Offshoring risk management

Outsourcing Question: Our firm understands that the IRS has stringent requirements for disclosure and consent when offshoring tax preparation work for individual 1040 filers, but our firm is considering offshoring tax preparation work for non-1040 filers to another country. What are the client disclosure/consent requirements under applicable IRS requirements?

 
Answer: According to Treas. Reg. § 301.7216-3(a)(3)(iii), “…a consent to disclose or use tax return information with respect to a taxpayer not filing a return in the Form 1040 series may be in any format, including an engagement letter to a client, as long as the consent complies with the requirements of § 301.7216-3(a)(3)(i).” Please note that the engagement letter must be signed for the consent to be valid. 

Here is a link to §7216 FAQs found on the IRS website: Section 7216 Frequently Asked Questions. 

FAQ 14 and 15 specifically state: 

Q14: What are the special rules for disclosing tax return information outside the United States?

A14: Disclosing tax return information to another tax return preparer that is assisting in the preparation of the return or providing auxiliary services in connection with preparing the return generally does not require the consent of the taxpayer. However, if the other tax return preparer is located outside the United States or any territory or possession of the United States, the taxpayer must agree and sign a form consenting to the disclosure. See Revenue Procedure 2013-14, section 5.04(e) for specific language that must be included in the consent form. If the tax return information to be disclosed includes social security numbers, see Q15.

Q15: What are the special rules for disclosing social security numbers outside the United States?

A15: Generally, tax return preparers may not obtain consents to disclose social security numbers to tax return preparers located outside the United States or any territory or possession of the United States. If social security numbers are included in documents for which the tax return preparer has obtained the consent of the taxpayer to disclose, the tax return preparer must redact or mask any social security number before disclosing the tax return information to a return preparer outside the United States. There is an exception. Social security numbers may be disclosed to tax return preparers located outside the United States if taxpayer consent is obtained and both the sending and receiving tax return preparers maintain adequate data protection safeguards defined in Revenue Procedure 2013-14, section 5.07. See also Revenue Procedure 2013-14, section 5.04(e)(ii) for specific language that must be included in the consent form.

Question: Our firm is considering offshoring non-tax work (bookkeeping, audit services, etc.) to another country. Since IRS rules don’t apply, is our firm required to disclose the relationship to clients and obtain written consent for releasing confidential client information outside of the U.S.?

Answer: At a minimum the firm will need to comply with applicable professional and regulatory standards (e.g., AICPA, state boards of accountancy, Securities and Exchange Commission (SEC), General Accountability Office (GAO), etc.) that may be applicable when outsourcing confidential information outside of the U.S. From a risk management best practice perspective, CAMICO strongly encourages firms to be transparent and obtain written client consent for all engagements when outsourcing out of the U.S., even if not required. We believe this “defensive documentation” is an important risk mitigation step to minimize the potential liability risks associated with clients who may later allege that they were harmed by not being fully informed of the nature of the disclosures of confidential client information to third parties outside of the U.S. 

Question: Our firm is considering leasing A&A staff from a leasing agency located offshore. The agency’s contract details a non-disclosure agreement with the talent, but they will not provide us a copy of that agreement. Should we have this person sign something on our end?

Answer: Yes, CAMICO recommends obtaining written assurances from the leased employee assisting you with your engagements that they, and any other contractors they work with, will adhere to the AICPA’s Confidential Client Information Rule.
 
Question: We have an employee in our tax department who is temporarily relocating out of the country to help care for an elderly parent and they would like to continue to work for our firm during this period. Should we have the employee sign and acknowledge an agreement that they will limit their access to only those clients who have specifically consented to allow the employee access to work on their tax returns while located out of the country, or do we need to bifurcate our tax file server to limit the employee’s access so as not to violate §7216 and the interpretations provided by the IRS of §7216?

Answer:  CAMICO’s guidance is limited in this situation, as we are not able to authoritatively opine on what the IRS would deem as “disclosure,” nor what would be considered by the IRS as sufficient safeguards for this specific fact pattern. 

Under the IRS’s FAQs, Q6 broadly defines disclosure as the “act of making tax return information known” to “any person” in “any manner whatsoever.” In this fact pattern, even if the “any person” (employee) has agreed in writing to limit opening only those files they have been assigned, the IRS may interpret “in any manner whatsoever” very broadly in the event of an investigation resulting in a “disclosure” if the employee were to have access to the entire tax file program. 

Given the IRS’s broad definition of what would deem to be a disclosure, and the potential exposure to criminal penalties, CAMICO strongly encourages firms to bifurcate their tax file server to specifically parse out the clients that have in fact consented to the disclosure out of an abundance of caution. For firms who desire to take a different approach in these situations, such as having the employee sign and acknowledge that they will only access a specific list of clients from the firm’s tax file server, CAMICO recommends a firm seek the services of an attorney who represents tax practitioners, particularly before the Office of Professional Responsibility, to give perspective and opine on the appropriateness of such an approach to satisfy IRC §7216 requirements.