonexamplesoftheabovedefinitionsinpracticeinclude,butarenotlimitedto,thefollowing:

-Client records:Bankstatements,W-2’s,vendorinvoices,andsalereceipts;

-Member-prepared records:journalentries,generalledgers,adjustingentries,trialbalances,

anddepreciationschedules;

-Member’s work products:compilationreports,auditreports,taxreturns,andmanagement

commentletters;and

-Member’s working papers: auditprogramguides,memosdocumentingproceduresperformed

andananalysisofsufficiencyofauditevidenceobtainedovermanagement’sassertion,and

clientrecordswithfirmanalysistosupporttaxreturnpositions.

1 .3 . Key Definitions – Requesting Parties

Clientsaregenerallyindividuals,membersofmanagementofanentity,partnersinapartnershipor

LLC,trustees,etc.However,clientsmaynotincludeindividualshareholders,unitholders,trustben-

eficiaries,andspouses.ET Section 501oftheAICPA Professional Code of Conductdefinestheterm

client(s)toincludecurrentandformerclients.

Third partyisanyindividualorentityotherthanaclient.Third partyrequestsmaycomefromparties

suchasmortgagebrokersandlenders,attorneys,financialinstitutions,theIRS,staterevenuedepart-

ments,federalandstateregulatoryandenforcementagenciesorcorporateshareholdersorpartners

whoarenotpartofclientmanagement1.Suchrequestsgenerallyarisefromfinancialstatementor

taxreturnpreparationservices.

1 See related article, Third Party Verification Letters, posted at www .cpai .com.

www.cpai.com


2. Professional Standards2 .1 . Record Requests – ET Section 501 of the AICPA Professional Code of Conduct

Interpretation 501-1ofET Section 501providesguidanceonhowtorespondtorequestsforrecords.

“Membersmustcomplywiththerulesandregulationsofauthoritativeregulatorybodies,suchas

themember’sstateboard(s)ofaccountancy,whenthememberperformsservicesforaclientandis

subjecttotherulesandregulationsofsuchregulatorybody.Forexample,amember’sstateboard(s)

ofaccountancymaynotpermitamembertowithholdcertainrecordsnotwithstandingfeesdueto

thememberfortheworkperformed.Failuretocomplywiththemorerestrictiveprovisionscontained

intherulesandregulationsoftheapplicableregulatorybodyconcerningthereturnofcertainrecords

wouldconstituteaviolationofthisinterpretation.

Client-provided recordsinthemember’scustodyorcontrolshouldbereturnedtotheclientatthe

client’srequest.

Unlessamemberandtheclienthaveagreedtothecontrary,whenaclientmakesarequestfor

member-prepared records,oramember’s work productsthatareinthecustodyorcontrolofthe

memberorthemember’sfirm(member)thathavenotpreviouslybeenprovidedtotheclient,the

membershouldrespondtotheclient’srequestasfollows:

-Member-prepared recordsrelatingtoacompletedandissuedworkproductshouldbeprovided

totheclient,exceptthatsuchrecordsmaybewithheldiftherearefeesduetothememberfor

thespecificworkproduct.

-Member’s work products shouldbeprovidedtotheclient,exceptthatsuchworkproducts

maybewithheld:

-iftherearefeesduetothememberforthespecificworkproduct;

-iftheworkproductisincomplete;

-forpurposesofcomplyingwithprofessionalstandards(forexample,

withholdinganauditreportduetooutstandingauditissues);or

-ifthreatenedoroutstandinglitigationexistsconcerningtheengagement

ormember’swork.

-Oncethememberhascompliedwiththeserequirements,heorsheisundernoethicalobliga-

tiontocomplywithanysubsequentrequeststoagainprovidesuchrecordsorcopiesofsuch

records.However,ifsubsequenttocomplyingwitharequest,aclientexperiencesalossof

recordsduetoanaturaldisasteroranactofwar,themembershouldcomplywithanadditional

requesttoprovidesuchrecords.

-Member’s working papersarethemember’spropertyandneednotbeprovidedtotheclient

underprovisionsofthisinterpretation;however,suchrequirementsmaybeimposedbystate

andfederalstatutesandregulations,andcontractualagreements.


Inconnectionwithanyrequestforclient records,member-prepared records,oramember’s work

products,themembermay

-chargetheclientareasonablefeeforthetimeandexpenseincurredtoretrieveandcopysuch

recordsandrequirethatsuchfeebepaidpriortothetimesuchrecordsareprovidedtotheclient,

-providetherequestedrecordsinanyformatusablebytheclient,and

-makeandretaincopiesofanyrecordsreturnedorprovidedtotheclient.

