Accounting, CPA & Audit Firms
Insurance for Review and Compilation Practices
A review or compilation practice needs an insurance program that accurately describes its attest and non-attest services, intended report users, client industries, claims-made history, and data access. Accountants professional liability is the service anchor; cyber, crime, excess, general liability, workers compensation, and employment coverages depend on the practice’s operations and contracts. Review and compilation standards, independence, and engagement requirements must be confirmed from current professional sources; this page is not an accounting or policy interpretation. General insurance education, not legal, accounting, actuarial, professional-standards or policy-specific advice. Coverage depends on the policy form, endorsements, limits, deductibles, exclusions, jurisdiction and facts. Submission does not bind coverage or guarantee a quotation or carrier approval. General insurance education not legal accounting or policy-specific advice.
Key takeaways
- Review and compilation work should be scheduled distinctly from audits, tax, bookkeeping, and advisory services.
- Document the report type, intended users, reliance context, and client industries.
- Claims-made continuity and prior-work records matter when a report is challenged later.
- Cyber and crime questions depend on client data, portal access, payment authority, and staff controls.
- A coverage review compares client requirements with actual policy terms; it does not promise limits or carrier acceptance.
A distinct profile within the attest spectrum
Review and compilation practices often combine attest engagements with tax, bookkeeping, CAS, or advisory work. The insurance question is not whether one label is better than another; it is whether the submission accurately shows what the firm performs, what it reports, and who may rely on the work. Separate revenue, engagement counts, staff responsibilities, and client industries by service.
Current AICPA resources should guide the accounting and engagement-standard discussion. For insurance, the advisor should then compare the service description, covered professional services, exclusions, and claims-made conditions. A generic accounting application may not ask enough about attest work, while an audit-focused classification may not describe the rest of the practice.
Professional liability follows the engagement promise
The letter and report should show the service performed, period covered, records supplied, intended users, and responsibilities of the client and firm. A compilation may involve different reliance questions from a review, and both differ from an audit. The distinction is useful for accurate underwriting and risk management; it does not decide whether a claim is valid or covered.
Ask the advisor to review the current policy’s definition of claim, defense provisions, prior-acts terms, exclusions, and limits in light of the firm’s largest or most complex engagements. Keep historical policies and signed letters because a challenge may arrive after the report period or after a partner changes role.
Data and payment access still matter
An attest practice may also hold tax returns, payroll records, bank feeds, workpapers, and portal credentials. Identify where those records reside, which vendors can access them, and how accounts are secured and offboarded. Cyber coverage may address certain breach response and liability costs, subject to the form and facts.
If staff can access client payment systems or change instructions, examine crime and social-engineering terms separately. A review or compilation practice should describe actual authority, verification callbacks, dual approval, reconciliation, and incident response. No coverage is complete merely because the firm carries a certificate.
Review and compilation submission checklist
Use the following packet to start a focused review. Remove unnecessary client-identifying information and send documents through an approved secure route. Record what is confirmed, what is pending, and which question requires accounting, legal, or insurance review.
- Revenue and engagement count by review, compilation, tax, bookkeeping, and advisory work
- Largest client industries, report users, distribution terms, and contractual requirements
- Signed engagement templates, quality-review process, staff and subcontractor roles
- Current and prior professional-liability policies, applications, endorsements, and loss runs
- Data, portal, payment, backup, MFA, and incident-response controls
- Open complaints, corrections, subpoenas, known circumstances, and renewal deadlines
Service-mix distinctions
| Practice service | Insurance conversation | Separate standards question |
|---|---|---|
| Compilation | Describe report and intended use | Which current compilation requirements apply? |
| Review | Describe procedures and reliance context | Which current review requirements apply? |
| Tax or bookkeeping | Describe errors, data, and payment access | What service is actually within scope? |
| Advisory | Describe recommendations and deliverables | What assumptions and responsibilities are documented? |
Hypothetical: Illustrative service expansion
A tax practice begins accepting review engagements for existing business clients. It updates its service inventory, engagement controls, staff responsibilities, client requirements, and insurance submission before renewal rather than assuming its tax classification answers the new exposure.
Additional questions
Is review and compilation coverage the same as audit coverage?
Do not assume identical treatment. The services and reliance context differ, and the policy wording and underwriting information must be compared with the actual practice.
Does an accountant need cyber coverage for these services?
Consider it when the firm stores client financial, payroll, tax, or portal data. The appropriate terms depend on data, controls, vendors, and policy wording.
Sources
- AICPA: Audit and attest — accessed 2026-09-13; supports Current audit and attest resource context..
- AICPA: SSARS resources — accessed 2026-09-13; supports Review and compilation standards resource location..
- National Institute of Standards and Technology: Cybersecurity Framework — accessed 2026-09-13; supports Organizing data-security controls..
General insurance education, not legal, accounting, actuarial, professional-standards or policy-specific advice. Coverage depends on the policy form, endorsements, limits, deductibles, exclusions, jurisdiction and facts. Submission does not bind coverage or guarantee a quotation or carrier approval.