Join the waitlist
Guides/Practice Management

Audit Firm Mergers and Succession Planning: Professional Standards Checklist

What a CPA firm must handle when it merges, sells or plans succession: client notice and file transfer under ET 1.400.205, buyer due diligence, section 7216, peer review consultation, independence, quality management and integration.

CORAA TeamUpdated November 5, 20269 min read

Most partners are in the same position: the firm has a few people who hold the audit relationships, those people are closer to retirement than the firm's plan admits, and the options are an internal transition, a merger or a sale. Each path is a business decision, and each also triggers professional requirements that are easy to miss when the term sheet gets the attention.

This guide covers the requirements that attach to the transaction itself: client notice and file transfer, what a prospective buyer may see, tax return information, peer review, independence, quality management and the integration that follows. It does not address valuation or deal structure, which depend on facts specific to each firm.

Begin with succession, not with a buyer

A firm that plans succession early has more options and better terms. The practical starting point is a client-and-partner map:

  • every audit and attest client, with the engagement partner, the years of the relationship and the industry
  • every partner and the clients they personally lead or originated
  • the engagements that need specialized competence, such as benefit plans or governmental audits, and who is qualified to lead them
  • the engagement quality reviewers and the partners who can serve in that role for each engagement type

Where one partner is the only person who can lead a type of engagement, that is a concentration risk for both succession and a merger. The AU-C 220 (SAS 146) requirement that the engagement partner be sufficiently and appropriately involved and have the competence and capabilities for the engagement applies to whoever takes over. Transition plans should therefore include co-leading engagements for at least one cycle before the outgoing partner steps back.

The professional requirements of the transaction

Client notice and file transfer: ET 1.400.205

The AICPA Code's interpretation on transfer of files and return of client records in a sale, transfer, discontinuance or acquisition of a practice took effect on June 30, 2017. For a sale or merger it requires, in substance:

  • The selling firm sends every client a written request for consent to transfer their files to the acquiring firm. Verbal permission does not meet the requirement.
  • The request states that consent is presumed if the client does not respond within 90 days.
  • Files move once the client consents or the 90 days pass, unless a law or state board rule prohibits it.
  • The acquiring firm should be satisfied that all clients of the predecessor firm subject to the acquisition have consented to the continuation of services.
  • If a client's files are not transferred, the seller returns the records to the client, or retains them in a confidential manner if the client cannot be reached, and follows any longer legal or regulatory retention period.
  • Evidence of consent, obtained or presumed, should be kept.

What the buyer may see: ET 1.700.050

Confidential client information is protected by the confidentiality rule, and a prospective buyer reviewing the firm's practice is not automatically entitled to see it. Under ET 1.700.050 the seller must take precautions, typically a nondisclosure agreement, so that the buyer does not disclose client information obtained during the review and does not use it to its own advantage. A revision effective October 31, 2016 added that the buyer also may not disclose client information gained through the actual acquisition. In practice, limit due diligence to what the buyer needs to assess the practice. Redact client names where possible in the early rounds, and move to full data only when the deal is real.

Tax return information: section 7216

If the firm prepares tax returns, the federal rules on use and disclosure of tax return information apply separately from the AICPA Code. Under Treas. Reg. 301.7216-2, taxpayer lists and records may be transferred only in conjunction with the sale or other disposition of the tax return preparation business. Pre-sale due diligence is not treated as a transfer if it is done under a written confidentiality agreement that bars further disclosure or use for anything other than evaluating the purchase. The acquirer takes the list subject to the same restrictions: it may use the list only to contact taxpayers with tax information or to solicit return preparation services, and may not transfer it further except in another qualifying sale. A statistical compilation may be sold or exchanged for value only in conjunction with the transfer of assets in the sale of the business.

Peer review

The AICPA peer review standards require that if a firm has had an acquisition of another practice, or a divestiture of a significant portion of its practice, during or after its peer review year, the reviewer or the reviewed firm must consult with the administering entity and AICPA staff before the review starts to consider the appropriate scope. Submitting the "Firm Structure Change" form can serve as that consultation. A divestiture during the review year may be reported as a scope limitation if the review team cannot assess compliance for reports issued under the firm's name during that year.