Thememberisnotrequiredtoconvertrecordsthatarenotinelectronicformattoelectronicformat

ortoconvertelectronicrecordsintoadifferenttypeofelectronicformat.However,iftheclientrequests

recordsinaspecificformatandtherecordsareavailableinsuchformatwithinthemember’scustody

andcontrol,theclient’srequestshouldbehonored.Inaddition,thememberisnotrequiredtopro-

videtheclientwithformulas,unlesstheformulassupporttheclient’sunderlyingaccountingorother

records,orthememberwasengagedtoprovidesuchformulasaspartofacompletedworkproduct.

Whereamemberisrequiredtoreturnorproviderecordstotheclient,themembershouldcomply

withtheclient’srequestassoonaspracticablebut,absentextenuatingcircumstances,nolaterthan

45daysaftertherequestismade.Thefactthatthestatutesofthestateinwhichthememberprac-

ticesgrantthememberalienoncertainrecordsinhisorhercustodyorcontroldoesnotrelievethe

memberofhisorherobligationtocomplywiththisinterpretation.”

2 .2 . Confidentiality – ET Section 301 of the AICPA Professional Code of Conduct

ACPAisprohibitedfromdisclosingconfidentialclientinformationwithoutthespecificconsentofthe

client.ThisconfidentialitydutyisembodiedintheAICPA Code of Professional Conduct,2aswellas

intherulesandregulationsofcertainstateboardsofaccountancyandregulatoryandtaxauthorities.

2 .3 . Ownership

Ingeneral,amember’s working papersarethepropertyoftheCPAfirm.Client recordsandmember-

prepared recordsarethepropertyoftheclient.Amember’s work productbecomestheproperty

oftheclientwhentheclientacceptsandpaysforthework.Specifically,withrespecttoanaudit

engagement,AICPAprofessionalstandardsindicatethat“auditdocumentationisthepropertyof

theauditor,andsomestatesrecognizethisrightofownershipintheirstatutes...”3

2 Id. at ET Section 301. Also see related Ethics Rulings on Responsibilities to Clients at ET Section 391 for discussion of how the rule should be construed and applied.

3 Id. at AU-C Section 230.A29, Audit Documentation.


3. Law, Rules, and Regulations3 .1 . Federal and State Laws3.1.1 Privacy, Confidentiality and Security

Inconsideringrequeststorevieworobtaincopiesofinformationcontainedinengagementfiles,

CPAsneedtobeknowledgeableabouttheapplicationofconfidentiality,privacy,andsecurityrules

andlawsthatapplytotheirpractice,asthismayimpactresponsestosuchrequests.Forinstance,

withrespecttoimplementationoftheGramm-Leach-BlileyAct,theFTCandtheSECpromulgated

rulesthatapplytoCPAfirms,theiremployees,andtheirsubcontractorsiftheyrendertaxservices

toindividualsorserveasinvestmentadvisersorregisteredrepresentativesofabroker/dealer.4,5

Otherfederalagenciesareresponsibleforthepromulgationandenforcementofrulesthatapplyto

serviceproviderstomedicalproviders(HHS)andfinancialinstitutions(OCC,FDIC,OTS).Additionally,

moststateshavepassedconsumerprivacylawsaffectingprofessionalservicefirms,andothersare

consideringdoingso.6

Risk Management Tip:

Asnewrulesandlawscontinuetoevolveintheareaofprivacy,CPAsshouldconsultwiththeir

legalcounsel,stateCPAsocietyandtheAICPAonaregularbasisforcurrentinformationon

thissubject.

3.1.2. Internal Revenue Code

TheInternal Revenue Code, 26 U.S.C.A. § 7216,makesitamisdemeanorcriminaloffenseforan

accountanttoknowinglyorrecklesslydisclosetoanon-clientinformationfurnishedtohimorherby

aclienttopreparefederaltaxreturnsortousesuchinformationforanyotherpurposewithoutthe

client’swrittenconsent.Theoffenseispunishablebyafineofupto$1,000and/ornotmorethan

1yearimprisonment.Exceptionstotherulearestatedin§7216.

Theconsenttodisclosefederaltaxinformationtoathird party mustbeinwriting(paperorelectronic

form)andmustincluderequiredinformationandmandatorylanguagedrivenbyTreasuryregulation.

Therearealsorequirementsastothesizeofpaperandfontforpaperconsents.Forelectroniccon-

sents,theremustbesufficientcontrastbetweentextandbackgroundcolors.

