What insurance issues should be reviewed when buying a CPA practice?

Key takeaways

• Inventory attest, tax, bookkeeping, valuation, payroll, and advisory work instead of relying on the target’s marketing label.
• Ask what the seller knows about complaints, subpoenas, peer-review matters, and potential claims—not only paid losses.
• Trace every policy to the entity that performed the work and the entity that will own the client relationship.
• Test cyber and crime controls where staff access client portals, bank accounts, payroll, or payment authority.
• Obtain written confirmation of unresolved items before signing; unknown appetite is not a reason to conceal facts.

Start with what the practice actually does

A target described as a tax or accounting practice may also perform audits, reviews, compilations, attest reports, valuation, payroll, outsourced finance, or transaction advisory. Each service changes the questions a reviewer asks about reliance, client contracts, staff access, and claims-made continuity. Reconcile the website, engagement list, revenue by service, personnel credentials, and policy applications.

Pay particular attention to services that are growing but not yet material in the revenue report. A small share of attest or valuation work can create a different diligence question than a much larger volume of routine bookkeeping. Record the facts neutrally and ask the broker what additional underwriting information is required.

Trace the professional-liability story

Request the current and historical policies, declarations, endorsements, applications, supplements, loss runs, and correspondence about claims or circumstances. Compare entities, insured names, retroactive dates, limits, deductibles, exclusions, defense provisions, and notice requirements. Ask where the seller expects a later complaint to be reported and who will maintain records.

Do not treat a no-claims statement as a complete risk assessment. Client demands, threatened demands, subpoenas, peer-review findings, quality-control remediation, regulator correspondence, and disputed invoices may be relevant even if no insurer has paid a loss. Counsel should advise on disclosure and transaction representations; the insurance advisor should map the facts to the forms.

Review access, money movement, and data

Accounting practices commonly hold tax identity data, payroll records, bank-feed credentials, workpapers, and payment instructions. Determine which staff can initiate or approve payments, change vendor details, access client portals, export data, or administer email. Confirm how access will be revoked and reissued during the transition, and whether the buyer will inherit systems or move clients to a new environment.

Cyber and crime policies address different parts of the risk and may contain specific conditions, sublimits, or definitions. The buyer should document multifactor authentication, backup testing, privileged access, callback verification, dual approval, reconciliation, incident response, and vendor controls. This is a control inventory—not a representation that any policy will respond.

A diligence packet that can be audited later

Use a tracker that names an owner, evidence location, open question, and deadline for each item. Keep copies of source documents and note when a response is verbal or still unverified. The goal is to make the post-close handoff usable to the person who will administer a claim or renewal, not merely to satisfy a transaction checklist.

Before binding successor coverage, provide the actual service mix and transaction structure. Never omit a difficult fact to obtain a preliminary indication. Coverage terms, carrier appetite, and any state or professional-standard issue require confirmation from the relevant specialists.

• Entity chart, ownership records, assumed names, and client-contract assignments
• Revenue and engagement schedule by service, client industry, and geography
• Current and prior professional-liability, cyber, crime, EPLI, and umbrella policies
• Applications, supplemental questionnaires, loss runs, complaints, and notices
• Access-control, payment-approval, incident-response, and backup documentation
• Closing agreement provisions concerning liabilities, records, notices, and indemnity

Diligence lens by exposure

Hypothetical: Illustrative acquisition finding

A buyer finds that the target’s revenue report calls work “advisory,” while several engagements include valuation and transaction opinions. The diligence team pauses the classification, requests engagement samples and policy supplements, and asks the broker and counsel how the service should be disclosed.

Sources

• U.S. Small Business Administration: Buy an existing business or franchise — accessed 2026-09-13; supports General acquisition diligence categories..
• AICPA: AICPA Code of Professional Conduct — accessed 2026-09-13; supports Professional conduct and responsibility context; not transaction advice..
• National Institute of Standards and Technology: Cybersecurity Framework — accessed 2026-09-13; supports Identify, protect, detect, respond, and recover control-organizing concepts..