Insurance for Accountants and CPA Firms
A missed extension or an audit that overlooked a theft can become a claim years after the engagement letter was signed. We request accountant professional liability insurance and the firm coverages around it for California CPAs and accounting practices, and an insurer decides after reviewing your services and claims history.
Where claims against CPA firms come from
Claims data from the AICPA Professional Liability Insurance Program, written by CNA, shows tax work producing the most claims. In 2021 most claims involved tax services, although tax claims tend to cost less than audit claims. The leading tax cause that year was a filing error, which CNA linked to the deadline changes of 2019 and 2020; in earlier years incorrect advice or failure to advise led the list. In one example, a missed extension for an individual client led to a $20,000 failure-to-pay penalty.
Other service lines carry different weight. Consulting made up 9% of 2021 claims, a 50% rise from 2020. Audit claim volume fell nearly 50% over the same year, yet more than half of audit claims came from third parties, mainly lenders and sureties that relied on the statements. CNA describes audit, fiduciary and failure-to-detect-fraud claims as typically high severity.
Accountant professional liability insurance: reading the policy
Accounting E&O, the professional liability line, answers a claim that your work fell short: a return filed late, advice that cost a client an election, or a review that missed a misstatement. It pays for your defense and for a settlement or judgment up to the limit. Whether it also repays a client’s penalties and interest, as distinct from the tax itself, comes down to the policy’s definition of damages, so read that wording before relying on it.
CPA malpractice insurance is usually written on a claims-made basis, which makes the date a claim arrives as important as the date of the work. Keep your retroactive date unbroken when you change insurers, and plan an extended reporting period before you retire, merge or sell the practice. Our guide to occurrence vs claims-made policies sets out both triggers.
When an audit misses employee theft
Failure to detect theft or fraud is high severity whatever service the firm performed. CNA describes a case in which an employee embezzled $2 million from an audit client, a financial institution. The client’s fidelity insurer paid the loss and then sued the CPA firm, alleging that the audit failure let the fraud continue.
That pattern explains why underwriters ask how much attest work you do, for which industries, and how engagement letters define what the audit is meant to find. Your own office faces the reverse risk: a staff member with access to the firm’s operating or trust accounts. A crime bond or commercial crime policy addresses theft of the firm’s own money, which professional liability does not.
California Board of Accountancy reporting and records
Business and Professions Code section 5063 sets 30-day written reporting duties to the California Board of Accountancy (CBA). They cover any civil settlement or arbitration award relating to public accountancy of $30,000 or more where the licensee is not insured for the full amount, any civil judgment alleging negligence, fraud, breach of fiduciary duty or other errors or omissions, and restatements, SEC formal investigations, Wells notices and PCAOB investigations. Limits that match your exposure can keep a settlement outside that reporting rule.
Your files are your defense. Section 5097 requires audit documentation to be kept at least seven years, longer while a board investigation or legal action is pending, and a written retention and destruction policy; missing documentation creates a rebuttable presumption that a procedure was not performed. Section 5037 lets a client ask for copies of working papers that form part of the client’s records. Firms with an accounting and auditing practice also need an accepted peer review report at least every three years to renew in active status (section 5076).
Client data: the WISP and the FTC Safeguards Rule
The IRS says federal law requires tax and accounting professionals to create and maintain a Written Information Security Plan (WISP), because the Gramm-Leach-Bliley Act treats them as financial institutions. Its Publication 5708 is a WISP template, alongside Publication 4557, Safeguarding Taxpayer Data, and Publication 5293, the Data Security Resource Guide.
The FTC Safeguards Rule lists elements such as a Qualified Individual, a written risk assessment, multi-factor authentication, encryption of customer data in transit and at rest, security awareness for staff and a written incident response plan. The FTC names tax preparation firms as covered, and for an accounting firm coverage turns on its activities. If a breach exposes unencrypted data on 500 or more consumers, the firm has 30 days from discovery to notify the FTC, a duty in force since May 2024. Breach response, notification and extortion costs are the job of cyber insurance; our cyber readiness checklist covers what applications ask.
The firm’s office, staff and tax season help
A client who slips in your reception area is a general liability claim, not an E&O one. A business owner’s policy packages that liability with property cover for computers, furniture and files. Hiring adds workers’ compensation: under Labor Code 3700.5, failing to carry it is a misdemeanor in California. Once you have staff, employment practices liability belongs in the review too.
CPA firms and their staff are exempt from California’s tax preparer registration under section 22258 of the Tax Preparation Act, so the separate CTEC rules described on our tax preparer page apply to preparers outside that exemption, not to your licensed practice.
What professional liability insurance for accountants costs
Insureon’s 2025 cost page for CPAs and accountants gives national medians from its own small-business customers, not California market prices and not a Mithril1 quote: about $45 a month ($537 a year) for professional liability, $30 a month ($357) for general liability, $60 a month ($719) for a business owner’s policy, $34 a month ($404) for workers’ comp and $80 a month ($964) for cyber. It puts a fidelity bond at $38 a month ($454), a figure for financial service businesses generally. These are starting points for solo practitioners and very small firms at standard limits; established firms pay well above them.
Professional liability grows with fee income, the number of CPAs and the services each one performs, while workers’ comp follows payroll. A small practice buying professional liability, a business owner’s policy and cyber at those medians would spend about $2,220 a year before workers’ comp or a crime bond.
Audit and attest work, financial institution or public company clients, fiduciary roles, prior claims and higher limits push the premium up. A tax and bookkeeping mix with strong engagement letters, a clean history, multi-factor authentication on every login and a higher deductible pull it down.
A few useful answers
Common questions
Do California CPAs have to report an uninsured settlement?
Yes, in one situation. Under Business and Professions Code 5063(b), a licensee must report to the CBA within 30 days any public accountancy settlement or arbitration award of $30,000 or more where the licensee is not insured for the full amount. Judgments alleging negligence or other errors have their own reporting duty. Confirm current requirements for your firm with the CBA.
Can my firm get accountant professional liability insurance through Mithril1?
It can, when an insurer accepts your firm after reviewing its engagements. We gather your service mix, fee income, staff count and claims history, request terms, and walk you through the retroactive date, limits and exclusions before you decide.
Does accounting E&O cover a client data breach?
Treat them as separate policies. E&O is written for claims about your professional work, while breach investigation, client notification and ransom demands sit with a cyber policy. Ask how each one handles a phished email that leads to a wrong wire.
What happens to my CPA malpractice insurance when I retire or sell?
Claims-made cover stops answering when the policy ends, so a claim that arrives after you retire or sell needs an extended reporting period, the tail, arranged before the policy lapses. In a sale, settle in writing whether you or the buyer pays for tail and which policy answers for work done before closing.
How long must audit work papers be kept in California?
At least seven years under section 5097, and longer while a board investigation, disciplinary proceeding or legal action is pending. Keep a written retention and destruction policy as well.