TheSection7216InformationCenter,availableatwww.irs.gov,providesanoverviewoftherequire-

menttoobtainaclient’sconsent,includingaidstopreparingconsentforms.Asguidancemaychange,

firmsshouldcontinuetomonitorguidancefromtheIRS.7


Notethatasubpoenatoproducetaxinformationdoesnotrelieveanaccountantofhisor

herresponsibilitiesunder§7216.Thefirmshouldstillimmediatelyreportthesubpoenatoits

professionalliabilityinsurer.Ifthefirmdoesnothaveprofessionalliabilityinsurancethatwould

assistthefirminrespondingtothesubpoena,thefirmshouldretainlegalcounseltoassist

withrespondingappropriately

4 The Financial Services Regulatory Relief Act of 2006 contains a privacy notice exemption for accountants (Section 609, Exemption From Disclosure Of Privacy Policy For Accountants).

5 See related articles, Privacy, Confidentiality, and Electronic Communications and A Possible Privacy Breach: What Next? posted at www .cpai .com. 6 As of the publication date of this guide, federal legislation affecting consumer privacy was under consideration. 7 Visit the information center for more detailed guidance - http://www .irs .gov/Tax-Professionals/Section-7216-Information-Center.

www.irs.gov

www.cpai.com

http://www.irs.gov/Tax-Professionals/Section-7216-Information-Center


3 .2 . State Board of Accountancy Rules and Regulations

AsnotedinAICPA Professional Code of Conduct, ET Section 501, Interpretation 501-1 (seeSection

2.1 Record Requestsofthisguide),firmsshouldrefertostateboardofaccountancyregulations

regardingretentionofclient records assuchregulationsmaydifferfromAICPAethicsstandards.For

example,CaliforniaBoardofAccountancyCodeSection68statesthat“Alicensee,afterdemand

byoronbehalfofaclient,forbooks,recordsorotherdata,whetherinwrittenormachinesensible

form,thataretheclient’srecordsshallnotretainsuchrecords.Unpaidfeesdonotconstitutejusti-

ficationforretentionofclient records.”Additionally,somestatesrequirewrittendisclosuresand

permissionfromclientsorprospectiveclients.Forexample,seeCaliforniaBoardofAccountancy

BusinessandProfessionalCodeSection5063.8.


4. Responding to Requests from Current Clients, Former Clients, and Third Parties4 .1 . Requests from Current and Former Clients

CPAsmayreceiverequestsfromclientsforcopiesofvariousdocuments,includingpreviouslyissued

reportsandtaxreturns.TheguidancecontainedinAICPA Professional Code of Conduct, ET Section

501, Interpretation 501-1alsoappliestotheserequests.Ifthedocumentsrequesteddonotconstitute

client recordsormember-prepared records asdescribedintheethicsinterpretation,providing

copiesisatthediscretionoftheCPAfirm.Itisappropriatetochargefortimeandexpensesincurred

inrespondingtotheserequestsandtorequirepaymentatthetimeofdeliveryofthecopies.

-Copiesofmember’s working papers –Anyrequestfromaclientforcopiesofamember’s

working papers shouldbecriticallyevaluatedastoindicatedneed,planneduse,andtheextent

oftherequest.Ifthemember’s working papersrelatetoanengagementthatwasnotcompleted

andnoreportwasissued,CPAsgenerallyshouldnotprovidecopies.Iftheclientquestionsthe

extentorqualityofservicesperformed,consultwithyourprofessionalliabilityinsurancecarrier

beforeproceeding.

-CopiesofPreviouslyPreparedTaxReturns–AlthoughETSection501,Interpretation501-1

doesnotrequiretheCPAtoprovidetaxreturnsifpreviouslyprovidedtotheclient,Treasury

DepartmentCircular 230,Section10.28statesthat“apractitionermust,attherequestofaclient,

promptlyreturnanyandallrecordsoftheclientthatarenecessaryfortheclienttocomplywith

hisorherFederaltaxobligations.”Thissectiongoesontodefine“recordsoftheclient”to

include“anyreturn,claimforrefund,schedule,affidavit,appraisaloranyotherdocumentpre-

paredbythepractitioner,orhisorheremployeeoragent,thatwaspresentedtotheclientwith

respecttoapriorrepresentationifsuchdocumentisnecessaryfortheclienttocomplywith

hisorhercurrentFederaltaxobligations.”



1.Uponreceiptofarequestforcopiesofengagementfiledocumentation,itiscriticalto

determinewhethertherequestiscomingfromtheclientorapersonwithintheauthority

toactonbehalfoftheclient,orathirdparty,duetoconsentconsiderations.

2.Requiretherequesttobemadeinwritingfordocumentationpurposes.Reviewthe

requesteddocumentspriortoprovidingcopiestotheclientanddeterminethetypeof

document,usingthedefinitionsestablishedinSection1.1 Key Definitions – Records and

Working Papers.Determinewhichdocumentsarerequiredtobeprovidedtotheclient

basedontheprofessionalstandards,laws,rulesandregulations.

