Chapter 8 Nonattest Services

Chapter 8 — Nonattest services Which rules describe the nonattest services that my firm and I may or may not provide to attest clients? Nonattest services include accounting, tax, and consulting services that are not part of an attest engagement. Activities such as financial statement preparation, cash-to-accrual conversions, and reconciliations are considered outside the scope of the attest engagement and, therefore, constitute a nonattest service. Nonattest services specifically addressed in the rules are the following: • Advisory services • Appraisal, valuation, or actuarial services • Benefit plan administration services • Bookkeeping, payroll, and other disbursement services • Business risk consulting services • Corporate finance consulting services • Executive or employee recruiting services • Forensic accounting services • Hosting Services • Information systems design, implementation, or integration services • Internal audit services • Investment advisory or management services • Tax services In addition to considering the general standard and four guiding principles (mutual or conflicting interest with the audit client, position to audit their own work, acting as management or an employee of the audit client, and position of being an advocate for the audit client), the SEC rules generally prohibit a CPA from providing the following services to an SEC audit client during the audit and professional engagement period: • Bookkeeping and other services related to the client’s accounting records or financial statements • Financial information systems design and implementation • Appraisal or valuation services, service opinions, or contribution-in-kind reports • Actuarial services • Internal audit outsourcing services • Management functions • Human resources • Broker-dealer, investment adviser, or investment banking services • Legal services 31 • Expert services unrelated to the audit Under PCAOB rules, the following types of services are also subject to significant restrictions if the auditor provides them to an issuer during the audit and professional engagement period: • Aggressive or confidential tax transactions • Personal tax services provided to persons in financial reporting oversight roles If your firm performs nonattest services for an attest client, the independence rules impose limits on the nature and scope of the services your firm may provide. In other words, the extent to which your firm may perform certain tasks will be limited by the rules. Further, certain services will be prohibited in total (for example, serving as an attest client’s general counsel). These rules apply during the period of the professional engagement and the period covered by the financial statements (to which the attest services relate). However, if the firm provided the entity with prohibited nonattest services prior to the entity becoming an attest client, independence would not be impaired if the prohibited nonattest services related to periods prior to the period covered by the financial statements the firm is engaged to audit, and those prior period financial statements were audited by another firm (or, in the case of a review engagement, reviewed or audited by another firm). The SEC staff frequently asked questions (FAQ) document Office of the Chief Accountant: Application of the Commission’s Rules on Auditor Independence— Frequently Asked Questions, updated in June 2019, includes 11 questions related to non audit services provisions of the rule. FAQ No. 4 under section E addresses the question of whether a successor auditor who performed one of the prohibited services (bookkeeping, internal audit outsourcing, valuation services, actuarial services, financial information system design and implementation ) during the prior audit period would be independent of the SEC audit client during the current audit period. The FAQ states that if the services (a) relate solely to the prior period audited by the predecessor auditor and (b) were performed before the successor auditor was engaged to audit the current audit period, independence would not be impaired. However, independence would be impaired if the successor auditor is engaged to help design a client’s financial system in the prior audit period, and the system was not implemented until the current period FAQ No. 11 under section E addresses the question of whether an auditor, prior to being dismissed, is precluded from proposing on prohibited non-audit services to be provided after the audit has been completed and the professional engagement period has ended. The FAQ states that proposing on prohibited non-audit services while the firm is still the auditor heightens the threat, both in fact and appearance, of audit team members acquiescing to management in order to increase the firm’s chance of winning the prohibited non-audit services engagement. As such, independence could be impaired. This chapter does not discuss each of these services but, rather, focuses on a few for purposes of illustration. To see the full context of the rules, see the “Nonattest Services” subtopic (ET sec. 1.295) under the “Independence Rule” (ET sec. 1.200.001) and SEC Rule 2-01(c)(4). You also are encouraged to review Frequently Asked Questions: Performance of Nonattest Services developed by the Professional Ethics Division and the “Prohibited and Non-audit Services” section of Office of 32 the Chief Accountant: Application of the Commission’s Rules on Auditor Independence—Frequently Asked Questions developed by the SEC’s Office of the Chief Accountant. The AICPA rules require a member to comply with more restrictive independence provisions, if applicable, of certain regulators, such as state boards of accountancy and the SEC, the Government Accountability Office, and the Department of Labor. SEC and