The Ethical Dilemmas of Outsourcing

Outsourcing the preparation of income tax returns overseas raises significant ethical issues. Reports of the scope and size of the outsourcing market vary greatly, but the largest outsourcing companies claim that thousands of returns were processed during the 2003 tax season. Estimates for the 2004 season indicate the total may now be well into the hundreds of thousands. Outsource Partners International (OPI) reports preparing 10,000 U.S. tax returns last year. SurePrep claimsto have processed 6,000 returns last year and expects to process as many as 30,000 by April 2004. A statement on their website sums up their outsourcing pitch to CPAs:

What if you could prepare a thousand more tax returns without adding even one more staff member? And what if you could prepare those returns for up to 50 percent less than what it costs you right now? You can with SurePrep. And with virtually unlimited ability to prepare and process returns, you can increase volume, multiply profits and grow your practice. (www.sureprep.com)

SurePrep electronically transmits tax information to preparers in India. Confidentiality of personal and financial data is a critical issue, as is the preparers’ competence and skills. SurePrep responds to the latter concern by pointing out that Indian preparers are well educated, speak English, and are trained in U.S. tax law. SurePrep’s website provides the following advice to CPAs concerned about what to tell clients:

You might tell your tax clients that while SurePrep accountants will prepare the tax returns, our role is transparent to the process from your clients’ perspective. Your firm is responsible for reviewing and approving the return prior to delivery.

The outsourcing process is similar among other service providers. The U.S. firm still interviews the client and collects all the information, which is encrypted and transmitted electronically to a secure server that the foreign accountant can access. Client source documents, including W-2s, 1099s, and K-1s, are also scanned for transmission. These electronic documents, and other relevant tax files, are uploaded to a data center in the United States; the outsourcing company accesses the documents using a web browser and organizes them into a web-based file. In India, Chartered Accountants (their equivalent to our CPA) access the files and prepare the tax returns using the firm’s preferred tax software package. Once it is completed, the U.S. firm reviews the return and is responsible for its accuracy.

CPA firms claim that it is increasingly difficult to find qualified part-time staff during tax season, and that there are significant cost savings from outsourcing. Various Indian websites claim that tax returns can be processed in India for 50% of the cost in the United States (e.g., see www.thehindubusinessline.com).

Four rules in the AICPA Code of Professional Conduct are of particular relevance to tax outsourcing: Rule 102, Integrity and Objectivity; Rule 201, General Standards; Rule 202, Compliance with Standards; and Rule 301, Confidential Client Information (AICPA Professional Standards Volume II; AICPA, New York, 2003). These rules—and whether they are followed—are central to the discussion of ethical concerns.

Rule 102: Integrity and Objectivity. Rule 102 provides that “In the performance of any professional service, a member shall maintain objectivity and integrity, shall be free of conflicts of interest, and shall not knowingly misrepresent facts or subordinate his or her judgment to others.” According to the Code’s Principle of Integrity, a member should be “honest and candid within the constraints of client confidentiality.” Two major outsourcing concerns are whether a client is informed that tax information is being transmitted overseas electronically, and that the return will be prepared by a non-U.S. CPA.

Honesty in communications is at the ethical core of trustworthiness, points out Michael Josephson, president of the Josephson Institute of Ethics. This includes expressing the truth as we know it, and not doing so in a misleading or deceiving way. In trusted relationships, honesty imposes the ethical obligation to volunteer information that another person needs to know (Josephson, Michael, Making Ethical Decisions; Josephson Institute of Ethics, Los Angeles, 2002).

From an ethical perspective, a client must be informed that personal and tax information is being transmitted electronically overseas for processing. The client has the right to opt out of the arrangement, and must be afforded the opportunity to do so. The only reason not to inform the client is because the CPA does not want the client to know. Nondisclosure is sometimes rationalized by saying that there is no need to inform the client, as long as the CPA maintains control over the source documents, and reviews and approves the return prepared by the overseas accountant. This is unacceptable from an ethical point of view. People who strive for honesty in communications disclose all the information that another party has a need or right to know.

Rules 201 and 202: Standards of Performance. Rule 201 includes two principles particularly important to the outsourcing issue: First, CPAs must exercise due care while performing professional services. Second, CPAs should adequately plan and supervise the performance of professional services.

