CPA Compliance: Licensing, Ethics, and Circular 230

CPA compliance requirements come from several regulators at once, and which ones bind you depends on what you do. Every licensed CPA answers to a state board of accountancy for licensure and continuing education. AICPA members follow the Code of Professional Conduct. CPAs who represent taxpayers before the IRS fall under Circular 230. Anyone handling taxpayer data must meet the FTC Safeguards Rule. Firms performing audits, reviews, or compilations add peer review, and firms auditing public companies add PCAOB registration and inspection on top of everything else. No single rulebook covers it all, and the fastest route to a disciplinary problem is assuming a layer that applies to you doesn’t.

State Licensing, CPE, and Firm Permits

The state board of accountancy is the regulator most CPAs deal with most often. Each board sets the education, experience, and examination standards for initial licensure and enforces ongoing compliance through renewal cycles and continuing professional education.

CPE hour requirements vary by jurisdiction. AICPA members must complete 120 hours over each three-year reporting period.¹ State boards may use two-year cycles instead, with different total-hour thresholds, and many impose an annual floor — often 20 hours — so a practitioner cannot backload all education into the final year of a cycle. Most states also require an ethics course, frequently one covering that state’s specific accountancy statutes and rules, and require that technical subjects such as accounting, auditing, and taxation make up a substantial portion of total hours.

Keep certificates of completion and course documentation for several years past each reporting period. State boards audit CPE compliance at random, and shortfalls can bring fines, mandatory make-up hours, and formal disciplinary proceedings. When you renew your license, you attest under penalty of disciplinary action that you have met the CPE requirements for the preceding period. Falsifying that attestation is itself a violation.

Individual licenses renew annually or biennially depending on the state, with a fee. CPA firms need their own permit to practice in most states, separate from any individual license. Firm permit rules typically require CPAs to hold an ownership majority, require reporting of ownership and office changes within a set window, and set the firm’s own renewal cycle. Where non-CPA ownership is permitted, those owners generally must hold a minority stake and materially participate in the business.

Practicing Across State Lines

All 55 U.S. accountancy board jurisdictions recognize substantial equivalency, so a CPA licensed in one state can generally practice in another without a second license if their own credentials meet the individual education, examination, and experience standards.² The framework has been shifting from a state-based equivalency determination to an individual-based one, so it is the CPA’s own credentials that increasingly control mobility rather than the home state’s overall status.³

Mobility does not shed oversight. When you practice in another state, that state’s board has disciplinary authority over your conduct there. Because boards share information through NASBA, a sanction in one jurisdiction can cascade into license actions in the home state and any other state where you hold practice privileges.

Ethical Rules Under the AICPA Code

Every AICPA member is bound by the Code of Professional Conduct. Its principles are aspirational, but the rules and interpretations built on them are enforceable.⁴ In practice, the duty runs to the public first, integrity is required within the limits of client confidentiality, and due care obligates you to stay current on technical and ethical standards and to perform each engagement competently.

Confidentiality

A CPA in public practice cannot disclose confidential client information without the client’s specific consent. The narrow exceptions include complying with a valid subpoena, participating in a peer review, and responding to an investigation by a recognized disciplinary body.⁴ The obligation survives the end of the engagement.

Contingent Fees

Contingent fees are prohibited for audits, reviews, and compilations when a third party will rely on the financial statements. The same prohibition covers preparing original or amended tax returns and refund claims on a contingent basis.⁴

The Code carves out several situations where contingent fees are allowed: representing a client during an IRS examination, filing an amended return based on a tax issue that is the subject of a test case involving another taxpayer, requesting a refund of penalty overpayments where the taxing authority has established a substantive review process, and fees fixed by courts or other public authorities.⁴

Independence for Attest Engagements

Independence is the most scrutinized area for any CPA performing audits, reviews, or other attest work. The Code requires both independence of mind — professional judgment genuinely free from outside influence — and independence in appearance, meaning a reasonable outside observer would not conclude your objectivity has been compromised.⁴

The AICPA’s conceptual framework identifies seven categories of threats, including self-interest, self-review, familiarity, and management participation. When a threat is present, the CPA or firm must apply safeguards to eliminate it or reduce it to an acceptable level. Safeguards come from three sources: the profession or regulators (such as peer review), the client (such as an active audit committee), and the firm itself (such as internal quality controls and engagement partner rotation).⁴

