Risk management mantras to add to your daily practice

The Accountants Risk Control team at CNA, the underwriter of the AICPA Professional Liability Insurance Program, speaks with thousands of CPAs every year and provides advice and guidance to help CPAs navigate tricky and challenging client situations. While each situation is unique, certain catchphrases are shared with CPA firms more frequently than others. These common catchphrases have become our risk management mantras.

January is the time for resolutions and new beginnings. A time to reflect on the past and set your intentions for the year to come. As you embark upon the new year, consider adding our risk management mantras to your daily practice.

DON’T FORGET ABOUT YOUR NO. 1 CLIENT — YOUR FIRM

A firm’s most important client isn’t the client that generates the most revenue or the one with the highest realization. A firm’s most important client is the firm itself. Therefore, as you evaluate and decide how to respond to various client situations, such as unilaterally altering the firm’s standard terms and conditions to respond to a client’s comments or accepting a trustee role for a longtime client without an acceptance evaluation, do not forget to first consider how your decision will affect the rest of the firm. Putting clients first may seem noble, but anything perpetually one-sided is not sustainable and may lead to higher risk than is comfortable for your firm. Take a more balanced approach to client service and care for yourself and your firm first.

IF YOU SEE SOMETHING, SAY SOMETHING (IN WRITING)

A common assertion in professional liability claims is that the CPA failed to advise the client of something, especially if an engagement letter is not in place. A failure-to-advise assertion could relate to unusual transactions noted while looking at a client’s general ledger or a client’s bookkeeper with unchecked access to cash accounts. It is helpful to inform a client of observations made, especially if those observations could result in a negative outcome for the client, and suggest the client further investigate. Documenting your observations in writing to the client as well as having an engagement letter that defines the specific scope of your services can help deflect an assertion of “you didn’t tell me.”

IF IT WASN’T DOCUMENTED, IT WASN’T DONE

Documentation that supports the services delivered by the CPA can provide critical evidence in a dispute. However, if documentation is absent or insufficient, resolving a dispute may be significantly more difficult and take longer than anyone would like. Save yourself a future headache by creating and retaining documentation to support the services and work product delivered to the client. Don’t forget to document key facts and assumptions, judgments made by you, and the decision made by the client. Summarize client conversations, whether it’s in an email to the client or note to the file, to help avoid a battle of memories (which CPAs seldom win).

BE SWITZERLAND

Clients may get into disputes of their own, whether it be a personal divorce, a partnership breakup, or a vendor disagreement. Disgruntled parties that refuse to talk to each other will often separately turn to the CPA to request documentation or other assistance in support of their arguments. Your client service instincts may pull you toward providing assistance, but you could soon find yourself caught in someone else’s drama over something unrelated to your services, spending more time than intended and, potentially, giving rise to a conflict of interest. Stay out of the fray, focus on the services you have been engaged to provide, and don’t be perceived to favor one side or the other. In other words, be neutral, like Switzerland. If the feuding parties, or their attorneys, persist, request a subpoena for your records or testimony.

YOU CAN’T CARE MORE THAN YOUR CLIENT

CPAs take pride in going the extra mile for clients and will wring their hands if a client is at risk of missing a tax filing deadline or similar compliance requirement. But remember, the objective of your services is to help your client meet their compliance requirements, not to comply for them. If a client is not concerned enough to respond to your inquiries or provide information on a timely basis, the client must accept responsibility and bear those consequences of their failure.

THEY’RE CALLED CLIENTS, NOT FRIENDS, FOR A REASON

All clients should be subject to the same risk management and quality control protocols as any other client, including those that you are friendly with or even related to. When money is lost, those “friends” will quickly turn on you, adding insult to injury. Best to not mix business with pleasure and keep the client/ CPA part of the relationship at arm’s length.

IF YOU KNEW THEN WHAT YOU KNOW NOW, WHAT WOULD YOU DO?

Hindsight is always 20/20, but this fact can get lost when evaluating existing clients and engagements for continuance purposes. A client’s risk profile and your risk tolerance can change over time. A client that was brought on board years ago is likely not the same client that it is today. Neither is the firm. Yet, once a client has made it through the firm’s front door, it’s easy to overlook or rationalize behaviors or risks that would have prevented the client’s entry initially. Take off those rose-colored glasses and objectively ask yourself if your acceptance decision would be the same now that you have the benefit of hindsight. If not, it might be time to part ways.

TAKE THE HIGH ROAD

Having a difficult conversation with a client, while necessary, can be extremely uncomfortable. Difficult conversations can arise when telling the client you’re suspending services for a past-due invoice, firing the client, or delivering other bad news.

Regardless of the situation, it’s always best to remain calm, be objective, and always be professional. No one likes to hear bad news, and your client may react poorly. They may yell, call you names, question your judgment, or more. Resist the urge to respond in the same manner. It is seldom helpful and usually harmful. Let them get in the last word and move on.

ANYONE CAN SUE ANYONE FOR ANYTHING AT ANY TIME

“I did everything right. I won’t be sued,” is a phrase we sometimes hear. Unfortunately, being “right” generally has nothing to do with whether or not you get sued. Anyone who thinks they have been wronged or has lost money and is looking for someone to blame can generally bring a claim against you. While there may be legal defenses available to help defend a claim, responding to any sort of claim takes time and money and takes an emotional toll, regardless of how “right” you think you are. In addition, just because you haven’t been sued, doesn’t mean you never will.

TRUST YOUR GUT

In the aftermath of a claim, a CPA will often say, “I just knew something didn’t feel right.” Don’t ignore those hairs on the back of your neck that are sticking up. If something seems off, it probably is. A CPA’s instinct is a pretty good guide when you reach a fork in the proverbial road. Before picking a path, pause and consult with others at your firm, or with your professional liability insurance carrier, about what course may be the best fit for you.

No size of firm is immune

32% Firms with less than $600,000 in annual revenue

43% Firms with greater than $600,000 but less than $10 million in annual revenue

25% Firms with greater than $10 million in annual revenue

Percentage of claims reported against CPA firms in the AICPA Professional Liability Insurance Program in 2023, by size of firm.

Source: CNA Accountants Professional Liability Claim Database, underwritten by Continental Casualty Company. Copyright © 2025. All rights reserved.

Sarah Beckett Ference, CPA, is a risk control director at CNA. For more about this article, contact specialtyriskcontrol@cna.com.

Continental Casualty Company, one of the CNA insurance companies, is the underwriter of the AICPA Professional Liability Insurance Program. Aon Insurance Services, the National Program Administrator for the AICPA Professional Liability Program, is available at 800-221-3023 or visit cpai.com.

This article provides information, rather than advice or opinion. It is accurate to the best of the author’s knowledge as of the article date. This article should not be viewed as a substitute for recommendations of a retained professional. Such consultation is recommended in applying this material in any particular factual situations.

Examples are for illustrative purposes only and not intended to establish any standards of care, serve as legal advice, or acknowledge any given factual situation is covered under any CNA insurance policy. The relevant insurance policy provides actual terms, coverages, amounts, conditions, and exclusions for an insured. All products and services may not be available in all states and may be subject to change without notice.