The MACPA Professional Ethics Task Force has been challenged with an increasing number of record retention inquiries over the past six years. Some of the situations are routine in that ET Section 501 can be explained to the complainant and/or the practitioner and the matter is resolved quickly. A few inquiries develop into formal complaints and require careful investigation of the facts and circumstances.

The AICPA Code of Professional Conduct has become quite definitive as to the general term of “books and records” and what data needs to be returned to the former client or remains the property of the CPA, providing excellent guidance to practitioners.

Some of the recent inquiries, however, have addressed guidelines as to individual firm practices in either developing or updating internal record retention policies. The following questions reflect some of the more common questions:

Are there any special requirements when electing a paperless record retention system?
Yes! Implementation of electronic imaging and data storage is quickly replacing the manual filing and storage systems of the past. Client confidentiality and the security of their data in a virtual filing cabinet is a critical consideration.

Record retention policies should address and advise the client of the method of record storage being utilized to facilitate future accessibility especially if the electronic environment is to be employed. If the CPA is not utilizing a scanning system to reduce written data to CD-ROM format physically stored internally, the practitioner must inquire and obtain a written statement from the storage website host as to the security of the data, accessibility, and back up procedures and its ability to recover data in a natural disaster, etc.

Are the prescribed record retention periods of the SEC, state accounting boards, regulatory agencies, etc. the same for virtual record storage?
Absolutely! The electronic format for data storage does not change prescribed record retention periods.

With the increased employment of electronic data transmission, do we have to retain email communications and fax transmissions as part of our record retention policies?
The CPA firm should develop its record retention policy to encompass both email and data transmitted by fax machine. Both forms of communication should contain a disclaimer indicating that no professional service is being provided prior to the execution of an engagement letter. In addition, each should state that the data being transmitted is for the intended recipient only.

The retention of emails and faxes in an electronic filing system may be subject to discovery in a lawsuit; the CPA firm’s record retention policy should provide guidance as to what email or fax transmission should, therefore, be retained in the virtual files or physically or electronically shredded.

In conclusion, the CPA should maintain copies of any client data in its storage system to support any conclusions reached in an engagement. Do not rely on the client.