Security, consent and supervision when you outsource tax work

Your firm stays the preparer of record

Your firm remains the preparer of record for every return support staff work on. Your preparers review the work, your signer signs, and your firm files and answers to the client and the IRS. Engagement letters and internal procedures should say who does what.

Section 7216 consent for outsourced tax preparation

Internal Revenue Code section 7216 and the regulations at Treas. Reg. section 301.7216 restrict how tax return preparers disclose and use taxpayer return information. The regulations allow some disclosures between preparers working on a return, but they add conditions, including taxpayer consent in some cases, depending on the arrangement and where the work is performed. Revenue Procedure 2013-14 sets out the required format and content of consents for individual (Form 1040 series) taxpayers.

Questions to settle with your counsel:

• Where will the work be performed, and by whom?
• Does your arrangement require written client consent, and in what form?
• How will consent be collected and stored, and what happens for clients who decline?
• Does your engagement letter need to disclose the use of outside support?

Do outsourced tax support staff need a PTIN?

IRS rules require a Preparer Tax Identification Number for anyone who, for compensation, prepares or assists in preparing all or substantially all of a federal tax return. Whether a given support role needs one depends on the work involved. Ask the provider which roles on your files hold a current PTIN, and decide with your firm's guidance which tasks require one. The IRS explains the requirement on its tax professionals pages. Tasks such as document intake and data entry are where this question comes up most.

Circular 230 and supervising outside staff

Treasury Department Circular No. 230 (31 CFR Part 10) sets standards for CPAs, attorneys, enrolled agents and others who practise before the IRS, including due diligence and responsibility for procedures within a firm. Outside support works under your firm's supervision and review in the same way in-house staff do. The current text is in the IRS publication of Circular 230.

The FTC Safeguards Rule and your written security plan

The FTC Safeguards Rule treats tax preparers as financial institutions that must keep a written information security program. IRS Publication 4557 covers safeguarding taxpayer data, and Publication 5708 walks through creating a written information security plan. Outside support should fit inside that plan. Questions to ask a provider:

• Does work happen only inside your firm's systems (remote desktop or hosted software), with no local copies?
• Does each person have an individual account with multi-factor sign-in, and is access logged?
• Are devices encrypted, patched and locked down, with removable storage and printing disabled?
• Who has access, how are they screened, and do they sign confidentiality terms?
• How quickly is access removed when someone leaves the account or the engagement ends?
• How would a suspected data incident be reported to your firm, and how fast?

What to put in a tax outsourcing agreement

• Scope of tasks, and the tasks support staff must not do
• Confidentiality and data-handling terms consistent with your security plan
• Where the work is performed
• Incident notification and cooperation
• Return or destruction of any data at the end of the engagement

Common compliance questions

Rules and IRS guidance change. Check the current versions of the sources linked above before relying on them.