Client Acceptance and Continuance for Small CPA Firms

Three layers of AICPA standards govern the decision: the firm-level quality objectives in QM section 10, the engagement-partner duties in AU-C section 220, and the engagement-specific preconditions in AU-C section 210. This post covers each layer, the Code's independence and conflict checks, and a process a small firm can run in a day.

See also our SQMS No. 1 guide, the audit engagement letter guide and predecessor and successor auditor communications.

Layer 1: QM section 10 quality objectives

SQMS No. 1 codified as QM section 10 replaced SQCS No. 8. Firms had to design and implement a system of quality management in compliance with it by December 15, 2025, and complete the first evaluation of the system within one year after that date. Acceptance and continuance is one of the components the firm builds into that system.

The standard requires quality objectives so that judgments to accept or continue a client relationship or a specific engagement are appropriate based on two things:

1. Information about the nature and circumstances of the engagement and about the integrity and ethical values of the client, including management and, when appropriate, those charged with governance.
2. The firm's ability to perform the engagement in accordance with professional standards and applicable legal and regulatory requirements. That includes time and resources.

The firm's financial and operational priorities must not lead to inappropriate judgments. A firm short on revenue applies the same test.

What counts as information

The application material in QM section 10 names the inputs:

• Nature of the engagement: industry and regulatory factors, operations, ownership, governance, business model and financing.
• Integrity and ethical values: the identity and business reputation of principal owners, key management and those charged with governance.
• Risk indicators: attitude toward aggressive accounting interpretations and the control environment, whether the client is aggressively concerned with keeping the firm's fees as low as possible, indications of a client-imposed scope limitation, indications of money laundering or other criminal activity, and the reasons for appointing the firm and not reappointing the prior firm.
• Sources: for an existing client, information from current or previous engagements and inquiry of other personnel who have served the client. For a new client, inquiry of existing or previous providers of auditing services, discussions with bankers, legal counsel and industry peers, and background searches of relevant databases.

Write those into a one-page acceptance form and record each answer.

Layer 2: the engagement partner's responsibility

AU-C section 220, effective for engagements for periods beginning on or after December 15, 2025, assigns three duties to the engagement partner:

• Determine that the firm's acceptance and continuance policies and procedures have been followed and that the conclusions reached are appropriate.
• Take the information obtained in the process into account when planning and performing the audit. Risk indicators found at acceptance feed the risk assessment.
• If the engagement team learns of information that would have led the firm to decline the engagement had it been known earlier, communicate that information promptly to the firm so the firm and the partner can act.

Before dating the report, the engagement partner also determines whether relevant ethical requirements, including independence, have been fulfilled.

Layer 3: AU-C 210 preconditions

AU-C section 210 governs the specific engagement. Before the firm agrees to audit, paragraph .06 requires the auditor to establish whether the preconditions for an audit are present by doing two things:

• Determine that the financial reporting framework to be applied is acceptable.
• Obtain management's agreement that it acknowledges and understands its responsibility for preparing and fairly presenting the financial statements in accordance with the framework; for designing, implementing and maintaining internal control relevant to preparation of statements free from material misstatement, whether due to fraud or error; and for providing the auditor access to all relevant information, additional information the auditor requests, and unrestricted access to people within the entity from whom evidence is needed.

If the preconditions are not present, the auditor discusses the matter with management. Unless law or regulation requires otherwise, the auditor does not accept the engagement when the framework is unacceptable or the management agreement has not been obtained. The auditor also does not accept an audit engagement, unless law or regulation requires it, when management imposes a scope limitation that the auditor expects to result in a disclaimer of opinion.

For a client whose books sit in a cloud accounting file, the access precondition is concrete: management agrees in writing to provide the books and supporting documents and to make people available.

The letter and recurring audits

AU-C 210 requires the agreed terms in an engagement letter or other written agreement. On recurring audits, the auditor assesses whether the terms need revision. If they do not, the auditor reminds management of the terms and documents the reminder.

Predecessor communications

For an initial audit or reaudit with a predecessor auditor, AU-C 210 requires the firm, before accepting, to ask management to authorize the predecessor to respond fully. After SAS No. 147, effective for audits of financial statements for periods beginning on or after June 30, 2023, the inquiry covers:

• Identified or suspected fraud involving management, employees with significant roles in internal control, or others when the fraud resulted in a material misstatement.
• Noncompliance or suspected noncompliance with laws and regulations that came to the predecessor's attention, other than clearly inconsequential matters.

If management refuses authorization or limits the response, the firm asks why and weighs the implications. The predecessor responds on a timely basis on the basis of known facts, absent unusual circumstances and unless prohibited by law, and states clearly when a response is limited. The successor evaluates the response (or the lack of one) in deciding whether to accept, and documents the inquiries and results when it accepts. See the predecessor communications post and first-year audits.

The independence and conflict check

The Independence Rule (ET 1.200.001) states that a member in public practice shall be independent in the performance of professional services as required by standards promulgated by bodies designated by Council. Run that test at acceptance, before the engagement letter is signed.

The Code's conflict-of-interest interpretation (ET 1.110.010) adds a separate check. A conflict of interest creates adverse interest and self-interest threats. Threats can arise when the firm's work on a matter involves two or more clients whose interests conflict, or when the firm's own interests on a matter conflict with the client's. Its examples include advising two clients competing to acquire the same company. It also states that independence impairments "cannot be eliminated by the safeguards provided in this interpretation or by disclosure and consent." Disclosure and consent address a conflict of interest; they do not cure an independence impairment.

If issues are identified at acceptance and the firm accepts anyway, record on the form how each was resolved. For nonattest services, apply the requirements in our independence and nonattest services post before the engagement letter goes out.

A one-day acceptance process

1. Intake interview: ownership, lenders, prior auditor, reason for change, deadline.
2. Integrity screen: background search on owners and key management.
3. Competence and capacity check: staff, specialists and hours available in the client's year-end window.
4. Independence and conflicts check: every covered person against the client and its affiliates, plus nonattest services in scope.
5. Predecessor inquiry with management's authorization; record the response.
6. Preconditions memo: framework acceptable; management's acknowledgment of its responsibilities obtained.
7. Partner sign-off, dated before the engagement letter is signed.
8. Annual continuance form with the documented reminder of the engagement terms.

What the reviewer sees

Peer reviewers test whether the policies in your quality management system operate. A dated acceptance form signed by the engagement partner shows the system running.

Sources

• AICPA, QM section 10, A Firm's System of Quality Management (acceptance and continuance objectives and application material; design and implementation required by December 15, 2025)
• AICPA, AU-C section 210, Terms of Engagement (preconditions, agreed terms, predecessor inquiries as amended by SAS No. 147)
• AICPA, AU-C section 220, Quality Management for an Engagement Conducted in Accordance With Generally Accepted Auditing Standards (periods beginning on or after December 15, 2025)
• AICPA Code of Professional Conduct: ET 1.200.001 and ET 1.110.010, https://pub.aicpa.org/codeofconduct/ethicsresources/et-cod.pdf

CORAA prepares ready-to-review audit files for US CPA firms from client books; you review and sign. See /us.

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error