Who owns audit workpapers: the CPA firm or the client?

The short answer: the firm owns the file, the client controls the information

It depends on which record you mean. Under the AICPA Code of Professional Conduct, a CPA firm's own working papers are generally the firm's property, while records the client handed over, and certain records the firm prepared for the client, must be returned or provided on request. Owning the file does not free the client information inside it: the Code's confidentiality rule bars disclosure without the client's specific consent.

For a firm weighing AI data licensing, that split settles most of the question. Audit and review files are built from client information, so they stay out of any license. The firm's own operating records, such as its methodology, training material and the way it runs the practice, are a separate matter and may qualify.

What the rules actually say

Two parts of the AICPA Code do most of the work. The AICPA's online Code is the authoritative version; a full-text copy of the AICPA Code hosted by the Minnesota Society of CPAs shows both provisions in context.

Records requests (ET 1.400.200)

This interpretation of the Acts Discreditable Rule sorts engagement records into four groups and gives each its own duty:

The interpretation also gives way to stricter requirements in law, regulation or contract, so an engagement letter or a state accountancy rule can change the answer for a particular file.

Confidential client information (ET 1.700.001)

The rule states that a member in public practice "shall not disclose any confidential client information without the specific consent of the client." Its carve-outs cover matters such as compliance with professional standards, a validly issued subpoena or summons, practice review and professional ethics investigations. None of them contemplates commercial reuse of client data.

Auditing standards separately govern what audit documentation must contain and how long it is kept, and audits of public companies follow their own standards and rules. Check what governed each engagement before anything is moved, archived or destroyed. State accountancy laws and board rules can also address working papers and confidentiality in their own terms.

How the rules play out in situations firms actually meet

The gap between holding a record and controlling what is in it shows up across service businesses. The same logic applies to call recordings at a contact center or BPO and to client data held by a 3PL.

What a CPA firm could license instead

A firm's licensable records are the ones that document how the firm itself works, not what it learned about clients. Candidates include:

• Methodology manuals, audit approach guides and internal technical memos written by the firm, with client examples taken out.
• Training curricula and case exercises built on fictional companies.
• Practice operations data, such as staffing models and hours by engagement type, in de-identified form.
• Firm-authored templates, checklists and review guides.
• Internal IT, scheduling and firm-management records where client references can be stripped.

Be realistic about email and chat. At an audit firm, most messages mention clients, so those archives need heavy redaction or exclusion, and firm-authored materials are usually the cleaner starting point. The firm must also clear the company baseline: US-based, 50+ full-time employees at peak (contractors excluded), several years of documented operations, clear rights to the records and a managing partner or other authorized sponsor. The accounting firm data monetization guide walks through scoping, and the data inventory builder lists systems without opening any files.

Disclosure and consent when a CPA introduces a client company

A CPA who introduces a client company, rather than the firm itself, faces two questions: confidentiality and fees.

On confidentiality, ask the client's permission before naming it to anyone, and share only the company name and the sponsor's contact details. The simplest route is to send the owner your referral link so the company applies itself at sourcex.si/apply; the client describes its own records and nothing leaves your files.

On fees, the Commissions and Referral Fees Rule (ET 1.520.001), in the Minnesota Board of Accountancy's copy of the Code, says a member in public practice may not accept a commission for recommending a product or service to a client when the member or firm also performs an audit, review, certain compilations or an examination of prospective financial information for that client. Permitted commissions and referral fees must be disclosed to the client. State rules can be stricter than the Code, as the New Jersey Society of CPAs' page on commissions and contingent fees shows. Firms that audit SEC registrants also answer to SEC independence rules, a regime separate from the Code, as the SEC Office of the Chief Accountant's 2004 letter to the AICPA ethics committee on contingent fees illustrates.

Partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, capped at $100,000 per referred company. The reward becomes payable only after the buyer pays and SourceX receives its fee, and it is a share of SourceX's fee, never a deduction from what the company receives. Whether a CPA may accept it depends on the rules above, so check them before registering.

Questions to ask your state board or ethics counsel

1. Does our state accountancy law treat working papers as the firm's property, and does it add confidentiality duties beyond the AICPA Code?
2. Is de-identified client information still confidential client information for our purposes?
3. Which of our internal records embed client information, and what redaction would make them usable?
4. Do our engagement letters say anything about data use, retention or destruction?
5. If we introduce a client company, is it an attest client, and what do ET 1.520 and our state rule then allow?
6. Do any of our audit clients bring SEC or PCAOB independence rules into play?

This is general information, not legal, tax or financial advice. Confirm with your own counsel, tax adviser or professional body before acting.

Next step

If your firm's own operating records look promising, or a client company with years of its own records has agreed to an introduction, register as a partner. Client companies can also go straight to sourcex.si/apply with your referral code attached. Check who qualifies for the baseline, and see referral opportunities for accountants for how the program fits a firm.