AICPA §1.150.040 third-party disclosure template language.

What §1.150.040 actually requires

AICPA Code of Professional Conduct §1.150.040 (previously labeled ET §1.150.040 or §291.4) addresses the use of third-party service providers by members who provide professional services. The core requirement: before disclosing confidential client information to a third-party service provider, the member must either (a) enter into a contractual agreement with the provider to maintain confidentiality in accordance with the AICPA Code, or (b) inform the client that a third-party service provider may be used and obtain the client's consent to the use of such a provider.

In practice, most CPA firms do both: they enter into contractual confidentiality agreements with the offshore provider (belt) and also disclose the use of a third-party provider to the client in the engagement letter (suspenders). Either alone is technically sufficient under §1.150.040, but the combined approach is standard industry practice.

How §1.150.040 differs from IRS §7216

These two requirements are often confused because they overlap for tax engagements. The distinction matters:

• §7216 is a federal statute (IRS regulation). Applies specifically to tax return information disclosed to preparers outside the US. Violations carry criminal and civil penalties. The consent format is highly specific (18-point type, prescribed language, signed before disclosure).
• §1.150.040 is an AICPA ethical rule. Applies to any confidential client information disclosed to any third-party provider (US or offshore, tax or non-tax). Violations don't carry criminal penalties but can result in AICPA and state board disciplinary action including license suspension. No prescribed format; disclosure can be in the engagement letter, a separate notice, or a verbal disclosure with written confirmation.

For a tax engagement using offshore preparers, both requirements apply. §7216 controls the tax-return-information-specific disclosure with its formatting rules; §1.150.040 controls the broader professional-services disclosure. Most firms fold both into the engagement letter in separate clauses.

Where firms get §1.150.040 wrong

• Relying on a confidentiality agreement alone without informing the client. §1.150.040 allows either (confidentiality agreement OR client notification) but not neither. If your confidentiality agreement with the offshore provider gets questioned later, the client-notification layer is your backstop. Do both.
• Generic "we may use third-party providers" without specificity. The disclosure is more defensible if it identifies the general nature of the provider (e.g., "offshore accounting and tax preparation staff") rather than a completely open-ended reference. Firms using multiple providers can reference them collectively without naming each.
• Missing the disclosure entirely on existing client engagements. When a firm adds offshore staff mid-year, existing clients should receive disclosure before their confidential information reaches the offshore team. The standalone notice template above is designed for this situation.
• Confusing §1.150.040 with §7216. These cover different scope (professional services generally vs tax return information specifically) and have different formats (no specific format vs 12-point+ Times New Roman). A tax engagement needs both; a non-tax engagement needs only §1.150.040.
• Failing to maintain records of disclosure. Keep signed engagement letters or client acknowledgments on file. In a peer review or state board inquiry, the ability to produce evidence of disclosure matters.

State CPA board considerations

Most state CPA boards have adopted the AICPA Code of Professional Conduct (or a substantially similar code) as state-level rules. Some states have additional requirements beyond §1.150.040 – for example, explicit written consent rather than signed engagement letter consent, or specific disclosure of offshore jurisdiction. See our state CPA board disclosure matrix for state-by-state specifics.