An AICPA engagement letter is the signed written agreement between a CPA firm and its client that defines the services to be performed, the fees, each party’s responsibilities, and the terms that will govern the relationship if something goes wrong. AICPA professional standards require a written understanding for most services, and firms that skip the letter or rely on a handshake lose both their compliance footing and their best defense in a dispute.
Why the Letter Matters
Malpractice claims against accountants with signed engagement letters can be up to 71 percent less severe or expensive to settle than claims where no letter was in place. The letter pins down what the firm agreed to do, which forecloses the most common client argument in a dispute: that the firm promised something broader, guaranteed a particular outcome, or should have caught something outside the scope.
Compliance is the other half of the picture. AICPA professional standards for audits, reviews, compilations, and preparation engagements all require a written understanding with the client. Performing those services without one puts the firm out of step with the standards it is obligated to follow.
Components Every Letter Needs
Certain elements belong in every engagement letter regardless of service type. Ambiguity in any of them is what a disgruntled client’s attorney will exploit.
- The full legal names of the firm and the client entity or individual. Vague references like “the company” become a problem when ownership is disputed or a subsidiary is involved.
- The engagement period, stated clearly, whether a calendar year, fiscal year, specific project, or recurring cycle.
- The fee structure. For hourly arrangements, specify the billing rates for partners, managers, and staff separately, and include payment terms.
- Termination rights. Firms typically reserve the right to withdraw if the client fails to pay, refuses to provide records, or asks the firm to take positions that violate professional standards. The client usually retains the right to terminate on written notice, subject to paying for work completed.
- Scope-change procedures. At minimum, the letter should state that any expansion of the original scope requires a written amendment signed by both parties, along with an adjusted fee.
One fee issue trips firms up repeatedly. The AICPA Code of Professional Conduct prohibits contingent fees for services where the firm also performs an attest engagement for that client, such as an audit, review, or compilation. Outside of attest services, the rules allow contingent fees in certain tax matters, including representing a client during an IRS examination or filing a refund claim that will undergo substantive review by the taxing authority. A contingent fee is not permitted when, for example, a firm prepares an amended return claiming a refund for a deduction simply left off the original filing.1AICPA & CIMA. AICPA Code of Professional Conduct
Scope and What the Firm Is Not Doing
The scope section is where most of the letter’s protective value lives. “We will prepare your tax return,” without specifying which returns, which year, and which standards govern the work, is a blank check for future disputes.
A tax engagement letter should identify the specific forms the firm will prepare, whether Form 1040, 1120, 1065, or state returns, and state that the engagement covers only the tax year specified.2AICPA & CIMA. 2025 Individual Tax Return Engagement Letter – Form 1040 An audit letter should identify the financial statements being audited, the applicable financial reporting framework, and the expected form and content of the auditor’s report. A compilation or preparation letter should name the financial statements being assembled and the basis of accounting.
Equally important is what the letter says the firm is not doing. A standard audit provides reasonable assurance that financial statements are free from material misstatement, but it does not guarantee that every error or fraud will be caught. AU-C Section 210 requires the letter to state that because of the inherent limitations of an audit and of internal control, an unavoidable risk exists that some material misstatements may not be detected even when the audit is properly planned and performed.
For tax work, the letter should state that the firm relies in good faith on the accuracy and completeness of information the client provides, without independent verification. Circular 230 supports that reliance but also requires the practitioner to make reasonable inquiries when information appears incorrect, inconsistent, or incomplete.3eCFR. 31 CFR 10.34 – Standards With Respect to Tax Returns and Documents, Affidavits and Other Papers The letter should reflect both sides: the firm relies on what the client provides, and the firm is not a rubber stamp for information that doesn’t add up.
What Changes by Service Type
Audit and Review Engagements
Audit letters carry the heaviest requirements because the firm is expressing an opinion. AU-C Section 210 calls for at minimum six elements: the objective and scope of the audit, the auditor’s responsibilities, management’s responsibilities, acknowledgment of the inherent limitations of the audit and internal controls, identification of the applicable financial reporting framework, and reference to the expected form of the auditor’s report.
