The Essentials: Protect — Accounting / CPA Firm

Malpractice Insurance Is Not Optional

Errors and omissions (E&O) insurance, typically $1,200-$3,000 annually for a small firm, covers claims arising from professional errors such as a missed deduction or a filing mistake that costs a client money. Many state boards do not mandate it, but operating without it exposes your personal assets to any claim your entity structure does not shield you from, which includes your own professional negligence regardless of entity type.

A Written Information Security Plan Is Legally Required

Under the IRS's Safeguards Rule (detailed in Publication 4557), any firm that prepares tax returns must maintain a written information security plan covering how client data is collected, stored, transmitted, and disposed of, plus a documented incident response plan. Practice management platforms with encrypted portals cover much of the technical requirement, but the written plan itself is something you must draft and keep current, not something software provides automatically.

Cyber Insurance Covers What E&O Does Not

E&O insurance covers professional mistakes; cyber insurance covers the cost of a data breach itself, including notification requirements, credit monitoring for affected clients, and forensic investigation. Given that a single breach exposing client SSNs and bank details can easily cost tens of thousands of dollars to remediate, cyber coverage is worth adding even for a solo practice, particularly once you exceed a few dozen clients.

Build a Continuity Plan for Solo Practitioners

If you are the only CPA in your firm, put a written continuity agreement in place with another local CPA who can step in temporarily if you become unavailable during tax season, and make sure your practice management system access and client files can be handed off without you being present. Clients and state boards both expect this kind of continuity plan; the AICPA has template language many small firms adapt.

Review Your Coverage Limits as the Firm Grows

E&O coverage limits appropriate for a solo practitioner with 40 clients are often inadequate once you're managing a larger client base or higher-complexity engagements; review your coverage annually against your current client roster and the largest potential claim exposure among them, rather than keeping the same policy limits you started with.

Train Staff on Phishing and Social Engineering Specifically

CPA firms are a common target for tax-season phishing schemes impersonating the IRS or clients requesting urgent wire transfers; regular staff training specifically on these tactics, not just general cybersecurity awareness, closes one of the most common ways firms actually experience a data breach or fraud loss.

Consider a Fidelity Bond if You Handle Client Funds

If your services ever involve handling client funds directly (bill pay, trust account management for certain advisory services), a fidelity bond protecting against employee theft or dishonesty is a separate coverage from E&O insurance and cyber insurance, worth adding if this applies to any part of your service offering.

Set a Clear Document Retention and Destruction Policy

IRS guidance generally recommends retaining client tax records for a minimum of seven years, but your own firm records and work papers may warrant longer retention for liability protection; establish a clear, written retention and secure destruction policy rather than either keeping everything indefinitely or destroying records inconsistently, both of which create risk.

Review Your Policies Annually With Your Insurance Broker, Not Just at Renewal

An annual review conversation with your insurance broker, walking through any changes in your services, client base, or staff count, catches coverage gaps that a passive automatic renewal would miss entirely, since your risk profile in year three of practice looks meaningfully different from your risk profile at formation. A firm that added advisory services or started handling a client's payroll since their last policy review may have created an entirely new coverage need that a broker only catches if you proactively discuss what's actually changed in your practice, rather than treating the annual renewal as a formality.

Build a Simple Incident Response Checklist Before You Need One

A short, written checklist covering who to notify, your insurer, potentially affected clients, and in some cases regulators, and in what sequence, for a data breach or a serious professional error, means you're not improvising under stress during an actual incident. Firms that draft this checklist calmly in advance respond faster and more effectively than those trying to figure out the right sequence of notifications while already dealing with the underlying crisis itself.

Understand How Your Coverage Interacts With Software Vendor Liability

When a data breach or error originates from a third-party software platform you use, such as your practice management system or e-signature provider, rather than from your own direct action, the liability picture can be more complicated than a straightforward claim against your own work; review your vendor contracts for their own liability limitations and understand how your own E&O and cyber policies would respond in a scenario where the root cause was a vendor's system failure rather than your own error. This is a nuance many practitioners never think through until an actual incident forces the question, at which point it's too late to negotiate better vendor terms or adjust your own coverage accordingly.

Take this further

FREQUENTLY ASKED QUESTIONS