PCAOB rules require independence of an issuer that is an audit client and various affiliated entities of the client.2 Note: SEC rules also require a client’s audit committee (or equivalent) to preapprove all audit and nonaudit services provided by the firm to an issuer and the issuer’s consolidated entities. Proposals to provide tax or internal control-related services are subject to more extensive audit committee preapproval requirements under PCAOB Rule 3524, Audit Committee Pre-approval of Certain Tax Services, and Rule 3525, Audit Committee Pre-Approval of Non-audit Services Related to Internal Control Over Financial Reporting (AICPA, PCAOB Standards and Related Rules, Select Rules of the Board). PCAOB Rule 3526, Communication with Audit Committees Concerning Independence (AICPA, PCAOB Standards and Related Rules, Select Rules of the Board), superseded the PCAOB’s interim standard Independence Standards Board Independence Standard No. 1, Independence Discussions with Audit Committees, and its interpretations. Before accepting a new audit engagement, and annually thereafter, the auditor must describe in writing to the issuer’s audit committee all relationships between the auditor and client (including affiliates of both) that could reasonably be thought to bear on independence, discuss these matters with the audit committee, and document the substance of that discussion (effective September 30, 2008). AICPA general requirements General requirement 1 The “General Requirements for Performing Nonattest Services” interpretation (ET sec. 1.295.040) explains the main safeguards that need to be applied whenever members provide nonattest services to their attest clients. The first general requirement explains that the attest client must agree to assume certain responsibilities related to the nonattest services engagement in order for independence to be maintained. Therefore, prior to agreeing to perform any nonattest services for the attest client, the member must obtain the attest client’s agreement that the attest client will a. assume all management responsibilities as described in the “Management Responsibilities” interpretation (ET sec. 1.295.030) under the “Independence Rule.” 2 See Rule 2-01(f)(4) and (6). 33 b. oversee the service by designating an individual, preferably within senior management, who possesses suitable skill, knowledge, and experience. The member should assess and be satisfied that such individual understands the services to be performed sufficiently to oversee them but is not required to possess the expertise to perform or reperform the services. c. evaluate the adequacy and results of the services performed. d. accept responsibility for the results of the services. With regard to the preceding list, the member should be satisfied that the attest client designee will be able to meet this criteria, make an informed judgment on the results of the nonattest services, and be responsible for making all significant judgments and decisions that are the proper responsibility of management. The attest client also must be willing to commit the time and resources needed for the designee to fulfill these duties. General requirement 2 One of the key principles underlying the AICPA rules on nonattest services is that you may not assume management responsibilities or even appear to assume management responsibilities. Management responsibilities involve leading and directing an entity, including making significant decisions regarding the acquisition, deployment, and control of human, financial, physical, and intangible resources. Examples of management responsibilities can be found in the “Management Responsibilities” interpretation under the “Independence Rule.” General requirement 3 Before performing nonattest services, the firm should establish and document its understanding with the attest client regarding the following: • Objectives of the engagement • Services to be performed • Attest client’s acceptance of its responsibilities • Member’s responsibilities • Any limitations of the engagement The firm should document the understanding in the engagement letter, audit planning memo, or internal firm file. Note: Routine activities such as providing advice and responding to questions as part of the normal client-member relationship are exempt. Are preparing financial statements, cash-to-accrual conversions, and reconciliations considered nonattest services? The AICPA independence rules consider the preparation of financial statements, cash-to-accrual conversions, and reconciliations outside the scope of the attest engagement and, therefore, constitute a nonattest service. Such activities would not impair independence if the requirements of the interpretations of the “Nonattest Services” subtopic are met. 34 What are the rules concerning performing bookkeeping services for an attest client? The AICPA independence rules prohibit members from assuming management responsibilities in all circumstances. Accordingly, a member may provide bookkeeping services if the attest client oversees the services and, among other things, performs all management responsibilities in connection with the services. For example, if a member is engaged to provide bookkeeping services that will result in a set of financial statements, the attest client must • approve all account classifications. • provide source documents to the member so that the member can prepare journal entries. • take responsibility for the results of the member’s services (for example, financial statements). Note: Proposing adjusting entries to an attest client’s financial statements as part of the member’s audit, review, or compilation services is considered a normal part of those engagements and would not be considered performance of a nonattest service subject to the provisions of the “Nonattest