It is difficult to see how these ethical obligations can be met when tax processing takes place overseas and without the direct supervision of the U.S. CPA. While some may argue that the review and approval process is sufficient to meet these rules’ technical requirements, it does not satisfy the spirit of the rules. Indeed, Interpretation 201-1 states that competence entails the ability to supervise staff and the quality of work performed, including evaluating “knowledge of the profession’s standards, techniques, and the technical subject matter involved, and the capability to exercise sound judgment in applying such knowledge in the performance of professional services.” Absent on-site supervision, a CPA must rely on the outsourcer for assurances that the competence standard is met; there is no reasonable way for the U.S. CPA to effectively supervise the overseas preparers.

Rule 202 requires a CPA to comply with the technical standards of services performed. Those that process tax information must follow the Statements of Standards for Tax Services. While these statements primarily apply to taking tax positions rather than to preparing returns, there are procedural matters that could arise in outsourcing, including instances when tax information appears to be incorrect, incomplete, or inconsistent. It is essential that the U.S. CPA evaluate the accuracy and completeness of the tax information before transmitting it to the outsourcer for processing overseas. Despite this evaluation, it is more difficult to address any issues that may arise when outsourced preparers are employed.

Rule 301: Confidentiality. Privacy of personal information and possible identity theft are the ethical issues that have received the most scrutiny. These issues came to the fore in the medical profession when it was disclosed on October 22, 2003, that a Pakistani transcriber of medical information threatened a medical center in San Francisco with posting patients’ medical records online unless she received money she alleged was her due (www.sfgate.com). Simply put, she was blackmailing the center to chase down a third party—yet another outsourcer—who she said owed her money. While the immediate threat has been resolved, the news article reports the center’s concern that there is no evidence that the transcriber actually destroyed the records as promised.

The implications for CPAs that outsource tax information are significant, especially if the client is unaware that Social Security numbers and financial data, including bank and brokerage account numbers, have traveled overseas. Rule 301 of the Code requires that “a member in public practice shall not disclose any confidential client information without the specific consent of the client.” The argument that confidential data is encrypted and that the CPA controls the source documents is a rationalization, and insufficient to satisfy the spirit of this rule. As the Pakistani transcriber case demonstrates, this argument does not hold water; the case came to a resolution only when her monetary demands were at least partially met. CPA clients have an ethical claim to know whether their confidential information is being sent to another party, whatever the mode of transmission. This is an especially significant concern when such parties reside outside the reach of U.S. legal jurisdiction.

The Texas Society of CPAs’ Executive Board raised ethical issues about the potential dangers of outsourcing in a November 11, 2003, letter to S. Scott Voynich, Chairman of the AICPA Board of Directors. In the letter, Nita J. Clyde, Texas CPA Society Board Chairman, identifies as concerns “the loss of security of client information sent electronically, the privacy of personal and financial information of clients and the potential loss of control of data and information when sent anywhere outside the firm.” The Texas Board also debated the CPA’s obligation to disclose the outsourcing practice to a client, and how the Code of Ethics might apply in this area. Moreover, Clyde questions whether current laws related to privacy, such as the Gramm-Leach-Bliley Act, might affect the outsourcing of tax information (www.accountingweb.com). They sought guidance from the AICPA on these issues.

In his response, Voynich cites Ethics Ruling 1 under Rule 301, “Computer Processing of Clients’ Returns,” to demonstrate how the Code addresses the issue of members using the services of an outside service bureau to process clients’ tax returns. He points out that the member has an obligation to ensure that the client’s information remains confidential by exercising due care, “which should include discussing the specific controls in place with the outsourcing provider to safeguard the client’s information and being satisfied that such controls are adequate.” Where client information is transmitted over the Internet, Voynich says that “the member should inquire as to specific security measures in place such as encryption techniques and use of proprietary lines.” In addition, controls should be “in place to ensure that those with access to the client’s information are bound by nondisclosure agreements and cannot misuse the clients’ financial information (e.g., no ability to download, print, scan or copy the clients’ financial data).”

Voynich also emphasizes the obligation to ensure that services are performed with professional competence and due care, including the adequate supervision and review of all “work performed by the outsourcing provider and [the obligation] to take full responsibility for the accuracy and completeness of the services performed.” He states that the AICPA’s Professional Ethics Executive Committee considered the issue and decided not to change the ethics rules, although he asked the AICPA staff to publish guidance for members on their responsibilities when using outsourcing in public practice [Editor’s Note: Now available at www.aicpa.org].

