What Are the AICPA Standards for Consulting Services?

The AICPA standards for consulting services are set out in the Statement on Standards for Consulting Services No. 1 (SSCS No. 1), which every AICPA member must follow when advising clients, and they operate on top of the broader ethical and technical rules in the AICPA Code of Professional Conduct. Together, the two documents govern the whole life of a consulting engagement: what counts as consulting, how the CPA agrees on scope with the client, the competence and care required, how objectivity and confidentiality are protected, how the CPA can be paid, and what happens when the same client also receives audit or review services.

What Counts as Consulting Under SSCS No. 1

SSCS No. 1 applies whenever a CPA develops findings, conclusions, or recommendations for a client’s use. The nature and scope of the work are shaped entirely by the agreement between the CPA and the client, so a consulting engagement can be as small as a one-hour review of a business plan or as large as a multi-year system installation.

Several services are carved out because they have their own dedicated standards. SSCS No. 1 does not apply to work governed by Statements on Auditing Standards (SASs), Statements on Standards for Attestation Engagements (SSAEs), or Statements on Standards for Accounting and Review Services (SSARSs).¹ Tax return preparation, tax planning, bookkeeping, and personal financial planning are also excluded, along with any recommendations that come up as a byproduct of performing those services. Excluded services can be delivered on the same engagement as consulting work, but only the consulting portion is subject to the SSCS.

The Six Service Categories

SSCS No. 1 recognizes six categories of consulting work. Placing an engagement in the right category helps both sides set expectations about deliverables, control, and who does what.

Consultations. Short-turnaround advice drawn largely from the CPA’s existing knowledge of the client and the subject, such as reviewing a client-prepared business plan or suggesting software to evaluate.
Advisory services. Engagements where the CPA develops findings, conclusions, and recommendations for the client to act on. Operational improvement studies and strategic planning fit here.
Implementation services. Putting an action plan into effect, often working alongside the client’s own staff. Installing a computer system is a typical example.
Transaction services. Work tied to a specific deal, usually involving a third party. Valuations, M&A analysis, and insolvency work qualify.
Staff and other support services. The CPA supplies personnel who work under the client’s direction, including data-processing management, programming, or controllership.
Product services. Delivering a product along with the professional support needed to install and use it, such as packaged training or software.

Categories can blend. A single engagement often mixes advisory and implementation work, and the written agreement should reflect whatever combination applies.¹

The Three Practice Standards Specific to Consulting

SSCS No. 1 adds three practice standards on top of the general professional standards, and they exist because consulting engagements give the client far more control over scope and direction than an audit or review does.

Serve the Client’s Interest

The CPA must work toward the objectives set in the client agreement while maintaining integrity and objectivity. If it becomes clear during the work that the stated objective is unrealistic or would produce a harmful outcome, integrity requires the CPA to say so rather than keep billing.

Establish a Clear Understanding With the Client

Before work begins, the CPA and client must reach an understanding about each party’s responsibilities, the nature and scope of the services, and any limitations. Under SSCS No. 1 that understanding can be written or oral, though a written engagement letter is standard practice. If circumstances change significantly during the engagement, the understanding must be updated.¹

Communicate With the Client

The CPA must tell the client, as they arise, about conflicts of interest, significant reservations about the scope or expected benefits of the engagement, and significant findings or events discovered during the work. Noting a serious problem in the workpapers and moving on is not enough.

The General Standards That Apply to Every Engagement

The General Standards Rule in the AICPA Code of Professional Conduct applies to every professional service, consulting included. It sets four requirements.²

Professional competence. A CPA can accept only work that the member or firm can reasonably expect to complete with the necessary skill and knowledge. Unfamiliar areas require research, training, or bringing in a specialist before proceeding.

Due professional care. Every engagement demands the diligence and critical thinking a reasonably careful professional would apply in the same situation. In consulting, that means questioning the client’s assumptions, stress-testing recommendations, and documenting the reasoning behind key judgments.

Planning and supervision. The CPA must plan the engagement with defined objectives translated into a structured work program. When staff are involved, they must be qualified for their tasks and their work reviewed against the plan and professional standards.

Sufficient relevant data. Conclusions and recommendations must rest on enough reliable information to support them. If the data is incomplete or questionable, the CPA has to qualify the conclusions or decline to issue a recommendation. Data sources, analytical procedures, and the path from evidence to advice all need documentation.

Engagement Letters and Documentation

SSCS No. 1 allows an oral understanding, but the AICPA strongly recommends a written engagement letter for every consulting engagement. The letter should spell out the scope of services, the duration of the relationship, and the applicable fees or rates.³ Starting work before a signed letter is considered poor practice, and the AICPA recommends issuing a new letter each year rather than leaving an open-ended agreement in place.

Scope control is where the letter earns its keep. If the client asks for work beyond what the letter covers, that expansion needs a written addendum or a revised letter. Skipping that step tends to produce unpaid work with no clear standard of care attached to it. The letter should also address billing and payment terms, dispute resolution, record retention, and confidentiality.

