For US CPA firms
- AICPA Code of Professional Conduct. The Code includes interpretations on using third-party service providers, covering when to inform clients and the need for a confidentiality agreement or client consent before sharing confidential information. Check the current wording and your state board’s rules.
- Tax return information. If the data was given to your firm in connection with preparing a tax return, Internal Revenue Code Section 7216 and its regulations may apply, including specific consent requirements for disclosure to a preparer located outside the United States. Offshore Accounting Hub does not prepare tax returns, but the source of the data still matters.
- Information security rules. Many tax and accounting firms must keep a written information security programme and oversee their service providers under federal safeguards rules. Include your offshore provider in that programme.
For Singapore practices
- Professional ethics. ISCA’s Code of Professional Conduct and Ethics requires confidentiality of client information. Make sure your engagement terms cover outsourcing.
- PDPA. The Personal Data Protection Act’s Transfer Limitation Obligation applies when personal data leaves Singapore. Contracts with the overseas provider should require comparable protection.
What to put in place
- An engagement letter clause telling clients you use outside service providers.
- Client consent where your rules require it.
- A written confidentiality and data-handling agreement with the provider.
- Named access, MFA and a process to remove access quickly.
- A record of which provider staff can see which clients.
Our security page explains how we handle each of these.
Frequently asked questions
Do US CPA firms need client consent to use an offshore provider?
It depends on the work and the rules that apply. The AICPA Code addresses the use of third-party service providers, generally expecting firms to inform clients and to have a confidentiality agreement or client consent. Tax return information has its own federal rules, with specific consent requirements for disclosure to preparers outside the United States. Confirm the position with your own adviser.
What does Singapore's PDPA require?
When personal data is transferred outside Singapore, the PDPA requires the organisation to make sure the recipient protects it to a standard comparable to the PDPA, typically through contractual terms.
Sources
General information only, not legal, tax, audit or professional-conduct advice. Rules, standards and software features change, so confirm the position that applies to your firm before you act. See our disclaimer.
