Security, consent and supervision when you outsource tax work

Preparer of record

Your firm stays the preparer of record for every return support staff work on. Your preparers review the work, your signer signs, and your firm files and answers to the client and the IRS. Engagement letters and internal procedures should reflect who does what.

Client consent under section 7216

Internal Revenue Code section 7216 and the regulations at Treas. Reg. section 301.7216 restrict how tax return preparers disclose and use taxpayer return information. The regulations allow some disclosures between preparers working on a return, but they set extra conditions, including taxpayer consent in some cases, depending on the arrangement and where the work is performed. Revenue Procedure 2013-14 describes the required format and content of consents for individual (Form 1040 series) taxpayers.

Practical questions to settle with your counsel:

• Where will the work be performed, and by whom?
• Does your arrangement require written client consent, and in what form?
• How will consent be collected and stored, and what happens for clients who decline?
• Does your engagement letter need to disclose the use of outside support?

PTINs

IRS rules require a Preparer Tax Identification Number for anyone who, for compensation, prepares or assists in preparing all or substantially all of a federal tax return. Whether a given support role needs one depends on the work involved. Ask the provider which roles on your files hold a current PTIN, and decide with your firm's guidance which tasks require one. The IRS explains the requirement on its tax professionals pages.

Circular 230 and supervision

Treasury Department Circular No. 230 (31 CFR Part 10) sets standards for CPAs, attorneys, enrolled agents and others who practise before the IRS, including due diligence and responsibility for procedures within a firm. Outside support works under your firm's supervision and review in the same way as in-house staff. Read the current text in the IRS publication of Circular 230.

Data security and your written plan

The FTC Safeguards Rule treats tax preparers as financial institutions that must keep a written information security program. IRS Publication 4557 covers safeguarding taxpayer data, and Publication 5708 walks through creating a written information security plan. Outside support should fit inside your plan. Questions to ask a provider:

• Does work happen only inside your firm's systems (remote desktop or hosted software), with no local copies?
• Does each person have an individual account with multi-factor sign-in, and is access logged?
• Are devices encrypted, patched and locked down, with removable storage and printing disabled?
• Who has access, how are they screened, and do they sign confidentiality terms?
• How quickly is access removed when someone leaves the account or the engagement ends?
• How would a suspected data incident be reported to your firm, and how fast?

What to put in writing

• Scope of tasks and the tasks support staff must not do
• Confidentiality and data-handling terms consistent with your security plan
• Where the work is performed
• Incident notification and cooperation
• Return or destruction of any data at the end of the engagement

Rules and IRS guidance change. Check the current versions of the sources linked above before relying on them.