An AICPA engagement letter is the written contract between a CPA firm and its client that spells out what the firm will do, what the client is responsible for, how fees will be charged, and where the boundaries of the relationship sit. AICPA professional standards require a signed written understanding for most services, including audits, reviews, compilations, and preparation engagements. Firms that use one face malpractice claims that are up to 71 percent less severe or expensive to settle than claims where no letter was in place.
Why the Letter Matters
Skipping the letter or working from a handshake is one of the costliest mistakes a firm can make. Without written terms, the firm has no documented defense against a client who later claims the firm promised broader services, guaranteed a particular outcome, or failed to meet an expectation that was never actually discussed.
The compliance side is just as concrete. AICPA standards for audits, reviews, compilations, and preparation engagements all require a written understanding with the client. Performing those services without one puts the firm out of step with the standards it is obligated to follow, regardless of how the work itself turns out.
Elements Every Engagement Letter Needs
Certain components belong in every letter, whatever the service. Ambiguity in any of these areas is what a disgruntled client’s attorney will exploit later.
- The full legal name of the CPA firm and of the client entity or individual. Vague references like “the company” cause trouble when ownership is disputed or a subsidiary is involved.
- The engagement period. State clearly whether the letter covers a calendar year, a fiscal year, a specific project, or a recurring cycle, and when the firm’s obligations begin and end.
- The fee structure. Fixed fee, hourly billing with rates broken out by partner, manager, and staff level, or a hybrid. Include payment terms and deadlines.
- Termination rights. Firms typically reserve the right to withdraw if the client fails to pay invoices, refuses to provide records, or asks the firm to take positions that violate professional standards. The client usually retains the right to terminate on written notice, subject to paying for work completed through that date.
- Scope change procedures. At minimum, state that any expansion of the original scope requires a written amendment signed by both parties, along with an adjusted fee agreement.
Contingent fees deserve special attention. The AICPA Code of Professional Conduct prohibits contingent fees for services performed for a client that also receives an attest engagement from the firm, such as an audit, review, or compilation. Outside of attest services, contingent fees are permitted in certain tax matters, including representing a client during an IRS examination or filing a refund claim that will undergo substantive review. But a contingent fee is not permitted where, for example, a firm prepares an amended return claiming a refund for a deduction that was simply left off the original filing.1AICPA & CIMA. AICPA Code of Professional Conduct
Defining Scope and Its Limits
Most of the protective value of an engagement letter lives in the scope section. A firm that writes “we will prepare your tax return” without specifying which returns, which tax year, and which standards govern the work has essentially signed a blank check for future disputes.
A tax engagement letter should identify the specific forms the firm will prepare, whether that is a Form 1040, 1120, 1065, or state returns, and should state that the engagement covers only the tax year specified.2AICPA & CIMA. 2025 Individual Tax Return Engagement Letter – Form 1040 An audit letter should identify the financial statements being audited, the applicable financial reporting framework, and the expected form and content of the auditor’s report. A compilation or preparation letter should specify the financial statements being assembled and the basis of accounting being used.
Equally important is what the letter says the firm is not doing. Every engagement has built-in limitations, and clients who don’t understand them become plaintiffs. A standard audit provides reasonable assurance that financial statements are free from material misstatement, but it does not guarantee that every error or fraud will be caught. For audits, AU-C Section 210 requires a statement that because of the inherent limitations of an audit and of internal control, an unavoidable risk exists that some material misstatements may not be detected even when the audit is properly planned and performed.
For tax work, the letter should state that the firm relies in good faith on the accuracy and completeness of the information the client provides, without independent verification. Circular 230 supports that reliance but also requires the practitioner to make reasonable inquiries if information furnished by the client appears incorrect, inconsistent, or incomplete.3eCFR. 31 CFR 10.34 – Standards With Respect to Tax Returns and Documents, Affidavits and Other Papers The letter should reflect both sides of that coin.
Tailoring the Letter by Service Type
Audit and Review Engagements
Audit and review letters carry the heaviest requirements because the firm is expressing some level of assurance about financial statements. For audits, AU-C Section 210 requires at least six elements: the objective and scope of the audit, the auditor’s responsibilities, management’s responsibilities, an acknowledgment of the inherent limitations of the audit and internal controls, identification of the applicable financial reporting framework, and reference to the expected form of the auditor’s report.
The letter must also confirm the firm’s independence. AICPA rules require independence for all attest services, and depending on the client, additional independence requirements from the SEC, the PCAOB, the Department of Labor, or the Government Accountability Office may apply.4Public Company Accounting Oversight Board. ET Section 101 – Independence The letter should acknowledge those overlapping obligations so the client understands the firm is not simply following its own internal policies.
