How to Comply with the New SSTSs

By William Stromsem, CPA, J.D., George Washington University School of Business 

AICPA promulgated three new Statements on Standards for Tax Services (SSTS) covering data protection, reliance on tools and tax representation that became effective on January 1, 2024. Prior SSTSs were carried over and reorganized but contain no new requirements and will not be dealt with in this article, assuming that you already have policies in place to work with them.   

The new SSTSs do not have bright-line standards and mostly use flexible terms like reasonable efforts, due professional care, due diligence and professional judgment. (See prior article on SSTSs.) The SSTSs tend to use “should” instead of the more mandatory “must,” so the compliance is somewhat flexible and hedged. This should give comfort to CPAs in tax practice, and the SSTSs might be thought of as providing a defensible standard against regulatory sanctions and liability claims.  

The new SSTS on data protection requires members to make “reasonable efforts to safeguard taxpayer data, including data transmitted or stored electronically” and consider “applicable privacy laws when collecting and storing data.” It does not require encryption or ask us to do any more than most practitioners are currently doing to protect taxpayer privacy. The new SSTS on reliance on tools requires only that members exercise professional care when using a tool, that members exercise “appropriate” professional judgment when using a tool, and that they “take reasonable steps to determine that the tools are appropriate for the intended purpose.” The new SSTS on representation requires that a practitioner determine that technical competence exists, follow applicable agency or court rules, act with integrity and professionalism, comply with applicable rules on timeliness of responses, consider confidentiality responsibilities for the taxpayer, suspend or withdraw from engagement if the case appears to be going into criminal issues, and review with the client the consequences of a proposed agreement with a tax authority. 

Note that the AICPA standards reflect current external legislative, regulatory and judicial standards. AICPA would not want to set more lenient standards, misleading practitioners to believe that they were in compliance with external standards, and having the standards look weak to outside regulators and the public. AICPA would also not want to set more rigorous standards, placing a self-regulatory burden on members and placing them at a competitive disadvantage to non-CPA practitioners. So, in general, compliance with the SSTSs may help avoid sanctions by other regulators.     

The SSTSs are binding under the AICPA Code of Professional Conduct. You may be tempted to think that there are likely to be few disciplinary actions by AICPA with the new flexible standards and that in the rare instance of a successful action against a CPA, AICPA’s most extreme sanction is to expel you from the organization, with a major consequence being the loss of AICPA group-term life insurance. However, this ignores the fact that the IRS and state professional licensing authorities all review AICPA sanctions – if you are sanctioned by AICPA, you may also see an action brought by other regulators. AICPA disciplinary actions are published on its website, and IRS sanctions are published in the IRS Bulletin, with each regulatory body reviewing the work of the other, and with state licensing authorities often having the same standards also reviewing AICPA and IRS sanctions. If your IRS practice rights are terminated, your firm must choose between giving up IRS practice or terminating you because the IRS does not want a sanctioned CPA to be able to work indirectly through others in the firm. Violations can result in a loss of your job, your right to practice before the IRS, or your CPA license, as well as your valuable professional reputation. Another major concern with failing to comply with the SSTSs is that these standards are often used in malpractice claims that a CPA was not acting in accordance with professional standards.   

The issue, then, is how do we show compliance with these flexible standards. You do not have to get it right with the benefit of hindsight, but you do have to be prepared to show a reasonable effort to satisfy the requirements. Again, there are no bright lines, but there are several ways to evidence your efforts that may be helpful. 

Training on Professional Standards, Including the New SSTSs   

A training session on the SSTSs will help your staff members to be aware of ethical issues and know how to exercise professional judgment and due professional care. The training might include some close calls, bringing a good discussion of current and better practices. This will help your associates and staff recognize when they are in an area where there are issues. Plus, it shows your firm’s effort to act in accordance with the standards. Be sure to keep a record of the training to be able to show your efforts.