A CPA firm is an accounting practice licensed by a state board of accountancy to provide accounting, auditing, and tax services to the public. The firm’s license is separate from the individual CPA credentials of the people who work there, and it is the firm-level license that authorizes restricted services like auditing financial statements. CPA firms range from solo practitioners to global organizations with thousands of partners, but they share a common regulatory backbone: state licensing, ownership rules that keep CPAs in control, and mandatory quality reviews.
What Sets a CPA Firm Apart
Anyone with a Preparer Tax Identification Number can prepare a tax return, and plenty of bookkeepers and consultants handle day-to-day accounting without a CPA license. What sets a CPA firm apart is its exclusive legal authority to perform attest services. Under the model legislation adopted in some form by every state, attest services include audits, reviews, and examination or agreed-upon-procedure engagements performed under professional auditing standards. Only a licensed CPA working through a licensed CPA firm can sign off on those engagements. A compilation, which assembles financial data management provides without expressing an opinion, falls outside most states’ definition of attest work and can sometimes be performed by non-CPA firms.
This attest authority exists because investors, lenders, and regulators rely on the independence of the opinion. When a CPA firm issues an audit report, it is telling the world that the financial statements are fairly presented. That opinion carries legal weight because the firm is licensed, insured, peer-reviewed, and subject to discipline if it gets the work wrong.
What CPA Firms Do
Assurance and Attest Work
The audit is the flagship product. The firm examines a company’s internal controls and financial records and issues an opinion on whether the financial statements are fairly presented in all material respects. For publicly traded companies, audited financial statements are a non-negotiable requirement: the SEC requires that registration statements include financial statements audited by an independent public accountant.1U.S. Securities and Exchange Commission. Public Companies Annual reports sent to shareholders ahead of proxy votes must also include audited financials.2U.S. Securities and Exchange Commission. Financial Reporting Manual – Topic 1 Registrant’s Financial Statements
A review engagement provides a middle ground. The firm applies analytical procedures and makes inquiries of management, then states whether it found anything that would require material changes to bring the statements in line with accounting standards. Reviews are common for privately held companies that need some level of third-party assurance for lenders or investors without the cost of a full audit. A compilation sits at the bottom of the assurance ladder: the firm organizes management’s numbers into financial statement format but expresses no opinion on whether those numbers are correct.
Tax Compliance, Planning, and Representation
Tax work splits into two categories that often overlap. Compliance means preparing and filing returns themselves, tracking deadlines, calculating estimated payments, and making sure the numbers reconcile to the books. Tax planning looks forward: structuring transactions to manage state and local tax obligations across multiple jurisdictions, evaluating entity-selection decisions, coordinating international reporting, and timing income recognition. The code changes frequently enough that planning advice from even two years ago can be dangerously stale.
CPAs also hold full, unlimited representation rights before the IRS under Treasury Circular 230. A CPA can represent you in audits, appeals, and collection proceedings at every administrative level of the agency.3Internal Revenue Service. Treasury Department Circular No. 230 Non-credentialed tax preparers can only represent clients on returns they personally prepared, and only before certain IRS employees. Enrolled agents also hold unlimited representation rights, but they cannot perform attest services.
Advisory and Consulting
Beyond auditing and tax, CPA firms offer consulting engagements that draw on their financial expertise. Forensic accounting involves digging through financial records to identify fraud, embezzlement, or hidden assets, often in litigation or internal investigations. Business valuation requires estimating the fair market value of a company, intellectual property, or other complex assets for mergers, partner buyouts, or estate planning.
Independence rules that dominate attest work are significantly relaxed in the advisory space, which allows the firm to act as a close strategic partner to management. That said, a firm that provides consulting services to a client generally cannot also audit that same client’s financial statements. The Sarbanes-Oxley Act made this conflict explicit for public company auditors, and the underlying independence principles apply to private engagements under the AICPA’s ethical standards.
Who Can Own a CPA Firm
CPA firm ownership is not a free market. Under the Uniform Accountancy Act, the model legislation published by the National Association of State Boards of Accountancy, a simple majority of the firm’s ownership in terms of both financial interests and voting rights must belong to individuals who hold an active CPA license.4NASBA. Uniform Accountancy Act, 9th Edition Most states have adopted this rule or something close to it, with some requiring even higher thresholds.
The purpose is straightforward: the people who control the firm’s professional standards and sign its audit opinions should be accountable to the licensing board. Non-CPA owners, where state law permits them at all, typically cannot hold themselves out as CPAs or sign attest reports. If a firm’s ownership composition falls below the required CPA threshold through a partner’s retirement, death, or license suspension, the firm usually has a short cure period before its license is at risk.