3.Intheeventincompleteinformationorworkthatshouldbecompletedorsupplemented

isdiscoveredpriortoprovidingcopies,prepareseparatedocumentsdatedandsigned

bythepreparer,alongwithanexplanationofwhysupplementaldocumentswereprepared.

Thesedocumentsshouldbereviewedandapprovedbytheengagementprincipal.Ifthe

workingpapersareinanelectronicformat,followtheinstructionsprovidedbythesoft-

waredeveloperinpreparingthesedocuments.Donotalterdocumentsintheworking

papersfile.AuditorsshouldconsultcurrentstandardsandguidancecontainedinAU-C

Section230Audit Documentation,aswellasguidanceissuedbythePublicCompany

AccountingOversightBoard(PCAOB)andtheU.S.GovernmentAccountabilityOffice

(GAO),asapplicable.

4.Oncealldocumentsaresortedandcopied,includeatransmittalletterwiththecopies

senttotheclientthatlistsanddescribeseachdocument,includingastatementthatthe

informationisfortheclient’sinternaluseonly.Anexampleofthistypeofletterisincluded

inAppendixA.Arecommendedpracticeistosequentiallynumbereachpageinthe

productionand/orkeepascannedcopyoftheproduction.

5.Intheeventadditionalrelateddocumentationisdiscoveredfollowingthefirm’sresponse

toadocumentrequestorsubpoena,immediatelyconsultwiththefirm’slegalcounsel

priortotakingfurtheraction.Donotdiscusswiththerequestingpartypriortoconsulting

withcounsel.


Original working papers or files should not be released.Duplicationofelectronicrecords

shouldbeperformedbyfirmpersonnel,andcopyingofpaperrecordsshouldbeperformed

underthefirm’ssupervisionandcontrol.


4 .2 . Requests from Third Parties

CPAsmayreceiverequestsfromthird partiesforaccesstoorcopiesofworkingpapers.Therecould

beseriouslegalconsequencesincertainjurisdictionsiftheCPAfirmpermitsthird partyaccessto

documentationwhichincludesthepossibleerosionofcertainprivitydefensesthatmayhavebeen

availabletodefendthefirm.Pleaseconsultwithlegalcounselpriortorespondingtoanyrequest

byathirdpartytoreviewcopiesofworkingpapers.Privity,asdefinedatwww.findlaw.com,is“the

directconnectionorrelationshipbetweenpartiestoacontractortransaction”.Overtime,caselaw

and/orlegislationhaveerodedthisdefense.8


Inmostcircumstances,aCPAshouldnotprovideaccesstoorcopiesofengagementfilesor

workingpaperstothird parties.Similartoclientrequests,allrequestsfromthirdpartiesshould

bemadeinwriting.Evenifaclientconcurswithathird partyrequestandprovideswritten

consenttotheCPA,thefirmshouldconsiderthereasonsfortherequestandthelegalliability

implicationsofcomplying.ConsiderwhetherInternal Revenue Code, 26 U.S.C.A. § 7216gov-

ernstherequest.SeefurtherinformationinSection 3.1.2 Internal Revenue Codeofthisguide.

Alsoconsiderapplicablestateboardofaccountancyrules.SeefurtherinformationinSection

3.2 State Board of Accountancy Rules and Regulations.Forrequestsfromthirdpartiesthat

caneasilybeprovidedbyaclient,itisrecommendedthattheCPAprovidetherecordstothe

clienttothemtransmittothethirdparty.

8 For more information on the AICPA’s position and advocacy actions related to Tort Reform – Privity of Contract, see the State Regulatory and Legislative Affairs area in the Advocacy section of the AICPA website at www .aicpa .org.

www.findlaw.com

www.aicpa.org


4 .3 . Requests from Regulatory Bodies, Administrative Agencies and Governmental Entities4.3.1. Miscellaneous Regulatory Bodies and Administrative Agencies

Insomecircumstances,firmsmayberequiredbylaw,regulation,orcontracttoprovideaccessto

andcopiesofengagementfilestoaregulatororadministrativeagency.Normally,thesepartieshave

subpoenapowerandwillrequestconfidentialclientinformationbysubpoena.Apersonorentity

subjecttoinvestigationbyaregulatorybodyorthirdpartieswithrelevantdocumentscanrequire

thatasubpoenabeissued.Whenthethirdpartyhasconfidentialinformation,arequestforasup-

portingsubpoenaidentifyingexactlywhichdocumentsarebeingrequestedisoftenadvisableto

documenttherequestandthefactthattheproductioniscompelled.Professionalliabilityinsurance

policiesmayproviderelatedinsurancecoverageforrespondingtoregulatoryinquiries.


