External reviewer independence requirements and the 2017 QI Agreement

Editor: Jacob Puhl, J.D., LL.M.

Rev. Proc. 2017-15 (the 2017 QI Agreement) allows foreign persons to enter into an agreement with the IRS to simplify their obligations as withholding agents under Chapters 3 and 4 and as payers under Chapter 61 and Sec. 3406 for amounts paid to their account holders under the Internal Revenue Code. Under the terms of the 2017 QI Agreement and its earlier iterations, qualified intermediaries (QIs) are required to periodically conduct a review of their controls and systems and certify their effectiveness.

Prior to 2014, an external auditor conducted this review of controls and systems and was required to report his or her findings directly to the IRS. Commencing with the 2014 QI Agreement, the IRS replaced the traditional requirement for a formal external audit with the more lenient instruction that the QI maintain an “internal compliance program.” Under this new standard, a QI may still engage a third party to assist it with evaluating its internal controls and systems, but, if it does, the third party is no longer required to make an attestation or render an affirmative opinion regarding a QI’s compliance.

As formal attestation is no longer required, the new standard substitutes in place of traditional auditor standards of independence a more generic requirement that the reviewer have sufficient independence “to objectively conduct the review and cannot review his or her own work” (Rev. Proc. 2017-15, §4.02(7)). Industry stakeholders remain uncertain as to the meaning of the new rules and the standard of independence required of an external reviewer performing a periodic review on behalf of a QI.

On Dec. 8, 2017, the IRS published guidance in the form of a Foreign Account Tax Compliance Act (FATCA) FAQ stating that for review years prior to 2018, an external reviewer of a QI may “apply the standards of independence that would otherwise apply to its engagement to conduct the periodic review (such as the standards for an agreed-upon-procedures engagement by a certified public accountant (CPA))” (FATCA — FAQs General, Certifications and Periodic Reviews, Q2, available at www.irs.gov. The IRS intends this FAQ as a stopgap measure establishing a temporary standard of independence applicable only until it can provide comprehensive independence guidance that will apply for reviews of calendar year 2018 or later.

As the July 1 and Dec. 31 deadlines for periodic certification are now fast approaching, many QIs either have commenced or are about to commence periodic reviews. This item is intended to provide timely discussion of the standard of independence applicable to external reviewers performing periodic reviews under the 2017 QI Agreement. It traces the evolution of the external reviewer independence standard and provides an interpretation of the present regulations.

An attest standard applied prior to 2014

Prior to June 30, 2014, entities admitted to QI status were governed under the terms of Rev. Proc. 2000-12 (as amended). Rev. Proc. 2000-12 generally provided that a QI was required to engage an external auditor to complete an audit of the second and fifth full calendar years that the then-applicable QI agreement was in effect. The external auditor was required to provide its findings directly to the IRS.

Rev. Proc. 2002-55 amended Rev. Proc. 2000-12 to incorporate detailed audit guidance for an external auditor “engaged by a qualified intermediary . . . to verify the QI’s compliance with the withholding agreement entered into with the [IRS] pursuant to Rev. Proc. 2000-12” (Rev. Proc. 2002-55, §1). In addition to highly specific “audit steps,” Rev. Proc. 2002-55 included specifications with respect to an auditor’s independence, namely, requirements that an auditor:

• Be one of the auditors listed in Appendix B of Rev. Proc. 2000-12; and
• Be subject to the laws, regulations, or rules that impose sanctions for failure to exercise independence and to perform the audit competently (Rev. Proc. 2000-12, QI Agreement §10.02).

First transition to an informal standard, the 2014 QI Agreement

The 2014 QI Agreement broke with the formal standards of the past in favor of a more flexible set of requirements. Principally, it replaced the old external audit requirement with an internal compliance program. Under the terms of this new internal compliance program, a QI was required to designate a responsible officer who would:

• Oversee the QI’s compliance with the QI agreement;
• Make a required periodic certification to the IRS; and
• Provide certain factual information regarding the QI that would vary depending on the number of reportable accounts received by the QI (Rev. Proc. 2014-39, §2.03(J)).

Partly for purposes of gathering the “certain factual information” discussed above, the 2014 QI Agreement retained the substance of the traditional external audit requirement in the form of a “periodic review” (i.e., a detailed review of a QI’s internal systems and controls). Relative to the old regime, the 2014 QI Agreement provided flexibility by permitting a QI to select as its “auditor”:

• An employee of the QI or an employee of a compliance QI (i.e., an internal auditor); or
• A CPA, attorney, or third-party consultant (“external auditor”); or
• Any combination thereof (2014 QI Agreement, §10.04(A)).

With respect to the standard of independence required of a third party conducting a periodic review, the 2014 QI Agreement provided that:

• An external auditor must be independent of the QI under the standards applicable to a CPA with respect to the engagement; or
• In the case of an auditor other than a CPA, any standard of independence otherwise applicable to the auditor for such an engagement (2014 QI Agreement, §10.04(A)(3)).

The independence provisions of the 2014 QI Agreement arguably read as a modified version of the earlier attest standard (at least with respect to periodic reviewers who are CPAs). However, the 2014 QI Agreement explicitly stated that an external auditor conducting a periodic review on behalf of a QI was “not required to make an attestation or render an opinion regarding [a] QI’s compliance” with that agreement (2014 QI Agreement, §10.04(A)(3)). In addition, the prescriptive audit steps set forth in Rev. Proc. 2002-55 were replaced with less formal procedures granting “auditors” significant flexibility in the performance of the mandated periodic review (Rev. Proc. 2014-39, §2.03(J)).

