CPA Ethics and Client Data When Using AI Quiz

Answers and explanations appear as you take the quiz.

1. Under the AICPA Confidential Client Information Rule, what is generally required before a member in public practice discloses confidential client information, outside the listed exceptions?
   • Approval from the state board of accountancy
   • The client's specific consent
   • A notice filed with the IRS
   • Nothing, as long as the recipient is a software vendor
2. What does Internal Revenue Code section 7216 primarily target?
   • Tax return preparers who knowingly or recklessly disclose or use tax return information outside permitted purposes
   • Companies that file financial statements late
   • Auditors who fail to meet independence rules
   • Taxpayers who underreport income
3. Which Internal Revenue Code section adds a civil penalty for improper disclosure or use of tax return information by preparers?
   • Section 179
   • Section 1031
   • Section 6713
   • Section 401(k)
4. When section 7216 consent is required, which description matches the regulations as summarized in the guide?
   • Verbal consent given at any time, even after the disclosure
   • An email from the preparer telling the client what happened
   • A general privacy notice posted on the firm's website
   • Written consent obtained before the disclosure, signed and dated by the taxpayer, in the prescribed format
5. Under the AICPA's third-party service provider interpretations, what is broadly expected before sharing confidential client information with an AI vendor?
   • Tell the client beforehand, and either have a confidentiality contract with the provider or get the client's specific consent
   • Nothing, as long as the vendor is large and well known
   • Only removing the client's name from documents
   • Filing a disclosure form with the AICPA
6. Why does the guide say that removing client names from a file does not make it anonymous?
   • AI tools automatically look up missing names
   • A combination of details such as location, income, business type and dates can still identify the client
   • Names are the only field that confidentiality rules cover
   • Anonymized data is always treated as tax return information
7. What does a SOC 2 Type II report tell a firm that a design-only review would not?
   • That the vendor's AI model never makes mistakes
   • That the vendor is licensed to practice public accounting
   • That the vendor's controls actually operated over a period of time
   • That the vendor processes data only in the United States
8. Which rule generally requires tax and accounting firms to maintain a written information security program?
   • The Sarbanes-Oxley Act
   • The Fair Labor Standards Act
   • ASC 606
   • The FTC Safeguards Rule