How to Onboard a New CPA Client: Engagement Letter Best Practices and Intake Process

The most expensive CPA client is often one who was never properly onboarded. Scope creep, fee disputes, and professional liability exposure almost always trace back to an intake process that was rushed or an engagement letter that was too vague. The AICPA's Statements on Standards for Tax Services (SSTS No. 1) and AU-C Section 210 for attest engagements both presuppose a written engagement agreement as the foundation of the CPA-client relationship — and malpractice carriers consistently report that the absence of a clear engagement letter is a contributing factor in the majority of CPA professional liability claims. Done correctly, onboarding protects the firm, sets the client's expectations, and creates a workflow that scales. This guide covers the full process from initial inquiry to signed engagement and active workflow.

Prerequisites

• A scope-of-services decision: what this client is engaging you for, at what fee tier
• A blank engagement letter template your firm or malpractice carrier has reviewed
• Access to your firm's practice management software or a document management system
• A checklist of documents you need from the client before beginning work

Step 1: Qualify the Prospect Before Accepting the Engagement

Not every prospect is the right client. Accepting an engagement creates professional obligations under IRS Circular 230, state CPA ethics rules, and AICPA professional standards — obligations that exist even if the engagement turns out to be poorly scoped or unprofitable. Before you extend an engagement letter, assess:

Financial complexity vs. your firm's capacity. A Schedule C filer with straightforward income is very different from a multi-entity structure with intercompany transactions, K-1 distributions, and a prior year under IRS examination. If the client's complexity exceeds your current capacity or competence level, you have both a business reason and a professional obligation under 31 CFR §10.35 (Circular 230 competence standard) to either decline or bring in a qualified collaborator.

Prior CPA relationship. Ask directly: "Who prepared your prior-year returns, and are you leaving that relationship or was it a one-time arrangement?" Request a copy of all prior-year returns for the past three years. If a client is leaving a prior CPA, request a professional courtesy call with the predecessor before accepting — this is standard practice and often surfaces issues (unfiled returns, prior disputes, known IRS activity) that affect whether you accept the engagement and how you price it.

Conflicts of interest. Under 31 CFR §10.29, CPAs must identify and disclose conflicts before representing a client. Run a conflict check against existing clients, especially for business entity work where related-party transactions or adverse interests may arise.

Red flags. Prior CPA turnover (multiple preparers in recent years), reluctance to provide prior-year returns, pressure to sign quickly before year-end, or requests to take aggressive positions before you have reviewed the facts are all signals that warrant additional diligence.

Step 2: Draft the Engagement Letter

The engagement letter is a contract. It defines the scope of the engagement, allocates professional liability, establishes fee terms, and creates the legal framework for your relationship. AICPA professional standards do not prescribe a mandatory engagement letter format for most tax engagements, but malpractice carriers — including CAMICO and Aon Affinity — consistently recommend written engagement letters for every engagement without exception.

Core clauses every engagement letter must include:

Scope statement. Define specifically what you are and are not doing. "Prepare federal and California Form 1040 and Schedule C for tax year 2025" is a scope statement. "Assist with tax matters" is not. Scope disputes are the leading source of CPA malpractice claims — an ambiguous scope statement resolves in the client's favor.

Exclusions. List explicitly what is excluded from the engagement. Common exclusions for business clients: quarterly payroll tax filings (unless separately engaged), sales tax compliance, financial statement preparation, bookkeeping services, state returns not listed, representation in IRS examinations, or local tax filings. Every service not listed in the scope section should appear in the exclusions section.

Fee arrangement. Specify the fee basis (fixed annual fee, hourly rate, blended rate), estimated or not-to-exceed amounts where applicable, billing frequency, and payment terms. For value-based or subscription pricing, include the monthly retainer amount and what it covers. See CPA Fees and Hourly Rates in 2025 for market benchmarks by service type.

Late payment and non-payment. Specify interest on past-due balances (typically 1.5% per month), your firm's policy on work suspension for non-payment, and any collection process. This clause must be enforceable under your state's usury and collection statutes — confirm with your state bar or a commercial attorney if uncertain.

Limitation of liability. A limitation of liability clause caps the firm's exposure to a defined amount — typically the prior 12 months' fees paid for the engagement, or a fixed dollar cap. Courts in most jurisdictions enforce these clauses between sophisticated commercial parties. The clause should explicitly cover third-party claims: under the Ultramares doctrine and its various state-law successors, CPAs have historically been protected from third-party negligence claims absent privity — but the engagement letter should reinforce privity by establishing the specific client relationship.

Confidentiality. Affirm that client information will be held in confidence under IRC §7216 (disclosure of tax return information) and your state CPA ethics rules. Note any exceptions required by law — for example, mandatory reporting requirements or responses to subpoenas.

