The suspense and jump scares of a Halloween movie may feel far removed from public accounting, but CPAs can face their own frightening moments: an unexpected subpoena, an angry client, a fraud allegation, or a wire transfer gone wrong. When those situations arise, the worst response is to freeze, or to investigate the proverbial “scary noise” alone.

The stories that follow highlight how accounting firms can respond when trouble arises and, just as importantly, how they can prepare before the next scare arrives.

Nightmare on 1040 Street

CPA Freddy’s jaw fell to the floor as he read the news headline announcing his 1040 client was indicted for federal securities fraud. “Well, the client sent me his investment income information from legitimate brokerages, so I’m not too concerned about getting wrapped up in this,” he tried to convince himself. That tone changed when CPA Freddy was served with a grand jury subpoena related to his client’s alleged criminal actions.

How to respond:

• Stop. Do not reply to the grand jury subpoena or any legal notice on your own.
• Notify your professional liability carrier. Your policy may include a supplemental benefit whereby the carrier will engage legal counsel to assist with the subpoena response, whether it is a grand jury subpoena or a more typical subpoena for your records or deposition testimony.
• Ask counsel whether you may notify the client about the information request. If notice is allowed, the client may want to consult their own counsel about objecting or seeking to narrow the scope of disclosure.

How to prepare:

• Create a firm–wide subpoena response protocol. If someone at the firm receives a subpoena, do they know whom to notify internally?
• Include a subpoena provision in the engagement letter, agreeing to notify the client of any subpoenas received (unless prohibited by law) and that the client agrees to reimburse the CPA for their time and expenses if the CPA is not a party to the matter.

The State Boards Have Eyes

As part of her annual continuance evaluation process, CPA Brenda decided that it was time to call one of her troublesome clients and send a termination letter, noting that all services were complete. Thereafter, the client made repeated demands for his “file,” including all working papers, emails, and notes. Brenda explained that these items were property of her CPA firm and that she had already sent required documents to the client. Unsatisfied with that answer, the client reported Brenda to her state board of accountancy.

How to respond:

• Don’t dismiss the complaint. Even if you consider it meritless, a non–response or non–cooperation can have a negative impact on your license.
• Notify your professional liability carrier. Your policy may include a supplemental benefit whereby the insurer will pay your attorney fees and other costs, fees and expenses in responding to such complaints.

How to prepare:

• Have a signed engagement letter for each engagement that clearly identifies the scope of your work, responsibilities with regard to work papers, and the expected deliverables.
• In a termination letter, indicate the status of any client records supplied to you and note your firm’s record retention policy.

Fraud Day the 13th

An audit client’s CEO called CPA Jason, letting them know that the client’s CFO had been arrested on suspected embezzlement. Jason, who golfed with the CFO last weekend, was in shock and picked up on the CEO’s accusatory tone. The CEO made her feelings crystal clear when she directly asked, “How could you miss this?”

How to respond:

• If fraud is suspected, review the relevant professional standards related to the engagement performed. For next steps, see “How to Not Lose Sleep over NOCLAR,” JofA, Dec. 1, 2024.
• Be mindful of assisting a client in their fraud investigation, as it is likely a conflict of interest.
• Report the matter to your professional liability insurance carrier, whether as notice of circumstances that could give rise to a claim or as an actual claim asserting that the CPA failed to detect a theft or fraud at the client. Regardless of the service provided, CPAs can experience claims alleging they failed to detect theft or fraud.

How to prepare:

• If the engagement is not designed to detect fraud or theft, state that in the engagement letter as well as management’s responsibilities for establishing and maintaining internal controls.
• Give special consideration to risk assessment for audit engagements. In audit claims, risk assessment and connection to the resulting procedures are heavily scrutinized, and the documentation of such is paramount.
• Be fraud–aware. Train all personnel about potential fraud risk factors, such as an unmonitored bookkeeper with too much access.