When the consulting client also receives audit or review services from the same firm, documentation is stricter. The AICPA Code requires a written understanding covering the engagement objectives, the services to be performed, each party’s responsibilities, and any limitations.⁴

Integrity, Objectivity, and Confidentiality

The Integrity and Objectivity Rule in the AICPA Code covers a lot of ground in one sentence: a member must maintain objectivity and integrity, remain free from conflicts of interest, and not knowingly misrepresent facts or defer professional judgment to someone else.²

Conflicts of Interest

A conflict exists whenever a relationship or financial interest could color the CPA’s advice. When a conflict is present or arises during the engagement, the CPA must disclose it to the client and obtain informed consent before continuing. The SSCS practice standards reinforce this by requiring disclosure of conflicts as they arise, not only at the start.

Client Confidentiality

A CPA cannot disclose confidential client information without specific client consent. The rule carves out narrow exceptions for compliance with a valid subpoena or court order, cooperation with an authorized peer review, response to an AICPA or state-board ethics investigation, and compliance with applicable laws and government regulations.² When a CPA uses a third-party service provider, confidentiality still applies: before sharing client information, the CPA must either obtain client consent or enter into a contractual agreement requiring the provider to maintain confidentiality and demonstrate adequate safeguards.

How the CPA Can Be Paid

Compensation is not left to business judgment alone. The Code regulates fee structures because certain arrangements can compromise objectivity.

Contingent Fees

A contingent fee is any arrangement where payment depends on achieving a particular result. The Code prohibits contingent fees when the CPA or firm also performs an audit, a review, certain compilations, or an examination of prospective financial information for the same client.² The prohibition covers both the attest engagement period and the period covered by the historical financial statements involved.

For clients who receive only consulting and no attest work, contingent fees are generally allowed under AICPA rules. State boards of accountancy often go further. Some prohibit contingent fees on original and amended tax returns regardless of whether the CPA also performs attest work for that client.

Commissions and Referral Fees

The same attest-client prohibition applies to commissions. A CPA cannot accept a commission for recommending a product or service to a client for whom the CPA also performs an audit, review, or certain compilations, and the prohibition runs during the engagement period and the period covered by the financial statements involved.²

For non-attest clients, commissions and referral fees are permitted with mandatory written disclosure. A CPA who accepts or expects to receive a commission must disclose that fact to the person or entity receiving the recommendation. Referral fees work the same way: a CPA who accepts a fee for referring a client to another CPA, or who pays a fee to obtain a client, must disclose the arrangement to the client in writing.²

Consulting for a Client You Also Audit

The highest-risk scenario is a firm that provides both attest services and consulting to the same client. The Code addresses it through the Nonattest Services interpretation, and getting it wrong impairs independence, which can invalidate the audit.

The core rule is that the CPA must never assume a management responsibility for an attest client. Management responsibilities include leading and directing the entity, making significant decisions about resources, and exercising judgment that properly belongs to management. Once that line is crossed, no safeguard can repair the independence problem.⁴

For consulting work that does not involve management responsibilities, independence can be preserved when the attest client agrees to four safeguard conditions:

Assume all management responsibilities related to the consulting work.
Oversee the services by designating someone in senior management with enough skill and knowledge to understand what the CPA is doing.
Evaluate the results of the services the CPA performs.
Accept responsibility for the outcomes and any significant judgments involved.

The designated person does not need the expertise to redo the CPA’s work, but must be able to oversee it meaningfully. When a single firm handles both the audit and the consulting engagement, using different partners and engagement teams with separate reporting lines helps address the self-review threat that arises.⁴

What Happens If You Violate the Standards

The AICPA enforces its standards through the Professional Ethics Division and the Joint Trial Board. Sanctions range from required continuing education, workpaper submissions, or pre-issuance review of future engagements at the low end, through public admonishment, suspension of AICPA membership for up to two years, and expulsion. Suspensions and expulsions are published. The AICPA can bypass hearings and expel or suspend a member automatically when a state board revokes the CPA’s license, or when the member is convicted of a crime punishable by more than one year of imprisonment, willful failure to file a tax return, or filing a fraudulent return.⁵

AICPA discipline is only part of the exposure. State boards of accountancy have independent authority to suspend or revoke a license, impose fines, and require additional education, and a single violation can trigger parallel proceedings at both levels. State-board sanctions often carry more practical weight, because they affect the legal ability to practice, not just professional membership.

1
eGrove. Statement on Standards for Consulting Services No. 1
2
American Institute of Certified Public Accountants. AICPA Code of Professional Conduct
3
AICPA & CIMA. Say “I Do” to Engagement Letters
4
American Institute of Certified Public Accountants. AICPA Code of Professional Conduct – Nonattest Services 1.295
5
AICPA & CIMA. Definitions of Ethics Sanctions/Disposition