Voynich’s response states that “There is no specific ethical requirement that the member disclose to the client that they are using the services of an outsourcing provider.” The ethical issue is not whether a specific disclosure requirement exists in the rules, it is whether the client is deprived of knowledge about the outsourcing. It is reasonable to assume that most clients would desire to know that their records are being outsourced. Some might not care, especially if cost savings were passed along to them as lower fees, but they would at least have a choice in the matter.

Ordinarily, outsourcing work requires a U.S. CPA firm to issue privacy notices to its clients, giving them the opportunity to opt out; there would also be stringent limitations on information disclosure to outsource providers. However, Voynich cites the specific exemption to the notice and opt-out requirements in the Gramm-Leach-Bliley Act for “processing and servicing transactions.” This is not addressing the issue; it is avoiding it.

Voynich’s statements illustrate a fallacy about ethics: that, if an action is legal and permissible, it is proper. As Josephson points out:

This substitutes legal requirements (which establish minimal standards of behavior) for personal moral judgment. This alternative does not embrace the full range of ethical obligations, especially for individuals involved in upholding the public trust. Ethical people often choose to do less than the maximally allowable, and more than the minimally acceptable.

Outsource Partners International acquired KPMG’s business processing outsourcing division in 2002, marking a turning point in outsourcing for the accounting profession. OPI now offers tax preparation services, internal accounting functions, and financial reporting support through its service center in Bangalore, India. According to Kishore Mirchandani, president of OPI, “Midsized clients using Peachtree and QuickBooks don’t always update their books, keep invoices, and check stubs … so that CPA firms have to complete write-up work before doing the returns. OPI can do the same thing it does with 1040s: take the source documents, do the write-up work, create a trial balance, and then complete the business tax return (www.electronic
accountant.com).

Outsource entities like OPI continue to offer accounting, tax, and financial services through alternative business structures. The 1990s were marked by the emergence of companies such as H&R Block and American Express Tax and Business Services, which grew by acquiring nonaudit services of small and mid-sized CPA firms. Perhaps the 2000s will be known for the incorporation of overseas outsourcing into firm structures to minimize costs and expand client services.

Outsourcing’s implications for the profession go beyond processing income taxes and other transactions. In the aftermath of recent accounting scandals and the internal control–reporting requirements of Sarbanes-Oxley, there is also the issue of the outsourcing activities of a CPA firm’s own clients. Public accounting firms should be particularly sensitive to a client’s outsourcing of information technology services. Local service providers might move toward outsourcing certain “noncore” functions, by either establishing their own offshore operation or contracting with third parties to perform critical business processes. If third parties are performing these functions, a public company’s executive management and accounting firm must be aware of the implications for compliance with section 404 of the Sarbanes-Oxley Act, and evaluate the internal controls underlying the process.

The outsourcing of tax services continues a disturbing trend in the accounting profession of placing pecuniary interests ahead of the public interest. The Enron scandal should have taught us that placing self-interest above all else, that fostering a client’s financial transactions regardless of the surrounding economic circumstances, can have disastrous consequences. The failure to disclose tax outsourcing raises similar concerns. This is especially so when clients’ interests are subordinated to those of a CPA firm that seeks to minimize costs without due regard for either the confidentiality of client information or the quality of services performed.

Concerns about income tax outsourcing exist because a U.S. CPA cannot directly oversee the operations that are outsourced overseas. Thus, she cannot ensure that proper security measures are in place to protect the clients’ interests, and it is difficult to verify the qualifications of the overseas accountants that prepare the returns. Notwithstanding the opt-out provision in the Gramm-Leach-Bliley Act, the legal ramifications of outsourcing are unknown. CPAs that engage in outsourcing are entering dangerous and uncharted waters. Moreover, it is deceitful for a CPA to outsource income taxes without first obtaining the client’s consent to do so. At the very least, a CPA should include a description of the practice in the engagement letter. However, ethical standards demand honest disclosure and forthrightness in communication—behavior that goes beyond “maximally allowable and minimally acceptable.”

The CPA Journal is broadly recognized as an outstanding, technical-refereed publication aimed at public practitioners, management, educators, and other accounting professionals. It is edited by CPAs for CPAs. Our goal is to provide CPAs and other accounting professionals with the information and news to enable them to be successful accountants, managers, and executives in today's practice environments.