ASF Audits head of education Shelley Banton explained that the new rules provide updated definitions for outsourced services and cloud computing.

Under the revised standard, an outsourced service is defined as a a service involved in outsourcing a material business activity to an outsourced service provider, who may not be located in the same country or may not even be a member of a professional body, she said.

“On the other hand, cloud computing refers to computing resources provided over the internet, including on-demand access to networks, servers, data storage, databases, software and applications. Cloud computing entrusts the remote third party with data and information of the SMSF firm’s clients,” she explained.

“Where either of these new requirements are met, SMSF practitioners must document and communicate with their SMSF trustee clients by updating their engagement letters to include the details of the provider, the geographic location of where the services will be performed and the nature and extent of the services to be utilised.”

The revised guidance also addresses compliance and privacy issues, Ms Banton said.

“Paragraph 3.5 of APES 305 states that using outsourced services or cloud computing may impact the amount of risk associated with delivering professional services and managing a client’s confidential information,” she noted.

“The revised standard also references APES GN 30 Outsourced Services (APES GN 30) to help firms identify whether a service is an outsourced service.”

Ms Banton said the revised standard provides a timely reminder that the SMSF practitioner “retains the primary responsibility to deliver the service in line with their engagement letter and must comply with the ethical requirements of APES 110 and all other professional standards”.

APES GN 30 also recommends that firms develop and document an outsourcing policy framework containing policies and procedures to manage business, operational and other risks.

The framework assists with setting the performance of the agreement and enabling the SMSF firm to conduct appropriate due diligence before working with the outsourced service provider, Ms Banton explained.

Some of the matters which should be considered and assessed in relation to the service provider’s business, she said, include ensuring there are policies and procedures that meet professional obligations, checking there is sufficient staff with the necessary professional competencies and skills, the communication skills of the provider and their personnel, the adequacy of contingency and business continuity plans, and the ability to conduct the services on a ongoing basis.

“The reality is that the firm retains the obligation to monitor and review their work to ensure it complies with professional standards applicable to the engagement,” she said.

“To this end, developing an outsourcing agreement will manage the risks of transition and implementation. It will also ensure that SMSF firms check whether their professional indemnity insurance policy contains adequate coverage for these services.”

One of the other critical considerations in regard to the revised standard is whether the professional services being outsourced constitute material business activity for a firm.

“It would be a mistake to underestimate the concept of material business activity as it does not just refer to fees. Material business activity refers to an entity or firm whose business activities have the potential, if disrupted, to significantly impact the quality, timeliness or scale of services,” she cautioned.

“One of the most critical aspects is that the material business activity assessment is performed from both the firm’s and the SMSF trustee’s perspectives: it is essential to judge each case based on the particular facts and circumstances.”

Ms Banton said there is a lot to consider with the revised standard such as challenging firms to establish policies and procedures designed to manage risk, putting appropriate quality control requirements in place and overhauling SMSF engagement letters.

“Documenting and communicating the terms of engagement will also ensure a clear understanding between SMSF trustees and advisers and is in both parties’ best interests,” she said.