Peer reviewers also assess the firm's structure. The standards list "recently merged or recently opened offices" among the factors that affect risk. They also give an example of a firm that had merged several times in two years: its reviewers concluded that the results from different offices were not being consolidated adequately, doubted that integration had succeeded, and could not place significant reliance on the firm's internal inspection to reduce review procedures. The lesson is that a merger puts the quality management system itself on display. The review cycle is three years for each firm, with the due date no more than 42 months after the previous peer review year end, and a firm that expects to merge should plan the timing with that in mind.

Independence and acceptance of acquired clients

Every acquired attest client needs an independence evaluation under the firm's policies before the firm issues its first report on it. The acquired firm's partners and staff must be evaluated under the combined firm's independence policies, and any non-attest services the acquired practice provides to attest clients need the same threats-and-safeguards analysis as the buyer's own. The engagement partner's documentation under AU-C 220 must include significant issues and conclusions on relevant ethical requirements, including independence, and on acceptance and continuance. See independence and nonattest services.

Quality management in the combined firm

SQMS No. 1 has been effective since December 15, 2025, with the first evaluation of the system due within a year. A merger changes the quality risks: different methodology, different tools, different review practices, different monitoring. Before the closing date:

  1. decide which firm's policies, templates and software will apply on day one for each engagement
  2. map the engagement partners and EQR-eligible people in the combined firm
  3. identify the engagements that need an engagement quality review and make sure eligible reviewers exist
  4. align monitoring, including internal inspection, across offices
  5. update the firm's risk assessment and document the response

SAS 146 requires the engagement partner to determine that the nature, timing and extent of direction, supervision and review fit the team's resources. A newly merged team that does not know the firm's methodology needs more of each. See SQMS 1 quality management.

A timeline

Eighteen to twenty-four months out: client-and-partner map, transition plans for engagements led by senior partners, identification of competence gaps.

Twelve months out: decide internal succession, merger or sale. If external, engage advisors and prepare the data room with client names redacted.

Six to nine months out: nondisclosure agreements, due diligence, independence evaluations, peer review consultation planning.

Closing minus 120 days: written consent requests to clients if files are to be transferred, with the 90-day presumption stated.

Closing: engagement letters or assignment, system and access cutover, notice to the peer review administering entity.

First busy season: extra review on acquired-client engagements and a post-season integration review.

Frequently asked questions

The AICPA interpretation requires a written request for consent to transfer files, with consent presumed after 90 days without a reply, unless a law or board rule prohibits transfer.

Can a buyer review client files during due diligence?

Confidential client information may be reviewed in connection with a prospective sale only with precautions, typically a nondisclosure agreement, that prevent the buyer from disclosing or using the information to its own advantage.

Sources

CORAA prepares ready-to-review audit files for US CPA firms from QuickBooks books; you review and sign. See /us.

Part of CORAA University · Quality management and practice: related guides, calculators and templates.

Share

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error

For US CPA firms

Join the CORAA waitlist

CORAA AI drafts audit working papers from your client’s QuickBooks books and does the first pass: lead schedules, tie-out, memos, draft notes and letters. CORAA Network reviewers clear every finding. Your firm reviews and signs.

  • First audit free, so you can judge the quality on a real file
  • Flat fee by entity size; messy books included
  • We work only with CPA firms, never their clients
See how it works →

* required

Keep reading
Schedule M-1 / M-2 / M-3
Book-Tax Differences: Schedules M-1, M-2 and M-3 and How They Tie to the Audit
2 CFR 200.303
2 CFR 200.303 Internal Controls Over Federal Awards: What Recipients Must Have and How Auditors Test It
2 CFR 200.332
2 CFR 200.331 and 200.332 Subrecipient Monitoring: Subrecipient vs Contractor and Pass-Through Duties