Client responsibilities. The client's obligations: to provide complete and accurate information, to respond to information requests on a timely basis, and to review the completed work product before the filing deadline. Establish that the CPA's work product is based on information provided by the client and that the client retains responsibility for the accuracy of underlying records.

Termination. Specify that either party may terminate the engagement with written notice, that all work completed through termination will be billed, and that the CPA will promptly return client-provided documents upon termination. Avoid clauses that attempt to prevent clients from engaging another CPA — these are unenforceable and potentially violate professional ethics rules.

Electronic signature authorization. If your state and engagement type permit electronic signatures (most do, under ESIGN and UETA), include explicit authorization. Platforms like DocuSign and Adobe Sign meet legal signature requirements for engagement letters in all U.S. jurisdictions.

Step 3: Conduct the Client Intake

An engagement letter signed without supporting documentation is half an intake. Before beginning any work, collect:

Prior-year federal and state returns (all years in scope, plus three prior years for context). Review immediately for red flags: large carry-forwards, prior-year amendments, late filing history, or missing schedules.

Entity documentation. For business clients: articles of incorporation or organization, operating agreement or bylaws, current ownership structure, and any prior-year S-Corp election (Form 2553) or partnership documents. Verify that the legal entity structure matches how returns were previously filed.

IRS correspondence. Ask directly: "Have you received any IRS notices or correspondence in the past three years?" Obtain copies of all notices. For notices still open, confirm whether a prior CPA or representative is handling them — if so, you need either a handoff or a separate Form 2848 engagement.

Current-year financial information. For business clients: most recent income statement and balance sheet, payroll records, and any large transactions year-to-date that will affect the tax position.

Identification documentation. For new clients, collect a government-issued ID copy for each responsible party. This is best practice under the AICPA's Know Your Client guidance, particularly for business clients involving entity formation, trust administration, or international transactions.

Step 4: Set Fee Arrangements and Establish Billing

Before the first invoice, the client should have no surprises about how fees work. Review the engagement letter fee section with the client verbally — do not rely on them reading it without discussion. Specific topics to address:

What triggers additional fees. Complexity discovered after engagement start (for example, unreported income discovered during return preparation, additional states that need returns, or prior-year amendments required) triggers a fee adjustment. Your engagement letter should include a change order provision authorizing the CPA to submit a revised fee estimate before continuing work if the actual scope materially exceeds the original estimate.

Payment timing. Establish whether billing is upfront (deposit or retainer), on completion (final payment at delivery), or in installments. A two-installment structure — 50% upfront at engagement signing, 50% on delivery — reduces non-collection risk and aligns with how Client Advisory Services practices typically structure retainer payments.

Payment methods. Accept payment methods that create a clear paper trail — ACH, credit card, or check. Wire transfer is appropriate for large engagements. Cash-only payment demands are a red flag.

Step 5: Establish Communication Protocols

Undefined communication expectations create friction and malpractice risk. Set them in writing at onboarding:

Primary point of contact. On your side: who is the engagement manager and who is the reviewing partner. On the client's side: who is the primary contact for document submission and who has authority to approve and sign returns.

Response time expectations. Your firm's standard: typical turnaround for information requests (e.g., five business days for routine requests), and the client's expected turnaround (e.g., document requests submitted with a stated return-by date).

Deadline notification. The client is responsible for providing information in time for you to meet filing deadlines. Establish a standing policy: document requests not fulfilled 20 days before the filing deadline will trigger an extension. Obtain the client's consent to file extensions on their behalf automatically if this threshold is missed, and confirm whether extension filing is included in scope or billed separately.

Secure document exchange. Specify the method: your firm's client portal, encrypted email, or a practice management platform. Do not accept sensitive tax documents (SSNs, financial statements, W-2s) via unencrypted email. AICPA guidance strongly recommends encrypted channels for all document transmission involving sensitive personal or financial information.

Step 6: Execute the Engagement and Set Up Your Workflow

Once the engagement letter is signed and documents collected:

Open the client file. In your practice management system, create the client record with all entity information, tax ID numbers, filing deadlines, and assigned staff.

Set deadline reminders. Enter all filing deadlines — federal and state — for every return in scope, plus internal preparation milestones (e.g., return due to reviewer 30 days before deadline, client review period 10 days before deadline).

Document the engagement start. Note the date the engagement letter was executed, the documents received at intake, and any unresolved open items from prior-year returns or IRS correspondence. This documentation protects you if a dispute arises later about what was disclosed at the start of the engagement.

Review prior returns for planning opportunities. For new business clients especially, a prior-return review frequently surfaces immediate planning opportunities — large deduction items not taken, missed elections (e.g., §199A optimization, S-Corp reasonable salary adjustments), or entity structure changes worth addressing. Flag these before you file the current-year return.

