(a) Confidential Client Information Rule. A holder shall not, without the consent of the client, disclose any confidential information pertaining to the client obtained in the course of performing professional services. - (i) This rule does not:
- (A) relieve a holder of any obligation under the Auditing Standards Rules, the Accounting Principles Rules, the Accounting and Review Services Rules, the Attestation Standards Rule, and Other Professional Standards Rules (formerly Rules 202, 203, 205, 206 and 207 );
- (B) affect in any way a holder's obligation to comply with a validly issued subpoena or summons enforceable by order of a court;
- (C) prohibit disclosures in the course of a quality review of a holder's professional services; or
- (D) Preclude a holder from responding to any inquiry made by the Board or any investigative or disciplinary body established by law or formally recognized by the Board.
- (ii) Members of the Board and professional practice reviewers shall not disclose any confidential client information which comes to their attention from holders in disciplinary proceedings or otherwise in carrying out their responsibilities, except that they may furnish such information to an investigative or disciplinary body of the kind referred to above.
(b) Records Rule. Within forty-five (45) days of the date a request is made for any of the records in subsections (i) through (iii) below, a holder shall either deliver originals or copies or provide access to the records. Once the holder has complied with these requirements there is no obligation to provide additional records. - (i) client records that were provided to the holder by or on behalf of the client;
- (ii) client records prepared by the holder such as accounting or other records including but not limited to tax returns, general ledgers, subsidiary journals and supporting schedules such as detailed employee payroll records and depreciation schedules the holder was engaged to perform;
- (iii) supporting records and information not reflected in the client's books and records that are otherwise not available to the client such as adjusting, closing, combining, or consolidating journal entries (including computations supporting such entries) that are produced by the holder during an engagement as these records may make financial information incomplete;
- (iv) working papers such as audit programs, analytical review schedules, and statistical sampling results, analyses, and schedules prepared by the client at the request of the holder are the holders' property and need not be provided to the client unless imposed by some other contractual agreement or state or federal law or regulation.
- (v) The information in subsections (i) through (iii) above shall be provided in the medium requested, written or electronic if prepared in that medium. The holder shall redact any confidential information that may be attached to paper or electronic records. The holder may make and retain copies of such documents when they form the basis for work performed by him or her and the holder is entitled to reasonable reimbursement for costs associated with providing records for the client.
- (vi) If an engagement is terminated prior to completion for a particular year-end, the holder is required to return only client records. A certificate holder may require all fees due for the last completed engagement be paid before the information in (ii) and (iii) above is provided.
- (vii) Record Retention: Absent any specific regulations or professional standards issued by governmental agencies or other agencies having generally recognized authority with jurisdiction over the holder's engagement, holders shall retain records for assurance and attest engagements no less than five (5) years from the date of completion of the engagement. All other records including tax related records must be retained for a minimum of three (3) years from the date of completion of the engagement. In the absence of regulations mentioned which define records, retained records shall include, but are not limited to, work papers and other documents that contain conclusions, opinions and analysis, or financial data related to the engagement. If the holder was engaged to perform services utilizing electronic systems, the holder shall ensure that the most current electronic records and three years of paper records (if created) are capable of being accessed in a usable, protected format and are safeguarded through sound computer security procedures to prevent unauthorized access to records. If a pending investigation exists, records shall not be destroyed until the Board has notified the holder in writing of the closure of the investigation or has issued a formal decision based on the investigation. The holder is under no obligation to provide software that may be attached to or associated with electronic records.