Insuchcases,timelyreportallregulatoryinquiriestoyourprofessionalliabilitycarrierorlegal

counselpriortorespondingtorequestsfromaregulator.Youmaybeadvisedtorequestthe

regulatororagencytoissueasubpoenafortheproductionoftherecords.Withorwithouta

subpoena,theCPAshouldstilladvisetheclientoftherequestandthatthefirmintendsto

complywithitabsentanobjection.Theexceptiontothisisintheeventofacriminalmatter.

SeefurtherinformationinSection 6.3.1 Subpoena and Administrative SummonsandSection

6.3.2 Contacting Legal Counsel and Professional Liability Insurance Carrier.

Thefirmshouldnotagreetosurrenderoriginalworkingpaperstoaregulatororadministrative

agency,andshouldmaintaincontrolovertheworkingpapersduringtheaccess/copyingprocess

toensureconfidentialityofclientinformationandthecontinuedintegrityoftheworkingpapers.9

4.3.2. Requests from the IRS and State Revenue Departments

CPAswhopracticebeforetheIRSandstaterevenuedepartmentsshouldbefamiliarwiththeirspecific

dutiestoprovideinformation.TreasuryDepartmentCircularNo.230states,“apractitionermust,on

aproperandlawfulrequestbyadulyauthorizedofficeroremployeeoftheInternalRevenueService,

promptlysubmitrecordsorinformationinanymatterbeforetheInternalRevenueServiceunless

thepractitionerbelievesingoodfaithandonreasonablegroundsthattherecordsorinformation

areprivileged”.10Inaddition,uponrequest,practitionersneedtomaintainandmakeavailableto

theIRScopiesoftaxreturns,refundclaims,listsoftaxpayersandtaxpayerIDnumbersforreturns,

andrefundclaimsprepared.11Further,firmsemployingataxreturnpreparermustmakeavailablea

listofsuchtaxpreparersaswellastheiridentificationnumbersandplaceofwork.12

9 Id. at AU-C Section 9230.02, Audit Documentation: Auditing Interpretations of Section 230.10 Treasury Department Circular No. 230, Regulations Governing Practice before the Internal Revenue Service, Sec. 10.20.11 IRC Sec. 6107(b).12 IRC Sec. 6060(a).


5. Other Request Considerations5 .1 . Marital Disputes

CPAsmayreceiverequestsforcopiesofindividualtaxreturnsandsupportinginformationfromclients

whoareseparatingordivorcingandhavepreviouslyfiledjointtaxreturns.Onlyonespousemay

havefurnishedtheinformationusedtopreparethereturn,andtheotherspousemayrequestcopies

ofpreviouslypreparedtaxreturnsandrelatedsupportingdocumentation(i.e.jointbankstatements,

individualIRAaccountstatements,etc.).


Inpreparingajointreturnforamarriedcouple,bothindividualsareconsideredclientsofthe

firmandhaveequalrighttotheinformationsupportingtheirfiledjointreturn.13However,if

onespousehasanownershipinterestinabusinessandtheotherspousehasnoownershipin

thisbusiness,recordspertainingtothebusinessshouldonlybeprovidedtotheindividual

whohasanownershipinterest.

5 .2 . Business Owner Disputes

Asimilarissueariseswhenrequestsforclient recordsandotherinformationaremadebyindividuals

associatedwithaclientwhoareembroiledinaninternalcompanydispute.Firmsmaystrugglein

determiningwhetherarequestistrulycomingfromacliententitledtothedocumentsorfroma

third party.Inthesedisputes,demandsforcopiesofrecordsareoftenmadebyindividualshaving

hadlittleornopriorcontactwiththeCPAfirm.TheobligationoftheCPAinsuchsituationsisto

respondtorequestsfromthepreviouslydesignatedclientrepresentative.TheCPAhasanobligation

tousereasonablecaretoobtaininformedconsentfromanauthorizedrepresentativeoftheclient.14


Ifitcannotbereadilydeterminedwhethertherequestingpartyisauthorizedtoreceivecopies

ofrecordsonbehalfoftheclient’sbusiness,itisrecommendedthattheCPAconsultwithlegal

counselpriortoresponding.Legalcounselwillmakeadeterminationbaseduponthefacts

andcircumstances.

13 Id. at ET Section 391.031-.032, Disclosure of Confidential Information.14 Id. at ET Section 591 – Ethics Rulings on Other Responsibilities and Practices, Ruling 189 Requests for Records Pursuant to Interpretation 501-1.


