When a CPA firm undergoes an ownership change, the question of who should retain the existing engagement working paper files and work product files is often raised. This may occur, for example, when:
- One or more firm principals leave one firm to join another existing firm or to start a new firm. In such situations, they may take some or all of the clients they serviced with them to their new firm. These individuals will want to take the working papers with them because they may need access to historical information and data about the clients to continue to service them effectively.
- A sole practitioner sells his practice to another firm. The buyer wants access to the existing working papers to ensure continuity of service to the clients.
Before addressing the issue of who should retain custody of original working papers, three points need to be stated.
- The firm that serviced the client (hereafter, predecessor firm) owns the working papers and related files, not the individual who brought the client to the firm, performed the work, or served as the primary client contact.
- The predecessor firm is responsible for maintaining the confidentiality of client information in its working papers and files.
- In the event of a malpractice claim or a professional or regulatory inquiry, the predecessor firm is responsible for maintaining the original working papers, and having access to them will be critical in effectively responding to such claims or inquiries.
From a risk control perspective, the recommended practice in these circumstances is for the predecessor firm to retain possession of the original working papers in accordance with its record retention policy. If few clients will be transferred to the new firm (hereafter, successor firm), paper copies of the relevant working papers can be provided to the successor firm upon receipt of written authorization from the clients to release this confidential information and a signed acknowledgment letter from the successor firm restricting the use of the working papers (AU §315.25). Although the sample successor auditor acknowledgement letter pertains to audit engagements, CNA encourages providers of other accounting professional services to request a similar acknowledgment letter from the successor firm. If a large number of clients will be affected, consider sending an authorization letter to each affected client with a stamped return envelope to facilitate the transfer of client information. See the sample authorization letter at the end of this article that could be requested from those clients which will be serviced by the successor firm in the future.
If tax clients will be affected, these authorization letters must conform to the written consent requirements set forth in Treas. Reg. Section 301.7216-3 and Revenue Procedure 2008-35. Federal tax law requires that tax preparers obtain written consent from each taxpayer for any disclosure or use of federal income tax return information with limited exceptions, and specifies requirements for the form and content of the written consent. Firms that render services to health care providers have additional obligations to protect individually identifiable health information of their patients contained in working papers (typically billing records) under the Health Insurance Portability and Accountability Act of 1996 (HIPAA). Other federal and state consumer privacy laws also must be considered prior to providing confidential client information to a successor firm. Consult with competent legal counsel on these issues, as this may necessitate changes to the language included in consent authorization letters provided to clients.
In the event the practice (or a portion thereof) is being sold, consider the cost of this activity prior to reaching a final agreement on the terms of the sale. In addition, the separation or sale agreement between the predecessor firm and departing individuals should describe any file transfer agreements and address responsibility for performing the copying and paying related costs. Copying of working papers, both paper and electronic, should always be done under the control and supervision of a continuing employee of the predecessor firm.
If the working papers are in electronic format, providing copies may be less expensive and cumbersome. However, there are still certain considerations that should be addressed, e.g., how to segregate electronic client records from the firm’s working papers. Consult with an information technology specialist with knowledge of the software being used prior to providing backup files of client records and relevant firm working papers. It is critical to protect the integrity of data maintained or created by the predecessor firm and to ensure that the data is not altered either during or subsequent to the transfer to the successor firm. The predecessor firm should maintain control over the original data files, and release only backup files that are locked from editing, i.e., read only. This is critical to both maintaining the integrity of data provided, and preventing other parties from viewing embedded metadata.1
In rare instances, continuing access to original working papers by a successor firm may be necessary for tax return preparation engagements but not for audit, attest and consulting engagements. If the predecessor firm decides to release either the original working papers or electronic backup copies to the successor firm, the predecessor firm should take steps to maintain the integrity of its working paper files by maintaining its own copies. It is essential that the separation or sale agreement between the parties specifically address the responsibilities of the successor firm to maintain and make the working paper files available to the predecessor firm.