Services” subtopic, provided the attest client reviews these entries and understands the effect on its financial statements and records any adjustments identified by the member that the attest client believes appropriate. Because of self-audit concerns, performing any type of bookkeeping service for an SEC audit client is considered to impair independence under SEC rules unless it is reasonable to expect that the results of the auditor’s services will not be subject to the firm’s audit procedures. The SEC considers there to be a rebuttable presumption that the results of these services would be subject to audit procedures; therefore, the firm must overcome the presumption to perform the service. This presumption of self-audit also applies to financial information design and implementation; appraisals, valuations, fairness opinions, or contribution-in-kind reports; actuarial-related advisory services; and internal audit outsourcing. May my firm provide internal audit services to an attest client? To perform internal audit assistance for an attest client and maintain independence, your firm may not, in effect, manage the internal audit activities of the attest client. For example, you and your firm may not • perform ongoing evaluations or control activities (for example, reviewing loan originations as part of the attest client’s approval process or reviewing customer credit information as part of the customer’s sales authorization process) that affect the execution of transactions or ensure that transactions are properly executed or accounted for, or both, or perform routine activities in connection with the attest client’s operating or production processes that are equivalent to those of an ongoing compliance or quality control function. • perform separate evaluations on the effectiveness of a significant control such that the member is, in effect, performing routine operations that are built into the attest client’s business process. 35 • have attest client management rely on the member’s work as the primary basis for the attest client’s assertions on the design or operating effectiveness of internal controls. • determine which, if any, recommendations for improving the internal control system should be implemented. • report to the board of directors or audit committee on behalf of management or the individual responsible for the internal audit function. • approve or be responsible for the overall internal audit work plan, including the determination of the internal audit risk and scope, project priorities, and frequency of performance of audit procedures. • be connected with the attest client as an employee or in any capacity equivalent to a member of management (for example, being listed as an employee in the attest client’s directories or other attest client publications, permitting himself or herself to be referred to by title or description as supervising or being in charge of the attest client’s internal audit function, or using the attest client’s letterhead or internal correspondence forms in communications). To maintain independence, the attest client must • designate an individual or individuals who possess suitable skill, knowledge, and experience, preferably within senior management, to oversee the internal audit function. • determine the scope, risk, and frequency of internal audit activities, including those the member will perform in providing the services. • evaluate the findings and results of internal audit activities, including those the member will perform in providing the services. • evaluate the adequacy of the audit procedures performed and findings resulting from the performance of those procedures. Internal audit services provided to an SEC audit client impair independence unless it is reasonable to expect that the results of the auditor’s services would not be subject to the firm’s audit procedures. May my firm provide valuation, appraisal, or actuarial services to an attest client? Your firm may not provide valuation, appraisal, or actuarial services to an attest client if • the results of the service would be material to the attest client’s financial statements. • the service involves a significant amount of subjectivity. For instance, your firm may not perform a valuation in connection with a business combination that would have a material effect on an attest client’s financial statements because that service involves 36 significant subjectivity (for example, setting the assumptions and selecting and applying the valuation methodology). Two limited exceptions apply to this rule. First, valuation, appraisal, or actuarial services performed for nonfinancial statement purposes may be provided if safeguards from the “General Requirements for Performing Nonattest Services” interpretation (ET sec. 1.295.040) are met. (For example, the attest client assigns an individual who is in a position to make an informed judgment on, and accept responsibility for, the results of the service to oversee the service.) In addition, your firm may provide an actuarial valuation of an attest client’s pension or postretirement liabilities because the results of the valuation would be reasonably consistent, regardless of who performs the valuation. The SEC prohibits your firm from providing valuation, appraisal, or any service involving a fairness opinion or contribution-in-kind report3 to an SEC audit client unless it is reasonable to expect that your firm would not audit the results of those services. The staff of the Professional Ethics Division issued nonauthoritative guidance (in the form of an frequently asked questions [FAQ] document) on the question of whether members could assist an attest client in applying FASB Accounting Standards Codification (ASC) 805, Business Combinations, or 350, Intangibles—Goodwill and Other, while maintaining