Resulting confusion and clarification of the applicable independence standard

A sizable number of account holders drew from the auditor independence provisions of the 2014 QI Agreement an inference that a QI periodic review must satisfy the standards of a financial audit or other attestation engagement of a CPA (Rev. Proc. 2017-15, §4.02(7)). Responding to this inference, Notice 2016-42 (Proposed QI Agreement) clarified that under the 2014 QI Agreement, attest standards of independence were no longer required in the context of a QI periodic review (Notice 2016-42, §2.02(A)). Additionally, the Proposed QI Agreement replaced all references to the term “auditor” in the 2014 QI Agreement with the more generic term “reviewer” (Notice 2016-42, §2.02(A)).

Following publication of the Proposed QI Agreement, the IRS received and evaluated industry comment asking for further modifications of the revised independence standard and, in particular, requesting:

• That the standard be relaxed to allow a wider range of external reviewers who have connections to, or experience with, external systems and procedures;
• That independence for external reviewers be determined on an individual or team basis (i.e., if an individual or team had established a QI’s compliance program, another individual or team in the same company or firm could review the first individual’s or team’s work);
• That any individual with management responsibility for implementation of the QI agreement not be allowed to have significant involvement with the review; and
• That people who review client tax forms, perform withholding for clients, or calculate amounts required to be reported be disqualified from performing the review (Rev. Proc. 2017-15, §4.02(7)).

Critically, the IRS ultimately did not adopt any of the above proposals (Rev. Proc. 2017-15, §4.02(7)), stating affirmatively that the provisions of the 2017 QI Agreement regarding the independence of the reviewer are unchanged from the Proposed QI Agreement.

Conclusions on external reviewer independence under the 2017 QI Agreement

The 2017 QI Agreement does not include a complete set of rules with respect to external reviewer independence. This is intentional. As the 2017 QI Agreement itself explains, the independence of any particular reviewer necessarily depends on specific facts and circumstances. Applying detailed prescriptive rules is therefore likely to result in requirements that are both over- and underinclusive (Rev. Proc. 2017-15, §4.02(7)). While this claim has some logic, the IRS’s previously mentioned December 2017 FATCA FAQ release (promising future detailed guidance on the independence standards applicable to external reviewers of QIs), suggests the agency now favors a more prescriptive approach.

In any event, for the time being, one is left to piece together the substance of the external reviewer independence requirement through careful reference to a combination of:

• The evolving history of QI external reviewer independence standards;
• The text of the 2017 QI Agreement; and
• Industry comment to the Proposed QI Agreement, which, in having not being adopted, sheds important light on the meaning of the QI Agreement’s independence provisions.

From these sources, one can glean that an external reviewer acting on behalf of a QI must have sufficient independence to objectively conduct a review and may not review his or her own work (Rev. Proc. 2017-15, §4.02(7)). In slightly more technical terms, Section 10.04(A)(2) of the 2017 QI Agreement provides that any qualified CPA, attorney, or third-party consultant may serve as an external reviewer to a QI, provided he or she is not reviewing systems, policies, procedures, or results thereof that he or she (or the firm with which he or she is affiliated) is involved in designing, implementing, or maintaining.

This standard is flexible and thematic and may possibly be interpreted to permit an otherwise qualified external reviewer to carry out a periodic review, so long as the reviewer is not in a position where he or she would be reluctant to make a negative assessment of the QI’s practices and procedures out of concern for the negative impact of such a determination on the reviewer and his or her employer. Hence, a reviewer who previously assisted solely with the physical submission of client data may carry out a periodic review on that client’s behalf. By contrast, a person may not act as an external reviewer with respect to systems he or she designed or documentation he or she validated (Notice 2016-42, §2.02(A)).

As a final note, readers will have observed that the IRS FATCA FAQ released late last year was published in part as a response to stakeholder confusion with respect to the meaning of the word “firm” as it is used in the context of the 2017 QI Agreement. This confusion might stem in part from industry comment on the Proposed QI Agreement requesting that the independence standard be applied on an individual or team basis rather than a “company” or firmwide basis. The IRS has firmly rejected these requests. The independence standard applicable to external reviewers of QIs should not be applied on an individual or team basis but instead on a company or firmwide basis. The term “company or firmwide basis” should be interpreted expansively to incorporate all individuals and subgroups reasonably characterized as belonging to a single professional services firm or corporate enterprise.

Remember that the general thrust of the current independence requirement is for external reviewers to avoid conducting periodic reviews in circumstances where a potential conflict of interest might compromise their integrity. If a reviewer winds up in a position where he or she must evaluate the work product of a present colleague, even a distant one, it is likely best to decline the work.

This publication contains general information only and Deloitte is not, by means of this publication, rendering accounting, business, financial, investment, legal, tax, or other professional advice or services. This publication is not a substitute for such professional advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified professional adviser. Deloitte, its affiliates and related entities, shall not be responsible for any loss sustained by any person who relies on this publication.

EditorNotes

Jacob Puhl is a manager in the Tax Policy Group of Deloitte Tax LLP’s Washington National Tax group.

For additional information about these items, contact Mr. Puhl at 202-220-2767 or jpuhl@deloitte.com.

Unless otherwise noted, contributors are members of or associated with Deloitte Tax LLP.