A review provides limited assurance, which is a fundamentally different product from an audit. The letter must make the distinction unmistakable, state that the firm is not expressing an opinion on the financial statements, and note that the scope of a review is substantially less than an audit. Clients who don’t understand that difference are the ones who later claim the firm “should have caught” something only a full audit would have revealed.
Compilation and Preparation Engagements
Compilation and preparation engagements provide no assurance whatsoever, and the letter must hammer that point home. A compilation letter states that the firm is presenting management’s financial data in the form of financial statements without undertaking to express any assurance on them.
A preparation engagement, governed by AR-C Section 70 under SSARS, is used when a firm prepares financial statements but does not issue a report on them. The letter must still document that the firm will not verify the completeness or accuracy of client-provided information. Each page of the prepared financial statements must include a legend stating that no assurance is provided.5CAMICO. SSARS No. 21 Risk Management and Implementation Issues SSARS requires that all compilation and preparation engagement letters be in writing and signed by both the firm and the client’s management.
Tax Engagements
The primary authority for tax engagement conduct is Treasury Department Circular 230, which requires practitioners to communicate clearly with the client regarding the terms of the engagement. SSTS No. 4 mentions engagement letters as something a practitioner should consider when representing clients, but does not govern them.6The Tax Adviser. Best Practices for Engagement Letters, POAs, and Tax Return Extensions
The tax letter must clearly assign responsibility for the information reported on the return. The client holds ultimate responsibility for accuracy and completeness, even though the firm prepares the return. The firm relies on client-provided data without independent verification, as permitted under Circular 230 Section 10.34(d), but must make reasonable inquiries when something looks wrong.3eCFR. 31 CFR 10.34 – Standards With Respect to Tax Returns and Documents, Affidavits and Other Papers
The letter should also address penalties. If the IRS challenges positions on the return, the client needs to understand upfront that the firm will advise on potential penalties and interest but cannot guarantee that every position will survive examination. The letter should state that the firm is not obligated to update its advice for later changes in tax law unless the client specifically engages the firm for ongoing monitoring.
If the firm will represent the client before the IRS, the letter should address whether a Form 2848 will be executed and the scope of the representation it authorizes.7Internal Revenue Service. Instructions for Form 2848, Power of Attorney and Declaration of Representative
Consulting Engagements
Consulting letters cover advisory work like internal controls assessments, forensic accounting, or transaction due diligence. The letter must state that the firm is not providing any form of assurance or opinion on the subject matter, and that the firm offers recommendations based on professional judgment and the information available at the time.
Consulting engagements are the most prone to scope creep because the client’s needs often evolve as the firm digs into the work. Define the specific deliverables, the information the client must provide, and the point at which additional work requires a scope amendment. State that the client is responsible for its own decisions about whether to act on the firm’s recommendations.
Firm and Client Responsibilities
Every letter must draw a clear line between what the firm is responsible for and what falls on the client’s management. That separation is required by AICPA standards for attest engagements and is the foundation of most malpractice defenses.
The firm’s responsibilities include performing the engagement in accordance with the applicable standards, whether that is Statements on Auditing Standards for audits, SSARS for compilations and reviews, or Circular 230 for tax work. The firm must maintain confidentiality over client information, subject to exceptions required by law or professional standards. For attest engagements, the firm must affirm its independence.
Management bears responsibility for the accuracy and completeness of the data it provides. Management must furnish all financial records and documents needed to complete the engagement on time. For audits and reviews, management must also acknowledge responsibility for designing, implementing, and maintaining internal controls relevant to the preparation and fair presentation of the financial statements.
At the conclusion of an audit or review, management is required to provide a written representation letter. AU-C Section 580 specifies its contents: confirmation that management has fulfilled its responsibilities for the financial statements and internal controls, that it has provided the auditor with all relevant information and access, that all transactions are recorded, and that it has disclosed all known fraud, noncompliance with laws, related-party transactions, subsequent events, and pending litigation.8American Institute of Certified Public Accountants. AU-C Section 580, Written Representations The engagement letter should reference this obligation so management is not surprised by the request at the end of the engagement.
Risk Management and Liability Provisions
Limitation of Liability
A limitation of liability clause attempts to cap the firm’s financial exposure, typically at a multiple of fees paid for the engagement or a specific dollar amount. These clauses are common and can be effective, but enforceability depends on the jurisdiction and the type of client. Courts in some states have held that because CPAs are state-regulated professionals serving the public, limiting their liability is contrary to public policy.