5 .3 . Requests from Clients with Outstanding Fees

Manyfirmsreceiverequestsfromclientsforreports,taxreturns,andotherdocumentsprepared

foraclientforwhichthefirmhasnotbeenpaid.Somestateboardsofaccountancyconsiderthe

withholdingofclient recordsadiscreditableact,evenifthereareoutstandingfees.Researchthe

applicablestateboardofaccountancyregulationsinthejurisdictionsofboththefirmandtheclient

priortowithholdingrecords.Additionally,TreasuryCircular 230,Section10.28generallyrequiresthe

returnofclient recordsnecessaryfortheclienttocomplywithhisorherFederaltaxobligations,

ifthereisafeedisputeandapplicablestatelawallowsorpermitsretentionoftheclient’srecords,

thepractitionerisonlyrequiredtoprovidetheclientwiththerecordsthatmustbeattachedtothe

taxpayer’sreturn.Inaddition,thepractitionermustprovidetheclientwithreasonableaccessto

reviewandcopyanyadditionalrecordsnecessaryfortheclienttocomplywithhisorherFederal

taxobligations.


Ifthefirmisnotobligatedtoreleaseworkproductthataclienthasnotpaidfor,itisappro-

priatetorespondtosuchrequestsinadatedandsignedletteroremailexplainingwhythe

documentsarenotbeingreleased.Suchdocumentationservesascriticalevidenceofthe

timingandexplanationforwithholdingworkproductiftheclientlaterallegestheysuffered

damagesasaresultofnothavingaccesstothedocuments.Ifaclienthaspaidfortheservices

underlyingtheworkproductinquestion,butthereareotherfeedisputespending,thefirm

shouldconsultcheckwithitsprofessionalliabilitycarrieronavailabilityofpre-claimassistance

orwithlegalcounselpriortorespondingtothesetypesofrequests.


6. Special Topics6 .1 . Audit Engagements6.1.1. Request to Furnish Previously Issued Audit Reports

Firmsmayreceiverequestsfromclientstofurnishadditionalcopiesofpreviouslyissuedauditreports,

ormayseekpermissiontoprovidereportcopiestothird parties.


Firmsreceivingsuchrequestsforadditionalcopiesofreportsshoulddeterminewhytherequest

isbeingmade,whowillreceivethereports,andhowtheauditreportwillbeused.Ifafirm

complieswiththerequest,asignedanddatedtransmittallettershouldaccompanyadditional

copiesofpreviouslyissuedauditreportsfurnishedtotheclient.Thelettershouldindicatethat

thepreviouslyissuedauditreportwaspreparedsolelyfortheuseoftheclientandexpected

usersknowntotheCPAfirmatthetimeitwasoriginallyprepared,andshouldnotberelied

uponbyanythirdparties.

6.1.2. Successor Auditor Requests

Inconnectionwithacompany’schangeofauditors,asuccessorauditormakesarequesttoreview

thepredecessorauditor’sauditdocumentation.AsindicatedintheapplicableAICPAprofessional

standards,“itiscustomaryinsuchcircumstancesforthepredecessorauditortomakehimorher

availabletothesuccessorfirmandmakeavailableforreviewcertainoftheworkingpapers.Thepred-

ecessorauditorshoulddeterminewhichworkingpapersaretobemadeavailableforreviewand

whichmaybecopied….theextent,ifany,towhichapredecessorauditorpermitsaccesstothework-

ingpapersisamatterofjudgment.”15


Beforerespondingtoanyrequestsfromthesuccessorfirm,thepredecessorshouldobtain

thewrittenconsentoftheclientbeforeproceeding.Inaddition,althoughnotrequiredbythe

AICPAprofessionalstandards,itisrecommendedthatthepredecessorobtainanacknowl-

edgementletterfromtheclientdocumentingthescopeandpurposeofthesuccessor’scom-

municationsandworkingpaperaccess.AsampleofsuchaletterisincludedinAU-CSection

510ExhibitB.Also,asindicatedintheAICPAprofessionalstandards,thepredecessorauditor

shouldreachanunderstandingwiththesuccessorauditorastotheuseoftheworkingpapers.

Althoughnotrequired,thepractitionershouldconsiderobtaininganacknowledgementletter

fromthesuccessorauditor.AsampleofsuchaletteriscontainedinAU-CSection510ExhibitC.

15 Id. at AU-C Section 510.A1-A9, Opening Balances – Initial Audit Engagements, Including Reaudit Engagements.


6 .2 . Other Requests for Access to Audit and Other Working Papers

Otherrequestsforaccesstoauditworkpapersmayariseintheeventaclientisconsideringselling

itsbusiness.AnotherCPAfirmmaybeengagedtoperformduediligenceservicesontheaudited

entity.Additionally,successorCPAfirmsmayrequestcopiesofrecordsinconnectionwithbookkeep-

ing,compilation,review,attestandtaxreturnpreparationengagements.


TheabovereferencedAICPAprofessionalstandardsapplytopredecessorandsuccessorfirms

inconnectionwithanauditengagement.However,fromariskmanagementperspective,this

guidanceshouldalsobeconsideredwhenrequestsarereceivedfromsuccessorfirmsincon-

nectionwithanyothertypeofengagement.

