Third Party Verification Requests The Letter of Comfort What can the CPA provide? Name of presenter Audience Date

Today’s Agenda Overview Common Verification Requests Responding to Requests What can the CPA provide? What can’t the CPA provide? Professional Services/ Additional Procedures Advisory/ consulting services Agreed-Upon Procedures Attest engagements and Levels of Assurance FAQs Summary Questions?

Overview

Seeing an Increase in Requests Not a new issue For banks Continued tightening of credit underwriting standards For individual and businesses As economy improves more individuals and business owners are seeking funding Increase in diversity of: Purpose Nature Scope Intent Small business owners are impacted the most For years, CPAs have been asked by third parties for verification, confirmation, certification, corroboration, authentication, or substantiation of their clients’ financial information. In this post financial crisis era, requestors are putting more scrutiny on the financial information that our clients are providing to various entities. CPAs are experiencing a rise in the number and different kinds of third party verification requests – often referred to as comfort letters. From a CPA’s perspective, negative connotations have often been associated with these requests—liability concerns, client alienation, confidentiality breaches, ethical issues, possible Gramm-Leach-Bliley Act violations, professional standard prohibitions, and Internal Revenue Code penalties. We see a lot these verification requests (comfort letter requests) for our clients that do not receive the standard W-2’s - our small business owners that are self-employed, contractors and others – who are seeking financing. These requests can create challenges for CPAs who want to serve our clients well, but we also need to manage our risk and potential liability.

Common Verification Requests

Examples of Borrower Information Requested Confirmation of a client’s self-employment status Verification of income from self-employment Verification of a borrower’s business ownership percentage Profitability or sustainability of a self-employed client’s business The impact on a self-employed client’s business if money is withdrawn to fund the down payment on a real estate purchase Validation of certain information presented on a tax return Here are some examples of the kinds of queries venders and loan brokers have: Would you confirm a client’s self-employment status? What is your client’s income from self-employment? Can you verify the self-employed borrower’s business ownership percentage? Is your self-employed client’s business profitable or sustainable? What will be the impact on your self-employed client’s business if money is withdrawn to fund the down payment on a real estate purchase? Will the loan have an adverse impact your client’s business?   There are a number of different ways a CPA will respond to these requests, depending on what kind request it is. For example, a response to a request to verify profitability or sustainability will vary from a request to confirm tax information. Not all third party requests will require a response in the form of an attestation service. CPAs can provide their clients' lenders with factual information as long as they are not breaking client confidentiality. Further, CPAs can only provide assurances to a third party by performing attestation services in accordance with SSAE standards.

CPAs Asked to Validate Information By Providing: A confirmation letter containing specific language A verification statement validating certain information presented on the tax return Certain information on a form

Responding to Requests

What Can the CPA Provide?

Professional services that comprise additional procedures Factual Information Professional services that comprise additional procedures What can the CPA provide? Factual information the CPA has obtained (with signed written client consent). Additional procedures performed ranging from: rigorous examinations that result in reports about whether the CPA believes the information to be free of material misstatement, to those less rigorous procedures, resulting in lower levels of assurance. Examples Copy of income tax return CPAs written acknowledgment of tax return preparation No assurance to the validity of the information provided by the client Copy of articles of incorporation Copy of articles of organization Financial projections No assurance to sustainability Compilation, Review or Audit of personal financial statements Examination, or a Compilation of prospective personal financial statements An agreed upon procedures report No assurance on matters related to solvency Time/Cost Lowest amount of work – generally quick turnaround; Low cost Involves more work/time; more costly Many of the requests can be performed as an advisory or consulting service. These engagements may fall under the CPA’s consulting standards as they require that the practitioner provide counsel in a short time frame based mostly, if not entirely, on existing personal knowledge about the client, the circumstances, the technical matters involved, client representations, or the mutual intent of the parties. The engagement will required the CPA to use its professional judgment and respond. The range of response required may be from simply responding to an email request or the completion of a form letter provided by the requestor. CPAs cannot provide assurances to a third party about information in tax returns - attesting to client information without performing attestation services in accordance with the AICPA Statements on Standards for Attestation Engagements (SSAE) constitutes a violation of professional standards, resulting in licensure implications. Agreed upon procedures can be mutually agreed with the requestor, or if needed, we have worked with various reporting agencies to create a standardize approach. An example is the procedures we developed with the Treasury for the Small Business Lending Fund. Some will require attestations. According to AICPA Technical Practice Aids on lender comfort letters , CPAs may provide clients with various professional attestation services in connection with a pending loan application such as:   audit, review, or compilation of financial statements; examination, review, or compilation of pro forma financial information; or examination or compilation of prospective financial information; or an agreed-upon procedures report. Compilation: Accountant does not obtain or provide any assurance that there are no material modifications that should be made to the financial statements Review: Accountant obtains limited assurance that there are no material modifications that should be made to the financial statements Audit: The auditor obtains a high, but not absolute, level of assurance about whether the financial statements are free of material misstatement

