Professional liability insurance for CPAs, bookkeepers and tax preparers.

Where a California rule sets a minimum: accountancy corporations and tax preparers

No federal rule I know of makes errors and omissions coverage a condition of preparing returns or keeping books; the demand I see comes from engagement letters, lenders and referral networks with a minimum limit. Two California rules put numbers on it.

Accountancy corporations. A CPA firm organized as a California accountancy corporation must keep security for client claims under 16 CCR §75.8: insurance of at least $100,000 per claim for each CPA, with the required per-claim amount capped at $1,000,000, and at least $250,000 for each CPA for all claims in a calendar year, capped at $3,000,000; or a written agreement in which the shareholders jointly and severally guarantee the corporation's liabilities to its clients. With neither, every shareholder is deemed jointly and severally liable for client claims. The regulation does not say whether that headcount means shareholders only or every CPA in the firm, so I size the limits to the larger number.

Tax preparers. A California preparer who is not exempt under Business and Professions Code §22258 (the exemptions cover CPAs and CPA firms, State Bar members, enrolled agents, regulated trust companies and financial institutions, and their supervised employees) must register with the California Tax Education Council and keep a $5,000 surety bond from a surety admitted in California, payable to the people of the State, covering fraud, dishonesty, misstatement, misrepresentation, deceit or any unlawful act or omission (§22250.1). The same section bars conducting business without a current bond. The bond is separate from E&O; I place both.

Retroactive dates, and why a tax claim can arrive years later

I will not let a client accept a quote whose retroactive date is later than the one they have, because every return between the two dates falls out of coverage. Prior-acts coverage is that date carried forward when you change carriers; it is the first thing I compare on competing quotes.

The date matters because of how long a tax claim takes to surface. In International Engine Parts, Inc. v. Feddersen & Co. (1995) 9 Cal.4th 606, the California Supreme Court held that the two-year limitations period under Code of Civil Procedure §339 for negligent preparation of a tax return starts when the IRS assesses the deficiency, not when the return was filed or the client discovered the error; until then an examiner's findings are merely proposed. A return filed this year can be examined, negotiated and assessed over several years before the client's clock starts, so continuous coverage matters more than any single year's limit. When you retire or merge, ask whether the extended reporting period is unlimited in duration, or whether the acquiring firm's policy will carry your retroactive date.

One more reason to size the limit: Business and Professions Code §5063 requires a California CPA to report to the Board of Accountancy, within 30 days of learning of it, any civil settlement or arbitration award of $30,000 or more relating to the practice of public accountancy where the CPA is not insured for the full amount. A settlement your policy pays in full is outside that subdivision; one above your limit is not.

Client data: the written security plan the FTC and IRS require, and where cyber coverage starts

The FTC's Safeguards Rule (16 CFR Part 314) lists tax preparation firms among the financial institutions it covers, and the IRS puts it directly: Federal Trade Commission regulations require professional tax preparers to create and enact security plans to protect client data. The program must be written and appropriate to the size and complexity of the business: a Qualified Individual to supervise it, a risk assessment, encryption of customer information at rest and in transit, multi-factor authentication for anyone accessing customer information, staff training, oversight of service providers and a written incident response plan. The unauthorized acquisition of at least 500 consumers' unencrypted information must be reported to the FTC no later than 30 days after discovery. IRS Publications 4557 (Safeguarding Taxpayer Data) and 5709 (How to Create a Written Information Security Plan for Data Safety) are the guides.

Behind the breach sit the disclosure rules: under IRC §7216 a knowing or reckless disclosure of return information is a crime, with a fine of up to $1,000 and up to a year in prison, and §6713 adds a civil penalty of $250 per unauthorized disclosure or use, up to $10,000 in a calendar year.

A professional liability policy is built for the negligent return, not the stolen one. Breach notification, forensics, defense of a regulatory inquiry, funds-transfer fraud and ransomware belong to a separate cyber policy, and what each picks up depends on the forms. The cyber application asks whether the written plan exists, whether multi-factor authentication covers every account that touches client data and whether backups are kept offline; those answers decide the offer.

Official sources

• California Board of Accountancy
• 16 CCR §75.8, security for claims against accountancy corporations (Cornell LII)
• California Business and Professions Code §22250.1, tax preparer surety bond
• California Business and Professions Code §22251, definition of tax preparer, council and registrant
• California Business and Professions Code §22258, persons exempt from CTEC registration
• California Business and Professions Code §5063, events a CPA must report to the Board
• International Engine Parts, Inc. v. Feddersen & Co. (1995) 9 Cal.4th 606
• FTC Safeguards Rule: what your business needs to know
• IRS: Protect your clients, protect yourself (security plans and publications)
• IRS: Tax preparer penalties (IRC §§6694, 6695, 6713, 7216)
• IRS: Outsourcing payroll and third-party payers