Pub. 1 2019 Issue 5

13 nebraska society of cpas W W W . N E S C P A . O R G In order to ensure independence, the client must have a full and complete set of books and records. If you have the client’s only original documents, you are hosting and in violation of the independence standard. In order to not host, when calculating depreciation for your clients for example, you must provide them not only the journal entry but also the schedule and calculations so that their books and records are complete. This goes for any CPA-prepared documents. Portals for Exchange What about portals? The use of portals can come into question as potential hosting services. Portals are widely used and a very convenient way to exchange information in a controlled and secure environment. The AICPA is certainly not discouraging the use of portals. The concern arises when a portal itself becomes a place where documents are stored, not exchanged. In order to maintain independence, documents must be cleared from the portal after a reasonable period of time. The reasonable period of time is determined by professional judgement. Your professional judgement should consider feasibility for the client to get the information without undue hardship. This could be 60 days or more but should not exceed one year. Removing access to the portal or removing the documents from the portal eliminates Your professional judgement should consider feasibility for the client to get the information without undue hardship. the hosting situation. The client must take responsibility for retrieving things from the portal and for storing those records on their own servers. Importance of Independence Why is hosting so important? Because it is a threat to independence and there are no safeguards available to mitigate the threat. If you host your client’s documents, then you are not independent and cannot issue audit reports or any engagements that require independence. The only way to escape the issue is to avoid hosting and make sure your quality control standards are updated to address potential problems related to hosting. Consider updating your engagement letters, having discussions with clients about these changes, and updating your procedures when implementing the standard. The Bottom Line If you are crucial in a client’s disaster recovery plan or a backup provider for your client, you are hosting. If your clients don’t have the documents to support their financial statements, you are hosting. It is important to be aware of the new standards and put processes in place to maintain your independence. As the use of technology in our workplace continues to increase, we continue to evolve as CPAs to provide the highest level of services in the market. That means adapting to new standards that are designed to protect us, not restrict us. The AICPA has a variety of information available to help with implementation of this standard. Please check out the nonattest FAQs on the AICPA’s website. They also have a podcast and blog that address frequently asked questions. Finally, there are multiple Journal of Accountancy articles you can use to assist you in updating your processes to ensure you are not accidentally hosting client information. t Susan Stutzel is owner of S Stutzel CPA LLC in Tipton, Iowa, and serves on the Iowa Society of CPAs Board of Directors. Melisa Galasso, CPA is the founder and CEO of Galasso Learning Solutions LLC in Charlotte, NC. This article has been reprinted with permission of the Iowa Society of CPAs. STANDARD