6 .3 . Litigation – Record Retention

Anoverridingconcernwithrespecttoworkingpapersandrecordsistheneedtopreserveallclient

engagementrecordswhenthefirmfirstlearnsthat:

-Aclient,thefirm,oracurrentorformeremployeeofthefirmisundercivil,criminal,orregula-

toryinvestigationorexpectstobeinvestigatedwithrespecttoeitherclientfinancialmatters

orservicestotheclient,or

-Theclientorthird partiesinquireaboutservicespreviouslyprovidedtotheclient,orallege

directlyorindirectlythattheservicesrenderedbythefirmmayhavebeenincompleteor

improper,or

-Litigationispendingorexpectedwithrespecttothesematters,regardlessofwhetherornotthe

CPAfirmoritscurrentorformeremployeesareorareexpectedtobepartiestosuchlitigation.

6.3.1. Subpoena or Administrative Summons

CPAsalsomayreceiveasubpoenaorsummonstotestifyorproduceworkingpapersandother

records.Thesubpoenaorsummonsmayrelatetocivilorcriminallitigationinvolvingaclient,an

inquiryorauditinvolvingtheIRSorastatedepartmentofrevenue,aregulatoryinquiry,oralawsuit

whereintheCPAfirmisaparty.Alwaysnotifyyourprofessionalliabilitycarrierifyoureceiveasub-

poenaorsummonstotestifyortoproduceworkingpapersandotherrecords.Theresponsetoa

subpoenaoradministrativesummonsvariesdependinguponitsnature.Federalandstatelawpro-

videsindividualswithcertainrightstoobjecttoacivillitigationsubpoena.Forexample,objections

couldberaisedinaresponsetoarequestfordocumentsinacivillitigationsubpoenarelatedtoa

divorceproceeding.Ontheotherhand,aCPAmustcomplywiththedemandsofanadministrative

subpoena.Itishighlyrecommendedthatyouconsultwithlegalcounseltoappropriatelyadvise

youontheseissues.


6.3.2. Contacting Legal Counsel and Professional Liability Insurance Carrier

Uponreceiptofasubpoenaorsummonstotestifyaboutclientservicesorproduceclientengage-

mentrecords,aCPAfirmshouldimmediatelyconsultwithitsprofessionalliabilityinsurancecarrier

andlegalcounselpriortorespondingtotherequest.Notethatgrandjurysubpoenasareconfidential,

andtheCPAfirmmaybeprohibitedfromcontactingtheclientunderthetermsofthesubpoena.

Concurrenttonotifyingitsprofessionalliabilityinsurancecarrierandlegalcounsel,thefirmshould

informallfirmprofessionalsandadministrativestafftopreserveanyandalldocumentationrelated

tothesubpoenasubject.

CPAsthathaverenderedservicestoanattorneyasaconsultingortestifyingexpertinconnection

withanticipatedorpendinglitigationwhoaresubsequentlysubpoenaedaspartofthatlitigation

shouldconsultwiththatattorneyregardingtheirresponse.Ontheotherhand,CPAswhoreceivea

subpoenapertainingtothisworkfollowingthesettlementorfinaladjudicationofthesubjectlitiga-

tionshouldfollowtheaboveguidanceandimmediatelyconsultwithitsprofessionalliabilitycarrier

andlegalcounsel.

6.3.3. Time Limitations

Timelimitationsonrespondingtodocumentrequestsaregovernedbyprofessionalstandards,state

boardofaccountancyregulations,andfederalandstatelawandregulations.Asnotedearlier,ET

Section 501, Interpretation 501-1oftheAICPAProfessionalStandardsindicatesthatclientrequests

shouldbecompliedwith(absentextenuatingcircumstances)nolaterthan45daysaftertherequest

ismade.Stateboardofaccountancyregulationsmaybemorerestrictive.Deadlinesforresponses

toadministrativesummonsorsubpoenasandcivilorcriminalsubpoenasvaryandtypicallyhavea

responsedateattachedtothedocumentation.Subpoenasmayhaveashorttimeframeforresponding.

Untimelyresponsestorecordrequestscanresultindisciplinaryproceedings.Withrespecttosum-

monsorsubpoenas,thisalsocanjeopardizelegalrightstoobject,filemotions,orseekadditional

timetorespond,andcanresultintheimpositionofcivilorcriminalpenalties.Untimelyresponses

todocumentrequestspresentedtoaclientwhichareforwardedtotheirCPAfirmforresponseon

theirbehalfcouldpossiblyjeopardizetherightsoftheclient,resultingindamagestotheclientand

exposuretocivilandcriminalpenaltiesforboththeclientandthepractitionerorCPAfirm.