The letter must also confirm the firm’s independence. AICPA rules require independence for all attest services, and depending on the client, additional independence requirements from the SEC, PCAOB, Department of Labor, or Government Accountability Office may apply.4Public Company Accounting Oversight Board. ET Section 101 – Independence
A review provides only limited assurance, which is a fundamentally different product. The letter must make this distinction unmistakable. Review procedures consist primarily of inquiry and analytical procedures rather than the detailed testing performed in an audit, and the firm is not expressing an opinion. Clients who don’t understand this difference are the ones who later claim the firm should have caught something only a full audit would have revealed.
Compilation and Preparation Engagements
Compilation and preparation engagements provide no assurance at all, and the letter must hammer that home. A compilation letter states that the firm is presenting management’s financial data in the form of financial statements without undertaking to express any assurance.
A preparation engagement under AR-C Section 70 is used when a firm prepares financial statements but does not issue a report on them. The letter must document that the firm will not verify the completeness or accuracy of client-provided information, and each page of the prepared statements must carry a legend stating that no assurance is provided.5CAMICO. SSARS No. 21 Risk Management and Implementation Issues SSARS requires that all compilation and preparation engagement letters be in writing and signed by both the firm and client management.
Tax Engagements
The primary authority for tax engagement conduct is Treasury Department Circular 230, which requires practitioners to communicate clearly with the client regarding the terms of the engagement. SSTS No. 4 also mentions engagement letters as something a practitioner should consider.6The Tax Adviser. Best Practices for Engagement Letters, POAs, and Tax Return Extensions
The tax letter should assign responsibility clearly. The client holds ultimate responsibility for the accuracy and completeness of what goes on the return, even though the firm prepares it. The firm relies on client-provided data without independent verification, as permitted under Circular 230 Section 10.34(d), but must make reasonable inquiries when something looks wrong.3eCFR. 31 CFR 10.34 – Standards With Respect to Tax Returns and Documents, Affidavits and Other Papers
Address penalties directly. The client needs to understand upfront that the firm will advise on potential penalties and interest but cannot guarantee every position will survive examination. State that the firm is not obligated to update its advice for subsequent changes in tax law unless the client specifically engages the firm for ongoing monitoring.
If the firm will represent the client before the IRS, the letter should address whether a Form 2848 Power of Attorney will be executed, the scope of representation it authorizes, and the authentication procedures required for electronic signatures on the form.7Internal Revenue Service. Instructions for Form 2848, Power of Attorney and Declaration of Representative For remote electronic signatures, the IRS requires the firm to verify the taxpayer’s identity through government-issued photo ID, record identifying information, and confirm it through secondary documentation such as a prior tax return or IRS notice.
Consulting Engagements
Consulting letters cover advisory work like internal controls assessments, forensic accounting, or transaction due diligence. The letter must state the firm is not providing any form of assurance or opinion. Scope needs to be drawn tightly, because consulting is the most prone to scope creep. Define the specific deliverables, the information the client must provide, and the trigger for a scope amendment. State that the client is responsible for its own decisions about whether to act on the firm’s recommendations.
Firm and Client Responsibilities
Every letter must separate what the firm is responsible for from what falls on client management. This split is required by AICPA standards for attest engagements and is the foundation of most malpractice defenses.
The firm commits to performing the engagement in accordance with applicable professional standards, whether Statements on Auditing Standards, SSARS, or Circular 230. The firm must also commit to confidentiality, subject to exceptions required by law or professional standards, and for attest work, to maintaining independence.
Client management bears responsibility for the accuracy and completeness of the data it provides and must furnish the records needed to complete the engagement on time. For audit and review engagements, management must also acknowledge responsibility for designing, implementing, and maintaining internal controls relevant to the preparation and fair presentation of the financial statements.
At the conclusion of an audit or review, management must provide a written representation letter. AU-C Section 580 specifies what it must cover: confirmation that management has fulfilled its responsibilities for the financial statements and internal controls, that it has provided the auditor with all relevant information and access, that all transactions are recorded, and that it has disclosed all known fraud, noncompliance with laws, related-party transactions, subsequent events, and pending litigation.8American Institute of Certified Public Accountants. AU-C Section 580, Written Representations The engagement letter should reference this obligation so management is not surprised by the request at the end of the engagement.
Liability and Risk Provisions
Limitation of Liability
A limitation of liability clause attempts to cap the firm’s financial exposure, typically to a multiple of the fees paid or a specific dollar amount. Enforceability depends on the jurisdiction and the client. Courts in some states have held that because CPAs are state-regulated professionals serving the public, limiting their liability is contrary to public policy.