How CPA Firms Are Organized
CPA firms operate under the same menu of business structures available to other professional service businesses: general partnerships, limited liability partnerships, professional corporations, and limited liability companies. The choice matters most for personal liability exposure.
In a general partnership, each partner is personally liable for the firm’s debts and for the professional negligence of every other partner. That risk is why most multi-partner firms now organize as limited liability partnerships or LLCs. Under those structures, a partner’s personal assets are generally shielded from claims arising out of another partner’s malpractice, though each partner remains fully liable for their own professional errors. Some states require firms organized as LLCs or professional corporations to carry minimum professional liability insurance as a condition of the liability shield, with required coverage amounts varying by jurisdiction.
State Board Licensing and Discipline
Each state’s board of accountancy grants and enforces CPA firm licenses independently. A firm that wants to practice in a given state generally needs a physical office there or must register as an out-of-state firm. Registration fees vary widely, typically falling between roughly $50 and several hundred dollars for an initial application. The board investigates complaints, conducts disciplinary proceedings, and can impose sanctions ranging from fines to full revocation of the firm’s license.
The firm license carries its own renewal cycle and continuing requirements separate from the individual licenses of the CPAs on staff. Letting the firm license lapse, even accidentally, can make every attest engagement the firm issues during the gap period legally defective. This is one of the administrative details that trips up smaller practices, where the same person handling client work is also responsible for regulatory filings.
Professional Standards and Peer Review
The American Institute of CPAs sets the ethical and technical standards that govern day-to-day practice. The AICPA’s Code of Professional Conduct applies to all AICPA members and establishes core principles including integrity, objectivity, independence, due care, and the public interest.5AICPA. Code of Professional Conduct The independence rules alone fill hundreds of pages, spelling out which financial relationships, business interests, and family connections can disqualify a firm or an individual from an attest engagement. Not every CPA is an AICPA member, but state boards generally adopt the AICPA’s auditing and ethics standards by reference.
Every CPA firm that performs audits, reviews, or other attest engagements must undergo an independent peer review of its quality management system once every three years.6AICPA & CIMA. Peer Review: A Vital Component in Audit Quality The review is conducted by another CPA firm or a team approved by the state CPA society or the AICPA’s Peer Review Board. A firm that receives anything less than a clean report faces potential consequences ranging from required corrective actions to loss of its license to perform attest work.
Extra Oversight for Public Company Auditors
Firms that audit publicly traded companies operate under a second layer of regulation from the Public Company Accounting Oversight Board. The PCAOB was created by the Sarbanes-Oxley Act of 2002 to protect investors after a string of high-profile accounting scandals.7Office of the Law Revision Counsel. 15 USC 7211 – Establishment; Administrative Provisions Any firm that issues or substantially contributes to an audit report for a public company must register with the PCAOB; performing this work without registration is unlawful.8Public Company Accounting Oversight Board. Rules – Section 2: Registration and Reporting
The PCAOB conducts its own inspections entirely separate from the AICPA’s peer review program.9Public Company Accounting Oversight Board. Basics of Inspections Inspections test individual audit engagements for compliance with PCAOB standards and can result in public reports identifying deficiencies, enforcement proceedings, and significant financial penalties.
What Confidentiality Actually Covers
CPA firms handle some of the most sensitive financial data a person or business produces, and the profession’s ethical rules treat confidentiality as a fundamental obligation. Under AICPA Rule 1.700.001, a member in public practice cannot disclose confidential client information without the client’s specific consent. Firms are expected to have written policies governing data security, limit access to client files, and retain information only as long as the engagement requires.
Federal law adds a limited layer of legal privilege, but it is narrower than many clients assume. Under 26 U.S.C. ยง 7525, communications between a taxpayer and a federally authorized tax practitioner, including CPAs, receive the same confidentiality protections as attorney-client communications only in noncriminal tax matters before the IRS and noncriminal tax proceedings in federal court.10GovInfo. 26 USC 7525 – Confidentiality Privileges Relating to Taxpayer Communications The privilege does not apply in criminal cases, in state court proceedings, or to any written communications connected to promoting a tax shelter. A conversation with a CPA does not carry the same blanket protection as a conversation with a lawyer.
Verifying a Firm Before You Hire It
Before hiring a CPA firm, you can confirm its license status through CPAverify, a free national database maintained by NASBA. The tool is populated with official licensing data sent directly from state boards and includes records of enforcement actions, disciplinary orders, and non-compliance markers.11NASBA. All About CPAverify You can search by individual CPA name or by firm name, and the database draws from over 50 participating jurisdictions.
If you find a disciplinary action on a firm’s record, contact the relevant state board of accountancy directly for the details. The board can tell you whether the issue was resolved, whether conditions were imposed on the firm’s license, and whether the firm is currently authorized to practice.