For CPAs auditing public companies, the PCAOB imposes independence rules on top of the AICPA’s. Registered firms must apply whichever standard is more restrictive when the PCAOB’s interim standards and the SEC’s auditor independence rules overlap.⁵

Tax Practice Rules Under Circular 230

If you represent clients before the IRS, prepare returns, or provide written federal tax advice, you fall under Treasury Department Circular 230.⁶ Circular 230 governs attorneys, CPAs, enrolled agents, enrolled actuaries, enrolled retirement plan agents, and registered tax return preparers.⁷

PTIN and EFIN Registration

Before preparing any federal return for compensation, you need a valid Preparer Tax Identification Number. The PTIN renews annually, and the application or renewal fee for 2026 is $18.75.⁸ Online applications typically process in about 15 minutes; paper applications on Form W-12 take around six weeks.

To e-file returns, you also need an Electronic Filing Identification Number. Getting an EFIN means applying through IRS e-services and passing a suitability check that includes a credit check, tax compliance review, and criminal background investigation. Approval can take up to 45 days.⁹ Preparing returns for compensation without a current PTIN exposes you to penalties.

Due Diligence and Client Errors

Circular 230 requires practitioners to exercise due diligence when preparing returns and other IRS documents. You can rely on information the client gives you, but you cannot ignore signs that something is wrong or incomplete.

When you discover that a client has failed to comply with the tax laws or has made an error in a previously filed return or document, you must promptly inform the client of the noncompliance and explain the consequences under the Internal Revenue Code.¹⁰ You are not required to report the error to the IRS without the client’s permission, but the duty to advise the client is absolute. If the client refuses to fix the problem, you must consider whether continuing the engagement is appropriate.

Written Tax Advice

Written advice on federal tax matters triggers additional requirements. You must base the advice on reasonable factual and legal assumptions, make reasonable efforts to identify all relevant facts, and consider all relevant circumstances. You cannot rely on representations from the taxpayer or any other party if that reliance would be unreasonable.¹¹

Two limits are worth memorizing. You may not evaluate a tax position by factoring in the likelihood that the return will never be audited. And you may not rely on another advisor’s work unless that advice was itself reasonable and your reliance is in good faith; if you know the other advisor lacks competence or has a conflict, the reliance is unreasonable by definition.¹¹ Compliance is judged under a reasonable-practitioner standard that accounts for the scope of the engagement and the specificity of the advice the client requested.

Sanctions

The IRS Office of Professional Responsibility investigates alleged Circular 230 violations. Available sanctions are censure (a public reprimand), suspension from practice before the IRS, and disbarment, which permanently revokes the CPA’s privilege to represent clients before the agency. Monetary penalties can be imposed on the practitioner, the firm, or both, capped at the gross income derived from the sanctioned conduct, and can be layered with or substituted for censure, suspension, or disbarment.¹²

Separately, the IRS can impose statutory preparer penalties for understating a taxpayer’s liability. Under Section 6694(a), an understatement due to an unreasonable position carries a penalty of $1,000 or 50 percent of the preparer’s income from that return, whichever is greater. Willful or reckless conduct under Section 6694(b) raises the penalty to $5,000 or 75 percent of the preparer’s income from the return.¹³

Data Security Obligations

Any CPA who handles taxpayer data is a “financial institution” under the FTC Safeguards Rule and must develop, implement, and maintain a written information security program appropriate to the size and complexity of the practice.¹⁴ The rule applies at every firm size, which is where solo practitioners and small firms most often fall behind.

The program must designate a qualified individual to oversee it, include a written risk assessment, encrypt client information both at rest and in transit, require multi-factor authentication for access to client data, and include a written incident response plan. Staff training, service provider monitoring, and regular testing of safeguards are also required.¹⁴

The IRS reinforces the same requirements through Publication 4557, which expects tax practitioners to maintain a Written Information Security Plan (WISP) documenting how they prevent, detect, and respond to data incidents.¹⁵ A firm that cannot show a written, regularly updated security program is out of compliance whether or not it has ever had a breach.