If the successor firm will take possession of any original working papers, the predecessor firm's attorney should consider including the following provisions in the agreement:
- The predecessor firm is the exclusive and continuing owner of working papers generated by the predecessor firm. The successor firm will maintain custody of the working papers exclusively for the purpose of providing professional services to the client, and in accordance with all other terms of the agreement.
- The successor firm will maintain the working papers in accordance with the confidentiality requirements of AICPA professional standards, applicable board of accountancy rules and regulations, and other applicable laws, rules and regulations, including those applicable to the subject clients.
- The successor firm will maintain the working paper files in their current state and format. Nothing will be added or removed. Any documentation prepared by the successor firm will be maintained separately. The successor firm will maintain copies of all communications from the predecessor firm regarding the working papers, including a detailed list of the working papers released to the successor firm. This serves as important evidence regarding the predecessor firm’s control over working papers not in its possession.
- The successor firm will maintain and dispose of the working papers in accordance with the predecessor firm’s record retention policy. The predecessor firm’s record retention policy should be attached as an exhibit to the agreement.
- The successor firm will immediately notify the predecessor firm in writing if any persons or entities, including the client and their representatives, request access to or copies of the working papers of the predecessor firm, whether by subpoena or otherwise.
- The successor firm will not release the working papers of the predecessor firm (or copies thereof) to any party without the written authorization of the predecessor firm, unless required by law. This prohibition does not apply to providing a client with copies of work product previously produced for the client and provided to the client by the predecessor firm.
- The successor firm will give the predecessor firm unrestricted access to the working papers upon their written request. They also will return original files as requested by the predecessor firm that may be needed to respond to any subpoena, potential or actual claim or lawsuit, criminal, civil or regulatory investigation, professional inquiry, peer review, or other similar inquiry or investigation.
- The successor firm will indemnify the predecessor firm, its partners, officers, and assigns and hold them harmless with respect to any and all costs, claims, lawsuits, fines, and penalties arising from:
- the successor firm’s failure to provide the predecessor firm with unrestricted access to its original working papers in a timely manner, provided that the predecessor firm or its legal representatives first submitted a written request for such access to the successor firm, and
- the successor firm’s failure to maintain the predecessor firm’s working papers in the original state and format, and
- a breach of privacy that may have resulted in the unauthorized disclosure of confidential client information to third parties.
- If the successor firm ceases to practice, merges, or sells its practice, it will immediately notify the predecessor firm in writing of this and return the predecessor firm’s working paper files to the predecessor firm. If the firm acquiring or merging with the successor firm requests the subject working papers, it should be required to sign a new agreement with the original firm about maintaining working paper files prior to being provided with these files. If the original firm no longer exists, the successor firm should maintain the working paper files in accordance with its own record retention policy.
- If any portion of the predecessor firm’s working papers is lost, damaged, or destroyed, or if the successor firm concludes that a breach of privacy regarding confidential client information contained in the working papers may have occurred, the successor firm will promptly notify the predecessor firm of this in writing, and to the extent possible, identify both the working papers affected and the confidential client information affected.
1Metadata is vital information hidden within an electronic file about the file data. By accessing an electronic file’s metadata, a user can access a wealth of background and other demographic information about the file. Some examples of metadata include the file’s name, location, format, size and type and details of changes made to the file over time, as well as information describing how, when, and by whom the file was created, accessed, and modified and the dates and times of each.
Addressing the preceding issues on a timely basis is an important risk control activity for the predecessor firm, and is important to the successor firm in providing continuing client service. Failing to plan for the day when access to original working papers is necessary for a successor firm could be damaging to the predecessor firm in the event of a professional or regulatory inquiry, or a malpractice claim.
Sample Client Authorization for Working Paper File Access/Copying (Other than Income Tax Clients) (Predecessor Firm Letterhead)
Date:
To: ABC Client
Dear Mr. & Mrs. ABC:
It has been a privilege to provide ___________________(e.g. bookkeeping) services to you over the last several years. Thank you for the opportunity to work with you.
Effective (insert date) XYZ CPA firm has purchased certain assets of our firm, which include the right to provide professional services to you and/or your company. In connection with this transaction, Mr. XXXX will be terminating his employment relationship with our firm.
