Many CPA firms are therefore finding themselves potentially providing hosting services without intending to do so. For example, CPA firms need to tread carefully to ensure that they fully understand the nuances that give rise to stepping into the role of providing "hosting services" when rendering tax services to attest clients.
Although not meant to be all-inclusive, the following safeguards are some best practices to consider:
- CPA firms need to ensure that all documentation that makes up a client's books and records are made available to attest clients for the tax services provided to them. Firms would impair their independence if their attest clients were to rely on the firm to retain all, or even just a portion of, their tax records beyond a reasonable period of time after the engagement concludes.
- To avoid client "expectation gaps," CAMICO strongly encourages firms to update their tax engagement letters with attest clients to address the limitations on the firm related to providing hosting services, and to clarify the clients’ responsibilities to retain and maintain their own records.
- CPA firms should also review and update, if necessary, their client portal agreements to avoid the perception of providing “hosting services." The portal agreement should specify that the firm will terminate the client’s access to data or records in the portal within a "period of time established by the firm" after the conclusion of the engagement.
- Record retention and destruction policies should also be updated to clarify the role of the firm as it relates to providing hosting services to clients.