Night of the Living Deepfake

CPA Ben’s high-net-worth client wanted two things from him: “Wire payments on my behalf and don’t bother me about it.” Without much protocol or guidance, Ben was left to his own devices. It did not take long before a wire was misdirected to a bad actor, who used AI deepfake technology to pose as someone on the client’s management team. The client was furious and sued Ben for the missing money.

How to respond:

• Inform relevant parties immediately. Notify the bank’s fraud department immediately. Request an immediate wire recall, SWIFT recall, and freeze of the recipient account (if funds remain).
• File a complaint with the FBI’s Internet Crime Complaint Center, and contact the local FBI field office.
• Report the incident to your professional liability and cyber insurance carrier as they may be able to assist in the incident response triage, forensic investigation, and recovery efforts as well as with any third–party claim that may arise.
• Follow your firm’s incident response plan, and work with a breach response coach or team to help you understand the scope of the incident and your responsibilities. Your cyber insurance carrier will likely have referrals for you.

How to prepare:

• If making payments on behalf of clients, agree on payment protocols, in writing, in advance. The client should also acknowledge that they understand and accept the risk that, even if the firm follows the established protocols, a fraudulent transfer may still occur. (For additional information see, “10 Tips to Help Avoid Wire Fraud Scams,” JofA, Oct. 1, 2024)
• To combat the potential for deepfakes, insist upon a live discussion, staying alert for unusual behavior from the client.

The Silence of the Accountants

CPA Clarice came back from lunch to find a surprising visitor in her office—an agent from the IRS Criminal Investigation (IRS-CI) division. Clarice, caught off guard and overwhelmed, listened as the agent requested all communications, working papers, and tax returns related to a client. Internally, she asked herself: “How can I balance client confidentiality while still appearing cooperative… and how can I get this agent out of my office?!”

How to respond:

• Whether it is the IRS–CI division, the FBI, or another law enforcement agency, do not volunteer any information about your client. Ask for a badge or other proof of identification to confirm the agent’s credentials and ask if it is an informal inquiry.
• If the request is an informal inquiry, inform the agent that you must uphold your professional standards regarding client confidentiality and cannot offer client information without the client’s consent or being legally compelled to do so.
• If the request is formal, ask the agent to provide their request in writing and do not answer questions off–the–cuff. This will help prevent potential miscommunications about the request and your response.
• Report the matter to your professional liability carrier, who may have resources to help and/or your policy may provide pre–claim assistance to help you respond to the agent’s request.

How to prepare:

• Continually evaluate your clients’ “tone at the top.” If a client displays questionable ethics, consider whether that client is still a fit for your firm’s risk tolerance.

If your firm finds itself facing an unfamiliar plot twist, remember that you are probably not the first CPA to hear that particular creak in the floorboards. Before you open the door alone, call in reinforcements. Another partner at your firm, the AICPA Ethics Hotline, your professional liability carrier, or your state CPA society may help turn a scary situation into a managed response. After all, in both horror movies and professional liability matters, the best survival strategy is rarely to split up and wing it.

---

Executed IRS warrants up

25% from previous year: The IRS Criminal Investigation division executed 1,445 warrants during fiscal year 2025, compared to 1,154 in fiscal year 2024.

Source: IRS Criminal Investigation, FY 2025 annual report.

---

Kevin Hayes, CPA, is a risk control consultant at CNA in Chicago. For more information about this article, contact specialtyriskcontrol@cna.com.

Continental Casualty Company, one of the CNA insurance companies, is the underwriter of the AICPA Professional Liability Insurance Program. Aon Insurance Services, the National Program Administrator for the AICPA Professional Liability Program, is available at 800-221-3023 or visit cpai.com.

This article provides information, rather than advice or opinion. It is accurate to the best of the author’s knowledge as of the article date. This article should not be viewed as a substitute for recommendations of a retained professional. Such consultation is recommended in applying this material in any particular factual situations.

Examples are for illustrative purposes only and not intended to establish any standards of care, serve as legal advice, or acknowledge any given factual situation is covered under any CNA insurance policy. The relevant insurance policy provides actual terms, coverages, amounts, conditions, and exclusions for an insured. All products and services may not be available in all states and may be subject to change without notice.