independence. Specifically, the FAQ document addresses whether the following services would be considered to impair independence: • Providing the attest client advice on valuation methodologies and assumptions needed to perform the valuation • Providing advice on valuation templates, software, or other tools that allow the attest client to determine an appropriate value for acquired assets, goodwill, contingent consideration, and so on May my firm provide investment advisory services to an attest client? Here are examples of what you and your firm may do under the AICPA rules, provided the safeguards from the “General Requirements for Performing Nonattest Services” interpretation are met: • Make recommendations to an attest client about the allocation of funds to various asset classes • Analyze investment performance However, the AICPA rules also indicate that you and your firm may not do the following: • Make investment decisions for the attest client • Execute investment transactions • Take custody of an attest client’s assets 3 Per the SEC, fairness opinions and contribution-in-kind reports are opinions and reports in which your firm provides its opinion on the adequacy of consideration in a transaction. 37 May my firm design or implement an information system or provide network maintainance services for an attest client? Effective January 1, 2021, your firm may not design, or develop an attest client’s financial information system. In addition, the performance of ongoing functions, processes, or activities that involve management functions (e.g. operating an attest client’s network, supervising client personnel, operating or managing the attest client’s information technology helpdesk) is prohibited. As long as all of the requirements of the “Nonattest Services” subtopic (1.295) are met, your firm may install and configure a commercial off-the-shelf financial information system package for an attest client, including helping the attest client set up a chart of accounts and financial statement format. However, your firm may not customize (i.e. modify or enhance the features and functions in ways that go beyond the options provided by the third-party vendor) such software. Your firm may perform network maintenance, such as updating virus protection and applying certain updates and patches not developed by your firm, as long as the firm doesn’t have the responsibility to perform ongoing maintenance. Your firm also may provide advice, training, or instruction to the attest client’s employees on how to use an information system. Your firm may not, however, supervise the attest client’s employees in their day-to-day use of the system because that activity is a management responsibility. Your firm is not precluded from designing, developing, installing, or implementing an information system that is unrelated to the attest client’s financial information system as long as the requirements of the “Nonattest Services” subtopic (1.295) are met.4 Finally, your firm is precluded from performing interface services and data translation services for off-the-shelf financial information systems (unless the firm uses a third-party application for the services and the firm is not developing code for the application to work). SEC rules prohibit your firm from providing any service related to an SEC audit client’s financial information system design or implementation unless the results of your firm’s services would not be subject to audit procedures during an audit of the client’s financial statements. Your firm may do either of the following: 4 • Evaluate internal controls of a financial information system as it is being designed, implemented, or operated for the client by another service provider • Make recommendations on internal control matters to management in connection with a system design and implementation project being performed by another service provider • Note: If your audit client is an issuer, your firm must obtain preapproval for these and other internal control-related services, in accordance with PCAOB Rule 3525, Audit Committee Pre-Approval of Non-audit Services Related to Internal Control Over Financial Reporting (AICPA, PCAOB Standards and Related Rules, Select Rules of the Board). Frequently asked questions are available to assist members in understanding and implementing the IT services provisions. 38 May my firm provide hosting services to an attest client? Providing hosting services to an attest client after June 30, 2019 will impair your independence, as you would be maintaining internal control over the attest client’s data or records. Hosting services involve (1) acting as the sole host of an attest client’s financial or non-financial information system; (2) taking custody of or storing an attest client’s data or records whereby the attest client’s data or records would be incomplete and they would need to come to you to get that information; or (3) providing the attest client with electronic security or backup services for its data or records. Examples of hosting services include housing an attest client’s website, keeping your attest client’s general ledger on your servers or servers leased by your firm, or being your attest client’s disaster recovery provider. Your firm will not be considered to be providing hosting services just because it keeps copies of an attest client’s data or records to support a service you provided, nor would you be providing hosting services if you use general ledger software to facilitate the delivery of bookkeeping services if you and the client maintain separate instances of the software on your respective servers and you just pass updated financial information to the attest client. You would also not be considered to be providing hosting services if the attest client retains a third-party service provider to maintain its