What Can’t the CPA Provide?

CPAs Cannot Provide Assurance on matters relating to SOLVENCY Confidential client information without client approval Client tax information without signed, written consent in IRS-specified format Certification or validation to a third party about information reported on a tax return without performing additional procedures. ALERT: For a CPA to validate information reported on a tax return without performing additional procedures would constitute a violation of professional standards, resulting in licensure implications for the CPA As previously mentioned, CPAs cannot provide assurance on matters relating to solvency. It is a violation of AICPA attestation standards and therefore an ethical violation. AT 9101.27      The matters relating to solvency mentioned in paragraph .23 are subject to legal interpretation under, and varying legal definition in, the Federal Bankruptcy Code and various state fraudulent conveyance and transfer statutes. Because these matters are not clearly defined in an accounting sense, and are therefore subject to varying interpretations, they do not provide the practitioner with suitable criteria required to evaluate the subject matter or an assertion under the third general attestation standard. In addition, lenders are concerned with legal issues on matters relating to solvency and the practitioner is generally unable to evaluate or provide assurance on these matters of legal interpretation. Therefore, practitioners are precluded from giving any form of assurance on matters relating to solvency or any financial presentation of matters relating to solvency.  CPAs also cannot provide any confidential client information without signed, written consent from the client.   Furthermore, a CPA cannot provide tax return information using a standard consent form. In fact, the Internal Revenue Code makes it a crime to do so. Section 7216 dictates that a specific format be used to obtain consent to disclose client tax return information to a third party. When CPAs prepare tax returns, CPAs don’t audit or verify the information provided by the client. CPAs meet the due diligence standards required of tax preparers, however, those procedures aren’t sufficient when being asked to verify or otherwise validate information presented on a tax return to a 3rd party.

Professional Services/ Additional Procedures

Understanding Lender Needs What level of assurance is really needed: Factual information –OR– CPA validation or certification of information (often requiring additional procedures performed by the CPA) If additional procedures are necessary, take into consideration: The associated time and Additional costs to the borrower Professional services that comprise additional procedures include: Advisory/consulting services Agreed-Upon Procedures Attest engagements When deciding which services is the most optimal, the CPA should take into consideration both timing and costs. Remember, the higher the level of service required, the more time the CPA needs to complete the engagement. Additionally, more time the CPA needs to complete the engagement, the more costly the engagement due to increased time for testing and procedures. The CPA can work with the lender and borrower (client) to best understand needs and manage their expectations to ensure that both the lender and borrower understand the appropriate timing and costs associated with providing factual information or more in-depth additional procedures.

Advisory/ Consulting Services CPAs can provide factual information (with client consent) CPAs use professional judgment to obtain the necessary factual information as long as they aren’t verifying or validating information without performing necessary additional procedures CPAs can prepare financial projections For requests asking pending loan’s impact on borrowers self-employed business CPAs cannot provide assurance to a client’s ability to repay the loan The CPA does not have clearly defined procedures that he must follow - the CPA uses his professional judgment to obtain the necessary factual information needed to respond to the inquiry. Letter acknowledging CPA preparation can accompany copies of the tax return

Agreed-Upon Procedures Engagement CPAs can prepare a report of findings based on specific procedures performed on specified subject matter This subject matter and related procedures must be clearly defined and relatively limited in scope Subject matter may take many different forms and may be as of a specified date or over a specified period CPA does not provide an opinion or negative assurance AT Section 201 / Agreed-Upon Procedures Engagements of the AICPA’s Statement on Standards, defines the guidelines

Attest Engagements: The Compilation Most basic level of service CPA assists management in presenting financial information Does not contemplate performing inquiry, analytical procedures, or other procedures No assurance that there are no material modifications that should be made to the financial statements The report states that no assurance is provided Generally appropriate for simple situations (e.g. lender needs GAAP financial statements versus internally prepared statements or the lender needs the comfort provided by knowing an accountant read the financial statements). Provides no assurance.