Common Mistakes

Accepting verbal scope changes. Any change to the scope, fee, or timeline should be documented in a written amendment or change order. Verbal agreements about scope expansions almost always create disputes at billing time.

Using a generic engagement letter without firm-specific customization. A boilerplate letter downloaded from the internet or borrowed from another firm may not reflect your state's professional liability rules, your specific services, or your firm's fee structure. Have every template reviewed by your malpractice carrier and a commercial attorney before using it.

Not updating the engagement letter annually. An engagement letter signed in 2023 for ongoing services does not clearly govern a 2026 engagement. Reissue and re-execute engagement letters annually for continuing clients, especially if services, fees, or contacts have changed.

Failing to include a professional ethics disclosure for Circular 230. For clients who may be represented before the IRS, confirm that the engagement letter addresses representation scope. Under IRS Circular 230, an engagement letter that bundles return preparation and IRS representation without clearly delineating the representation scope can create ambiguity about when the CPA's obligations to the client begin and end.

Starting work before the letter is signed. This is the most common error in high-volume tax practices during filing season. Beginning work before executing the engagement letter eliminates your scope protection and limitation of liability clause. Use your practice management system to block project initiation until engagement letter execution is confirmed.

FAQ

Is an engagement letter legally required for CPA services?

For attest services — audits, reviews, and compilations — AU-C Section 210 and SSARS 21 require a written engagement letter or equivalent agreement. For tax services, no federal statute mandates a written engagement letter, but AICPA professional standards strongly recommend one for every engagement, and most malpractice carriers require them as a condition of coverage. In a fee dispute or malpractice claim, the absence of a written scope agreement consistently disadvantages the CPA.

What's the difference between an engagement letter and a client services agreement?

An engagement letter is typically engagement-specific — scoped to a defined tax year or set of services. A client services agreement (CSA) or master services agreement is an ongoing framework that governs all services between the CPA and client, with individual service orders or statements of work added for each engagement. Larger firms often use a CSA for ongoing relationships and annual engagement letters for each tax year's scope. Either structure works; the key is that the scope, fee, and liability provisions are clearly documented in writing for every active engagement.

Can I limit my liability in an engagement letter?

In most U.S. jurisdictions, yes — limitation of liability clauses in engagement letters between CPAs and business clients are enforceable. The clause must typically be conspicuous, clearly stated, and not unconscionable under state contract law. Some states restrict liability limitations in specific professional services contexts; verify with local counsel. Consumer clients (individuals) receive less favorable treatment for limitation of liability clauses in some states.

How do I handle a client who refuses to sign the engagement letter?

A client unwilling to sign an engagement letter is either unfamiliar with the process or uncomfortable with a specific term. Walk through the letter together and address objections item by item. If after discussion the client refuses to sign any written agreement, that is a strong signal to decline the engagement — proceeding without documentation exposes the firm to unlimited scope claims and eliminates your primary liability defense.

How often should I update engagement letters for ongoing clients?

Annually, at minimum. A new engagement letter should be issued and executed for each tax year for individual and business tax clients. If your fee structure, service scope, or key contacts change mid-year, issue an amendment. The date of execution establishes when the new terms govern — which matters in any fee or scope dispute.

What should an engagement letter say about document retention?

Specify that the client is responsible for retaining the source documents underlying the return (see Document Retention Requirements for IRS Audits for the applicable retention periods). Your firm's policy on retaining work papers — typically seven years for tax files under most state CPA board rules — should also be stated. Note that work papers are your firm's property, not the client's, but the client is entitled to their completed return and any documents they provided to you.

Can I use an electronic engagement letter?

Yes. The ESIGN Act (15 U.S.C. §7001) and state UETA adoptions make electronic signatures legally equivalent to wet signatures for contract purposes, including engagement letters. Platforms like DocuSign, PandaDoc, or your practice management system's built-in e-signature feature all meet ESIGN requirements. Ensure your system creates a timestamped audit trail of when the letter was sent, viewed, and signed — this documentation is essential if the signature is challenged later.

How does the engagement letter interact with my professional liability coverage?

Most CPA malpractice policies include engagement letter compliance as a condition of coverage — insurers expect to see a signed engagement letter in the file before the claim is paid. CAMICO and other carriers publish model engagement letter templates as part of their risk management resources. Review your specific policy requirements with your carrier annually. If your firm does not currently have professional liability (E&O) coverage, this is also the time to address that gap — see What E&O Coverage Limits Should a Professional Carry for context on professional liability limits.

Arvori helps CPA firms manage client communication, document intake, and workflow from a single platform — including automated engagement tracking, deadline management, and secure client portal. If your onboarding process is creating bottlenecks during filing season, see how Arvori works.