When Parties Come Knocking for Client Records
CPA firms either maintain or have access to numerous types of client records and related working papers. Requests for access to copies of such records can arise from multiple sources, including current and former clients, lawyers, civil and criminal investigators, lenders, and others. All requests should be made in writing. The obligation of a CPA firm to respond to these requests is governed by professional standards, state board of accountancy regulations, state and federal law, and regulatory bodies. Before responding, a CPA firm should consider all applicable standards, statutes, and regulations. Often, the requesting party seeks an immediate response while actions affecting the CPA firm's client, such as extending a loan, securing a construction bond, or responding to a regulatory inquiry, are pending--thus creating impediments to a prompt reply Additional issues to consider include the standing of the parties requesting the records, the types of records requested, the time frames sought to produce the records, the format of the records being requested, and the resources necessary to identify, retrieve, reproduce, and submit copies of records. CPA firms should consider designating a records custodian responsible for coordinating the responses to all such requests. The custodian will develop expertise over time in this area, and that continuity will help minimize errors and wasted time. Ultimately, this protocol will help to manage the costs associated with responding to records requests, as processes are developed and required consultations with legal counsel can be minimized. REQUESTS FROM CLIENTS AND FORMER CLIENTS The most common types of records requests come from clients, former clients, or parties associated with them. With respect to the standing of the party requesting the records, the first question to consider is whether the party is the client or former client, or an authorized representative. Business clients often are closely held and are corporations or partnerships, which can lead to other questions to consider before responding, such as whether the client has a COO or CFO, or whether one of the owners always engaged the CPA firm and provided requested information, but there is joint ownership. The requesting party should state in writing its relationship to the client. The CPA firm should then consider whether this representation is consistent with the information the CPA firm knows about the client's business. This is important because it is not unusual for the operators or owners of a client business to become embroiled in a business dispute and demand copies of records despite having had little or no prior contact with the CPA firm. If it cannot be readily determined whether the requesting party is authorized to receive copies of records on behalf of the client's business, it may be necessary to consult with legal counsel prior to responding. REQUESTS FROM THIRD PARTIES Records requests may come from third parties, such as shareholders, lenders, mortgage brokers, vendors or customers of clients, attorneys, regulators, and civil or criminal investigators. Before responding to an inquiry, a CPA firm should consider the source. Is the request emanating from a regulator, a representative of a department of revenue, or a criminal investigator? When in doubt, consult with your firm's legal counsel. It is possible that a subpoena should have accompanied the request. In addition, other advice may be needed to avoid running afoul of investigative authority vested in the requesting party. Also, consider the potential risk to the CPA firm if it provides client records to a third party. In addition to privacy and confidentiality concerns, a CPA firm can unintentionally expose itself to the risk of claims from third parties, who may assert reliance on the records provided by the CPA firm to make a decision or enter into a business transaction. …