Peer Review and PCAOB Oversight for Attest Work

If your firm issues attest reports, you carry additional layers. Firms performing audits, reviews, and certain compilations must maintain a system of quality management covering the entire accounting and auditing practice, addressing independence, personnel management, client and engagement acceptance, engagement performance, and monitoring.¹⁶ AICPA quality management standards add formal risk assessment and remediation processes for firms doing non-public attest work.

Peer Review

Firms that issue attest reports must undergo external peer review, generally once every three years, conducted by an independent CPA firm or a state society-approved reviewer under AICPA oversight administered by state societies.¹⁷ A System Review applies to firms that perform audits or examinations of prospective financial statements and evaluates the firm’s whole quality management system. An Engagement Review, used for firms whose highest-level service is reviews, compilations, or agreed-upon procedures, looks at selected engagements rather than the system.

Reviews result in a rating of Pass, Pass with Deficiencies, or Fail.¹⁷ Anything below Pass requires a corrective-action letter. Failure to remediate deficiencies can result in termination from the program, which typically means loss of AICPA and state society membership and can prevent the firm from performing attest work at all.

PCAOB Registration and Inspections

Firms auditing publicly traded companies must register with the PCAOB and comply with its auditing, ethics, and independence standards.¹⁸ Registered firms file an annual report on Form 2, due each year by June 30, covering the period from April 1 through March 31.¹⁹

The PCAOB inspects registered firms on a schedule tied to firm size. Firms that regularly audit more than 100 public companies are inspected annually; firms that audit 100 or fewer issuers are inspected at least once every three years.²⁰ Inspections review individual engagements and evaluate the firm’s quality control system. Deficiencies that go unremediated within 12 months become public.

When a Client Is Breaking the Law

The AICPA Code’s interpretation on Responding to Noncompliance With Laws and Regulations, known as NOCLAR, applies to all members in public practice. It covers situations where a client’s management, employees, or governance body has violated a law or regulation that either directly affects material financial statement amounts or is fundamental to the client’s business operations.

When you become aware of credible information suggesting noncompliance, the required first step is to understand the conduct and raise it with an appropriate level of client management or those charged with governance. You must continue to comply with the Confidential Client Information Rule, so disclosure to third parties without the client’s consent is generally off the table unless an exception applies, such as a legal reporting obligation.

If management will not address the issue, you must evaluate whether to withdraw from the engagement or end the client relationship entirely. NOCLAR does not turn CPAs into whistleblowers, but it does impose a structured obligation: escalate the issue inside the client organization, and when that fails, decide whether continuing the relationship is compatible with your professional duties. Silence is not a compliant option.

1
AICPA & CIMA. CPE Requirements and Credits
2
NASBA. Substantial Equivalency
3
NASBA. New CPA Licensure Pathways and CPA Mobility
4
American Institute of Certified Public Accountants. AICPA Code of Professional Conduct
5
Public Company Accounting Oversight Board. Ethics and Independence Rules
6
Internal Revenue Service. Office of Professional Responsibility and Circular 230
7
eCFR. 31 CFR 10.3 – Who May Practice
8
Internal Revenue Service. PTIN Requirements for Tax Return Preparers
9
Internal Revenue Service. Become an Authorized E-File Provider
10
eCFR. 31 CFR 10.21 – Knowledge of Clients Omission
11
eCFR. 31 CFR 10.37 – Requirements for Written Advice
12
eCFR. 31 CFR 10.50 – Sanctions
13
Internal Revenue Service. Tax Preparer Penalties
14
Federal Trade Commission. FTC Safeguards Rule – What Your Business Needs to Know
15
Internal Revenue Service. Protect Your Clients, Protect Yourself
16
Public Company Accounting Oversight Board. QC Section 20 – System of Quality Control for a CPA Firms Accounting and Auditing Practice
17
AICPA & CIMA. Peer Review – A Vital Component in Audit Quality
18
Public Company Accounting Oversight Board. Section 3 – Auditing and Related Professional Practice Standards
19
Public Company Accounting Oversight Board. Form 2 – Annual Report Form
20
Public Company Accounting Oversight Board. PCAOB Inspection Procedures