As certified public accountants, we have a duty to maintain client confidentiality. To the extent you wish to grant permission to our firm to provide copies of our relevant working papers relating to your engagements to XYZ CPA firm and Mr. XXXX, please sign the authorization on the enclosed copy of this letter and return the copy to us by (insert date) in the enclosed addressed envelope.2
Sincerely,
Predecessor ------------------------------------------------
To: Predecessor, CPAs:
We are engaging XYZ CPAs to provide services to us in the future. Please provide them with copies of your relevant working papers to facilitate the transition to this successor firm.
____________________________________________________________
Client Signature Date
2Prior to using this sample client authorization letter, CPAs should become familiar with federal and state laws and regulations to ensure compliance with specific regulations concerning consent to disclose confidential client information.
Executive Summary:
- When there is a change in ownership at a firm, it may be necessary to provide the successor firm continuing access to the predecessor firm’s working paper files. In most instances, the recommended method of transferring the requested files is for the predecessor firm to maintain possession of the original files and to provide copies to the successor firm.
- Prior to releasing any working paper files (or copies thereof), the predecessor firm must obtain written authorization from affected clients to release their confidential information. If this includes federal income tax records, the authorization must comply with the consent for disclosure requirements in IRC Sec 7216. The predecessor firm should also consider obtaining an acknowledgement letter from the successor firm restricting use of the working paper files.
- If it is necessary for the predecessor firm to release its original working paper files to the successor firm, the predecessor firm should take steps to ensure the integrity of those working paper files. These steps include maintaining copies as well as including language in the sale or separation agreement with the successor firm clearly outlining the successor firm’s responsibility to safeguard the working paper files in their original format.
- If the working paper files are in an electronic format, the predecessor firm should take steps to safeguard the integrity of the data and to segregate client records from firm working papers. Steps to consider include working with an information technology specialist and/or the software provider to understand how the system works, releasing only back-up files in a read-only mode.
Resource List:
- Retaining Engagement Records and Responding to Requests for Records Guide is available to AICPA Professional Liability Insurance Program policyholders at http://www.cpai.com.
- Sample disclosure and use consent forms, as well as resources and guidance on I.R.C. §7216, are available to members of the AICPA Tax Section at http://tax.aicpa.org/.
June 2010
By Accountants Professional Liability Risk Control, CNA, 333 South Wabash Avenue, 39S, Chicago, IL 60604.
This information is produced and presented by CNA, which is solely responsible for its content.
The purpose of this article is to provide information, rather than advice or opinion. It is accurate to the best of the authors’ knowledge as of the date of the article. Accordingly, this article should not be viewed as a substitute for the guidance and recommendations of a retained professional. In addition, CNA does not endorse any coverages, systems, processes or protocols addressed herein unless they are produced or created by CNA. CNA recommends consultation with competent legal counsel and/or other professional advisors before applying this material in any particular factual situations.
Any references to non-CNA Web sites are provided solely for convenience, and CNA disclaims any responsibility with respect to such Web sites.
To the extent this article contains any examples, please note that they are for illustrative purposes only and any similarity to actual individuals, entities, places or situations is unintentional and purely coincidental. In addition, any examples are not intended to establish any standards of care, to serve as legal advice appropriate for any particular factual situations, or to provide an acknowledgement that any given factual situation is covered under any CNA insurance policy. Please remember that only the relevant insurance policy can provide the actual terms, coverages, amounts, conditions and exclusions for an insured. All CNA products and services may not be available in all states and may be subject to change without notice.
IRS Circular 230 Notice: The discussion of U.S. federal tax law and references to any resources in this material are not intended to: (a) be used or relied upon by any taxpayer for the purpose of avoiding any federal tax penalties; (b) promote, market or recommend any products and/or services except to the extent expressly stated otherwise; or (c) be considered except in consultation with a qualified independent tax advisor who can address a taxpayer’s particular circumstances.
Continental Casualty Company, one of the CNA insurance companies, is the underwriter of the AICPA Professional Liability Insurance Program.
CNA is a registered trade mark of CNA Financial Corporation. Copyright © 2010 CNA. All rights reserved.