For certain clients, limitation of liability provisions are flatly prohibited. The AICPA Code of Professional Conduct treats it as an act discreditable to the profession to perform an attest engagement when the agreement contains limitation clauses prohibited by law or regulation. Clients regulated by the SEC, state insurance commissions, and federal banking regulators generally fall into that category.1AICPA & CIMA. AICPA Code of Professional Conduct Confirm with legal counsel whether a proposed limitation clause is enforceable before relying on it.
Indemnification
Indemnification clauses, where the client agrees to hold the firm harmless for losses arising from the client’s own acts, are a separate matter. For non-attest services like tax preparation, broad indemnification language is common and generally permissible. Many tax letters include a clause stating that if penalties result from the client providing inaccurate or incomplete information, the client will indemnify the firm for those penalties.
For attest engagements, the rules are stricter. The AICPA Code prohibits a firm from entering into an indemnification agreement with an attest client because doing so impairs the firm’s independence. A firm that indemnifies an attest client against the client’s own losses, or that accepts indemnification in a way that compromises its objectivity, has violated the independence requirements.1AICPA & CIMA. AICPA Code of Professional Conduct
Dispute Resolution
A dispute resolution clause is not required by AICPA standards, but it is one of the most valuable provisions a firm can include. Requiring mediation before arbitration, or arbitration before litigation, reduces the time and cost of resolving disagreements. Specify the location and governing rules for the process. Some firms also include a prevailing-party attorneys’ fee provision to discourage frivolous claims.
Working Papers and Subpoena Response
The letter should state that the firm owns the working papers generated during the engagement. While the client receives the final work product, the underlying documentation belongs to the firm. That ownership right is well established in professional standards and state law, though clients generally retain the right to request copies of records needed to comply with tax obligations.
Because CPA firms frequently receive subpoenas and other third-party requests for client documents, a subpoena reimbursement clause is worth including. The clause should state that the client will reimburse the firm for professional time and legal costs incurred in responding to third-party legal process related to the engagement. For attest services, this language must be carefully worded so it does not become an impermissible indemnification provision.
The letter should also address the firm’s obligations when it encounters evidence of illegal activity. Under AICPA Section 360, a firm that discovers noncompliance with laws and regulations must comply with applicable legal and regulatory requirements, which may include reporting to an appropriate authority. In some circumstances, such as those arising under anti-money laundering laws, the firm may be prohibited from alerting the client about the report.9AICPA & CIMA. Section 360 – Responding to Non-Compliance With Laws and Regulations
Data Security and Privacy Language
CPA firms handle some of the most sensitive personal and financial data a client possesses. Under the FTC Safeguards Rule, which implements the Gramm-Leach-Bliley Act, CPA firms are classified as financial institutions and are required to maintain a Written Information Security Program.
The letter should describe in general terms the security measures the firm employs, including access controls, encryption, and monitoring. It should state what the firm will do in the event of a data breach, including notification obligations under applicable state and federal law. If the firm uses third-party cloud platforms or outsources any processing, the letter should disclose that and confirm that service providers are contractually required to maintain appropriate security safeguards.
Annual Renewal Versus Evergreen Letters
Some firms use evergreen engagement letters that remain in effect indefinitely until one party terminates. That is a risk management trap. Evergreen letters do not prompt the routine confirmation of expectations and services that annual letters require. Over time, the client’s needs change, the firm’s services evolve, and the original letter no longer reflects reality. The result is scope creep with no documented authorization and a weaker defense if a claim arises.
Evergreen letters also create statute of limitations problems. Because they lack affirmative language about when the engagement concludes, firms may lose the ability to argue that the limitations period has run on older work. The cost to resolve claims connected to evergreen letters is significantly higher than claims involving annual letters.10AICPA & CIMA. Say I Do to Engagement Letters
Best practice is to issue a new engagement letter for each engagement period, have it signed by both the firm and the client before any work begins, and update the letter whenever the scope of services changes.
Accepting Engagement Letters Electronically
Electronic signatures are legally valid for engagement letters under the Electronic Signatures in Global and National Commerce Act, which has been mirrored in some form by all states. Firms using e-signature platforms should retain the audit trail documentation from those platforms, as it supports enforceability if the signed letter is later challenged.
A few practical points matter. Sign close to the time of engagement acceptance discussions but before any work begins. If the client signs weeks or months after work has started, a dispute may arise about whether the terms were actually agreed to before services were rendered. When multiple documents require a signature, each should carry its own e-signature rather than a single blanket acknowledgment. The more identity verification the e-signature process requires, the harder it becomes for a client to later claim the signature wasn’t authentic.