For certain clients, these provisions are flatly prohibited. The AICPA Code of Professional Conduct treats it as an act discreditable to the profession to perform an attest engagement when the agreement contains limitation of liability clauses prohibited by law or regulation. Clients regulated by the SEC, state insurance commissions, and federal banking regulators generally fall into this category.1AICPA & CIMA. AICPA Code of Professional Conduct Confirm with legal counsel whether a proposed clause is enforceable before relying on it.
Indemnification Clauses
Indemnification clauses, where the client agrees to hold the firm harmless for losses arising from the client’s own acts, are a different animal. For non-attest services like tax preparation, broad indemnification language is common and generally permissible. Many tax engagement letters include a clause stating that if penalties result from inaccurate or incomplete client information, the client will indemnify the firm.
For attest engagements the rules are stricter. The AICPA Code of Professional Conduct prohibits a firm from entering into an indemnification agreement with an attest client because doing so impairs independence.1AICPA & CIMA. AICPA Code of Professional Conduct
Dispute Resolution
A dispute resolution clause is not required by AICPA standards but is one of the most valuable provisions a firm can include. Requiring mediation before arbitration, or arbitration before litigation, reduces the time and cost of resolving disagreements. Specify the location and governing rules. Some firms also include a prevailing-party attorneys’ fee provision to discourage frivolous claims.
Working Papers and Subpoenas
State that the firm owns the working papers generated during the engagement. The client receives the final work product, but the underlying documentation belongs to the firm. Clients generally retain the right to request copies of records needed to comply with tax obligations.
Because CPA firms frequently receive subpoenas, a reimbursement clause is worth including. Responding is expensive, and the clause should state that the client will reimburse the firm for professional time and legal costs incurred in responding to third-party legal process. For attest services, this language must be carefully worded so it does not become an impermissible indemnification provision.
Address what happens when the firm encounters evidence of illegal activity. Under AICPA Section 360, a firm that discovers noncompliance with laws and regulations must comply with applicable legal and regulatory requirements, which may include reporting to an appropriate authority. In some circumstances, such as those arising under anti-money laundering laws, the firm may be prohibited from alerting the client about the report.9AICPA & CIMA. Section 360 – Responding to Non-Compliance With Laws and Regulations
Data Security Language
Under the FTC Safeguards Rule, which implements the Gramm-Leach-Bliley Act, CPA firms are classified as financial institutions and are required to maintain a Written Information Security Program. Data security language in the engagement letter is more than a nice-to-have.
Describe in general terms the security measures the firm employs, including access controls, encryption, and monitoring. State what the firm will do in the event of a data breach, including notification obligations under applicable state and federal law. If the firm uses third-party cloud platforms or outsources any processing, disclose that fact and confirm that service providers are contractually required to maintain appropriate safeguards.
Annual Letters vs. Evergreen Letters
Some firms use “evergreen” letters that remain in effect indefinitely until one party terminates. This is a risk management trap. Evergreen letters do not prompt routine confirmation of expectations, and over time the client’s needs change, the firm’s services evolve, and the original letter no longer reflects reality. The result is scope creep with no documented authorization.
Evergreen letters also create statute of limitations problems because they lack affirmative language about when the engagement concludes. Data shows that the cost to resolve claims connected to evergreen letters is significantly higher than claims involving annual letters.10AICPA & CIMA. Say I Do to Engagement Letters
Issue a new letter for each engagement period, have it signed by both parties before any work begins, and update it whenever the scope of services changes.
Electronic Signatures
Electronic signatures are legally valid for engagement letters under the Electronic Signatures in Global and National Commerce Act, which has been mirrored in some form by all states. Firms using e-signature platforms should retain the audit trail documentation, which supports enforceability if the signed letter is later challenged.
The letter should be signed close to the time of engagement acceptance discussions but before any work begins. If the client signs weeks or months after work has started, a dispute may arise about whether the terms were actually agreed to before services were rendered. When multiple documents require a signature, each should carry its own e-signature rather than relying on a single blanket acknowledgment. The more identity verification the e-signature process requires, the harder it becomes for a client to later claim the signature wasn’t authentic.