Attest Engagements: The Review Involves primarily analytical procedures and inquiries that will provide a reasonable basis for obtaining limited assurance A review does not assess internal control, fraud risk A review does not test accounting records or other procedures The report provides a statement that the accountant is not aware of any material modifications that should be made to the financial statements More costly than a compilation but substantially lower in cost than an audit. Provides limited assurance. Often prepared for privately held companies because of requirements such as banks, creditors and potential investors that are looking for comfort that the financial statements are not materially misstated.

Attest Engagements: The Audit Auditor is required to obtain an understanding of the entity’s internal control and assess fraud risk Obtain audit evidence Inquiry, physical inspection, observation, third party confirmations, examination, analytical and other procedures The auditor’s report provides an opinion as to whether the financial statements present fairly, in all material respects, the Company’s financial position, results of operations and cash flows Highest from of assertion. Provides an opinion on the financial statements. Often prepared for companies when a bank, creditor, purchaser or outside investor wants assertion that the financial statements present fairly, in all material respects, the company’s financial position, results of operations and cash flows for the period reported. Note: The auditor may also issue a disclaimer of opinion or an adverse opinion if appropriate.

FAQs This section simply reminds lenders and brokers of the different levels of assurance by engagement type. NOTE: Consider using this brochure as a hand-out to provide a comparative overview of the different levels of assurance for compilation/review/audit. http://edit.aicpa.org/InterestAreas/PrivateCompaniesPracticeSection/QualityServicesDelivery/KeepingUp/DownloadableDocuments/Brochure%20NonCustomizeable-Difference%20between%20Comp%20ReviewAudit.pdf

Self-Employment Question: Response: Can the CPA confirm a borrower’s income from self-employment or self-employment status? Response: The CPA can only provide factual information, such as copies of tax returns (with signed written consents from the client) The CPA can provide a letter verifying they prepared the tax return based on information the client provided This letter can be provided along with tax return copies The CPA cannot verify or validate the information reported on a tax return without performing additional procedures Can provide factual info (such as tax return copies) as long as the CPA does not break client confidentiality Internal Revenue Code Section 7216 actually makes it a crime for a tax preparer to disclose client tax return information to a third party without consent. More information and details regarding the specific wording and format for written consents can be found on the Section 7216 Information Center, Treas. Reg. §301.7216-3(a)(3) on the IRS website: http://www.irs.gov/Tax-Professionals/Section-7216-Information-Center The CPA can provide a letter verifying they prepared the tax return that states: “I verify that I prepared a tax return reporting $XX,XXX amount of income based on information provided by my client”.

Financial Projection of Business Income Question: Can a CPA provide a requestor with a financial projection of business income over a specified period? Response: A CPA can perform a financial forecast for a client and report their findings (with client consent). A CPA cannot attest to the sustainability of the client’s business as a result of that forecasted projection (that would be expressing an opinion on a client’s solvency).

Knowledge of Information Requested Question: Can a CPA just respond to a request if he has knowledge of the information requested? Response: Yes A CPA can respond to a form letter or email provided that the information is: Factual information Not expressing an opinion unless attestation performed Not providing an attestation on solvency

Summary

In Conclusion… Credit decisions are based on a lender’s exercise of due diligence This includes considering multiple factors and information The burden of determining the impact on the ability of the business to continue operating as a result of the withdrawal is solely on the lender or broker A CPA cannot provide assurance on any matter related to a client’s ability to repay the loan Options are available to meet lender/borrower’s needs Working as a team, the lender, the CPA and the borrower can determine how to best meet everyone’s needs I should also reference the fact that no such guidance stating that self-employed borrower will not qualify for a mortgage unless his/her accountant provides a comfort letter exists in either the Fannie Mae or Freddie Mac seller guides for residential mortgages.

Questions?