Agree how your accountant handles third-party demands for records

An accounting provider may receive a request from a lender, owner, buyer, regulator or party to a dispute. Agree how it identifies the requester and determines what response is permitted or required. A person claiming an interest in the company does not, by that fact alone, settle which confidential records the provider should release.

Have appropriate counsel review the actual contractual and legal obligations. The purchasing task is to establish a notification and decision process before a demand arrives. Do not ask the provider to promise that it will ignore lawful requirements or always obtain company consent when the applicable rules do not permit that condition.

Identify a primary and alternate recipient for third-party demands. Ask the provider to notify them promptly where permitted, with the request, stated deadline and proposed next step. Keep routine customer confirmations separate from sensitive legal or regulatory demands so urgent matters do not disappear into an ordinary support queue.

AICPA engagement guidance identifies confidentiality and other business terms as matters for the agreement. Make those terms operational by defining who reviews a request and how the provider records the decision. Any restriction on notification should be handled with qualified advice, not an assumption that the company can veto every disclosure.

Ask how the provider identifies responsive records across its own systems and subcontractors. Distinguish client documents, agreed deliverables and internal working papers. Those categories may have different treatment under the contract and applicable rules. Avoid a promise that the company automatically owns or controls every file created during an engagement.

FTC security guidance supports limiting access to sensitive information. Require a controlled route for collecting and reviewing the requested material, with access confined to authorized participants. The team should not send an entire archive merely because extracting the relevant subset takes additional effort.

Record what was disclosed, to whom, when and under what authority, subject to applicable restrictions. Preserve the approved version and transmission evidence. A later finance leader needs to understand the disclosure without reconstructing an informal exchange between a former employee and the provider.

Discuss how the provider handles a preservation instruction and suspension of ordinary deletion where required. Counsel should define the relevant obligation and scope. The operational agreement should identify the contact, acknowledgment and systems affected so the instruction reaches the people who manage retention.

Ask how search, review, copying, professional consultation and response work are charged. Establish who can approve discretionary additional work and how urgent required action is communicated. A broad indemnity or reimbursement clause deserves appropriate legal review before it becomes the only basis for an unexpected bill.

Obtain a status note identifying the response completed, open questions and any continuing preservation requirement the company needs to understand. Keep privileged or restricted material under the handling instructions established by counsel. Do not distribute the request broadly merely to prove that it was received.

At the next engagement review, fix any practical gap exposed by the event, such as an outdated contact or inaccessible archive. The objective is a provider that can respond deliberately and lawfully while giving the company appropriate visibility, rather than relying on improvised decisions when an unfamiliar requester appears.