Yes. If your firm uses an outsourced service provider, APES 305 requires you to tell your client. The revised APES 305 Terms of Engagement, effective for engagements commencing on or after 1 July 2021, requires members to document and communicate to the client the details of the outsourced service provider, where the outsourced services will be performed, and the nature and extent of the outsourced services.

What APES 305 requires

When you use outsourced services to deliver professional services to a client, your terms of engagement must cover:

  • Who: the details of the outsourced service provider
  • Where: the geographical location where the outsourced services will be performed
  • What: the nature and extent of the outsourced services to be used

This applies to offshore and onshore outsourcing alike. It sits alongside your existing obligations under APES 110 (confidentiality) and your firm’s quality management system.

Sample engagement letter wording

Adapt this to your own engagement letter and have it reviewed against the current standard:

“In performing this engagement, we will use an outsourced service provider, [Provider name], located in [City, Country]. [Provider name] will assist with [for example: preparation of working papers, lead schedules and substantive testing]. [Firm name] remains responsible for the engagement, including review of all work and final sign-off. Your information is accessed only by authorised personnel under confidentiality and information security arrangements.”

Privacy: sending personal information overseas

If your firm is covered by the Privacy Act 1988, Australian Privacy Principle 8 applies when personal information is disclosed to an overseas recipient. In general, you must take reasonable steps to ensure the overseas recipient does not breach the APPs in relation to that information. A written confidentiality and data protection agreement with your provider is the usual starting point.

Checklist before you outsource

  • Provider’s legal name and the city and country where work is done
  • Exactly which tasks are outsourced, and which stay in-house
  • Who reviews the work and who signs off
  • Information security certification (for example ISO 27001)
  • Signed confidentiality and data protection agreement
  • Access controls: who can see client files, on which systems
  • Updated engagement letters for affected clients
  • A record in your quality management documentation

The details you need from AudiTree

  • Provider: AudiTree
  • Location: Kochi, Kerala, India
  • Typical scope: working papers, lead schedules, reconciliations, substantive testing, financial statement drafting
  • Security: ISO 27001 certified, access restricted per engagement
  • Responsibility: your firm keeps review, sign-off and the client relationship

See how we work with Australian firms on our audit outsourcing for Australian CA & CPA firms page.

Frequently asked questions

Does APES 305 apply to offshore audit support?

Yes. It applies whenever outsourced services are used to provide professional services to a client, wherever the provider is located.

Do I need the client’s consent?

APES 305 requires disclosure in the terms of engagement. Check your engagement letter, privacy obligations and professional body guidance for when consent is also appropriate.

When did this start?

The revised APES 305 applies to engagements commencing on or after 1 July 2021.

This article is general information, not professional advice. Check the current standard at APESB and guidance from CA ANZ or CPA Australia before updating your engagement letters.

Sources: CPA Australia: APES 305 Terms of Engagement; APESB: revisions to APES 305.