Intheeventoflitigation,asubpoena,and/oradministrativesummons,allemployeesshould

immediatelybeadvisedtoretainallfirmrecordspertainingtotheclient,andtoreferanyrequests

forsuchrecordstofirmmanagement,regardlessofthesourceoftherequest.Management

shouldconsultwithitsprofessionalliabilityinsurancecarrierandlegalcounselwhenpreparing

aresponsetosuchrequests.Pleasenotethatitisimperativetorespondinatimelyfashion

andifyouhaveanyquestionspleaseconsultwithyourprofessionalliabilitycarrierand/or

legalcounsel.


Appendix A – Sample Transmittal Letter Accompanying Copies of Working Papers Furnished to a Client

ABC, CPAs

123 Any Street

Anytown, USA

June1,201X

XYZClient

456AnyStreet

Anytown,USA

Dear_______________________________:

Asyourequested,Iamenclosingthefollowingcopiesfromourengagementfilesforthe(engage-

mentdescription):

(Includedescriptionofeachdocumentincludingtitle,date,workingpaperindex(ifavailable),

descriptionofinformationpresentedandnumberofpages)

Thesecopiesareforyourcompany’sinternaluseonly(describetheclient’sstatedpurposeorneed

fortheworkingpapers)andarenottobedistributedormadeavailabletoanythird-party.Ifthese

workingpapersbecomethesubjectofanysubpoena,summons,orcourtorderthatyoureceive,you

agreetonotifyusimmediatelybeforecomplyingwithsuchorder.

Sincerely,

JohnDoe,CPA


Additional ResourcesAICPAResourcesavailableatwww.aicpa.org:

1. Privacy/DataProtectionPage

2. APrivacyChecklistforCPAFirms

CNAriskmanagementarticlesavailableatwww.cpai.com:

1. ProfessionalLiabilityIssuesinPracticeMergersandDissolutions

2. FirmOwnershipChange:ReleasingWorkingPapers

JournalofAccountancyarticlesavailableatwww.journalofaccountancy.com:

1. Whenpartiescomeknockingforclientrecords

2. Therulesonprovidingclientrecords

www.aicpa.org

www.cpai.com

www.journalofaccountancy.com


The purpose of this article is to provide information, rather than advice or opinion. It is accurate to the best of the authors’ knowledge as of the date of the article. Accordingly, this article should not be viewed as a substitute for the guidance and recommendations of a retained professional. In addition, CNA does not endorse any coverages, systems, processes or protocols addressed herein unless they are produced or created by CNA. Any references to non-CNA websites are provided solely for convenience, and CNA disclaims any responsibility with respect to such websites. The sample letter is for illustrative purposes only. As each practice presents unique situations and statutes may vary by state, we recommend that you consult with your attorney prior to use of this or similar letters in your practice. This article is not intended to establish any standard of care, to serve as legal advice for any particular factual situations, or to provide an acknowledgment that the situation is covered under any CNA insurance policy. Only the relevant insurance policy can provide the actual terms, coverages, amounts, conditions and exclusions for an insured. All CNA products and services may not be available in all states and may be subject to change without notice. IRS Circular 230 Notice: The discussion of U.S. federal tax law and references to any resources in this material are not intended to: (a) be used or relied upon by any taxpayer for the purpose of avoiding any federal tax penalties; (b) promote, market or recommend any products and/or services except to the extent expressly stated otherwise; or (c) be considered except in consultation with a qualified independent tax advisor who can address a taxpayer’s particular circumstances. Continental Casualty Company, a member of the CNA group of insurance companies, is the underwriter of the AICPA Professional Liability Insurance Program. CNA is a registered trademark of CNA Financial Corporation. Published 2/2014

Formorethan50years,CNAhasbeenservingaccountingfirmswithsolutionsthathelpreducetherisksofmanagingtheirpracticeandinsurancethathelpscoverafirmanditsemployees.Withproductsandservicesdesignedforaccountantsbyexperiencedprofessionalriskconsultantswithpracticalexperienceintheprofession,CNAinsuresmoreaccountantsthananyothercarrier.CNA’sbroadportfolioincludesprofessionalliability,generalliability,cyberliability,property,employmentpracticesliability,andourindustry-leadingP&Cpackageforsmallfirms.WeareproudtobetheendorsedprofessionalliabilityinsurancecarrierfortheAmericanInstituteofCPAs®memberinsuranceprogram.

CNA,AccountantsProfessionalLiability333S.WabashAve.,36S,Chicago,IL60604

AICPA Professional Liability Insurance Program

To learn more about the AICPA Professional Liability Program visit cpai .com or call 800-221-3023 .

Underwrittenby:Endorsedby: Broughttoyouby:

http://www.cpai.com

request for records – a guide for cpa firms

Documents