general ledger in a cloud-based platform and grants you access to this software to provide bookkeeping services. If you use a portal to electronically exchange data or records, to avoid inadvertently providing hosting services, it is recommended that you terminate access to the data or records in the portal within a reasonable period of time after the conclusion of the engagement. Another way to think about hosting services is if the client were to end the professional relationship with your firm and engage another firm to provide the same services. Would the former client need to come back to you in order for its books and records to be complete? If the answer is no, then your firm is not providing hosting services. If the answer is yes, then you may be providing hosting services. Additional examples are available in the Hosting Services interpretation. Also, the staff of the Professional Ethics Division issued nonauthoritative guidance (in the form of an FAQ document) that includes specific nonattest services questions and answers (including hosting). For additional information listen to episode 3, episode 4 and episode 12 of the Ethically Speaking podcast. May my firm provide an attest client with training services? The Nonattest Services FAQ document addresses the question of whether a member’s independence would be impaired if the member provided training to an attest client that is implementing changes to its financial reporting system or process. The FAQ concludes that a member’s independence would not be impaired if the attest client personnel are provided with a general understanding of the financial reporting system or process. It goes on to explain that if attest client personnel already have a general understanding, the member may provide more specific training to attest client personnel on how the system or process applies to the attest client’s specific circumstances. It cautions members that they should ensure that the training does not involve supervising attest client personnel in either the implementation or daily operation of the financial system or process or result in the member performing other management responsibilities, such as making operational decisions or implementing the internal controls necessary for the system or process to run effectively. 39 May my firm manage a project for an attest client? Responsibility for attest client projects, including deciding whether to proceed with a project, is management’s responsibility. Accordingly, if a member accepts responsibility for management of an attest client’s project, then the member’s independence would be impaired even if the project did not affect the attest client’s financial statements. However, if the member’s services were limited to providing assistance, advice, suggestions, or recommendations regarding matters that are within the member’s areas of knowledge or experience, independence would not be impaired. May my firm assist an attest client with implementing a new accounting standard? New accounting standards may require changes that are difficult for your attest clients to understand and, as such, correspondence and discussions with clients may go outside the routine activities provided when providing attest services. Some examples of routine activities include discussions with the attest client about management’s selection and application of accounting standards or policies and financial statement disclosure requirements, the appropriateness of methods used in determining accounting and financial reporting, adjusting entries that the member has prepared or proposed for management’s considerations, or the form or content of the financial statements. When assessing independence and assisting an attest client with implementing a new standard, you would want to consider whether the firm’s involvement becomes so extensive that the firm may need to consider a separate service subject to the requirements for nonattest services. Some considerations may include the significance of the new accounting standard, the extent of the difference from the previous standard, or the complexity of the new standard. If your firm currently provides allowable non-attest services, you should also consider the cumulative effect on independence when providing multiple nonattest services. Before agreeing to perform nonattest services, you should evaluate whether the performance of multiple nonattest services by your firm in aggregate would create a significant threat to the firm’s independence that cannot be reduced to an acceptable level with the application of safeguards. Your firm should also be cautious of crossing the line that may lead to providing prohibited nonattest services. Your firm may explain the steps needed to achieve the principles of the new standard, but the attest client must accept responsibility for the work performed to implement the standard. Management participation and self-review threats seem to be the most prevalent threats when assisting clients with implementing new accounting standards, but there could be others. Your firm should apply the safeguards in the “General Requirements for Performing Nonattest Services” interpretation. For additional information listen to episode 9 and episode 10 of the Ethically Speaking podcast. What about cyber security services? Firms are often asked to assist their clients with cybersecurity services. This type of service is often considered to be an advisory service depending on the specifics of the engagement. Practitioners would need to follow the guidance in the “Advisory Services” interpretation (ET sec. 1.295.105). The staff of the Professional Ethics Division issued nonauthoritative guidance (in the form of an FAQ document) that includes specific nonattest services questions and answers (including sybersecurity services). 40