Why Accountants Need Enhanced NDAs
While CPAs are already bound by professional confidentiality rules, NDAs provide additional protection in several important ways:
- Third-party staff: Bookkeepers, administrative staff, and offshore processing teams may not be licensed CPAs and need contractual confidentiality obligations.
- Client-to-client protection: Prevents clients from leveraging information learned about your other clients through incidental exposure.
- Cloud and software vendors: Tax software, accounting platforms, and cloud storage providers need confidentiality obligations.
- Specific damage remedies: NDAs can specify liquidated damages and injunctive relief not available under professional rules alone.
- Extended duration: Professional rules may not specify how long confidentiality lasts after the engagement ends.
Information Protected in Accounting Engagements
Accounting NDAs should specifically address protection for:
- Tax return information: All data collected for tax preparation, including supporting schedules and work papers
- Financial statements: Balance sheets, income statements, cash flow statements, and supporting documentation
- Business financials: Revenue figures, profit margins, cost structures, and pricing information
- Personal financial data: For individual clients - income, assets, debts, and investment positions
- Tax strategies: Planning advice, structure recommendations, and optimization approaches
- Audit findings: Internal control weaknesses, material misstatements, and management letter comments
Mandatory Disclosure Carve-Outs
Every accounting NDA must include exceptions for legally-required disclosures:
- IRS summons and audits: CPAs must respond to valid IRS information requests
- Subpoenas: Court orders and valid legal process in litigation
- Peer review: AICPA peer review requirements for quality control
- State board investigations: Responses to disciplinary investigations
- Successor accountant requests: Professional obligations when a new accountant takes over
- Anti-money laundering: Suspicious activity reporting requirements
Client Consent for Third-Party Disclosure
The NDA should establish clear procedures for authorized disclosures:
- Written consent requirements before sharing with banks, investors, or other third parties
- Process for obtaining consent for engagement letters that require third-party access
- Limitations on consent scope (what information, to whom, for what purpose)
- Duration of consent and procedures for revocation
Work Paper Ownership and Access
Address the important distinction between work papers and client records:
CPA work papers: Analysis, notes, and documentation created by the CPA during the engagement typically remain the CPA's property (though subject to professional retention requirements).
Client records: Original documents and records provided by the client, which must be returned upon request.
Access limitations: Define when clients can access work papers (some jurisdictions require access; others leave it to the engagement letter).
Offshore and Cloud Processing
Many accounting firms use offshore processing or cloud services. The NDA should address:
- Disclosure that work may be performed by offshore staff or contractors
- Requirement for flow-down confidentiality agreements with all service providers
- Data security standards for electronic transmission and storage
- Geographic restrictions on where data may be processed or stored if required