Accounting-firm regulatory and office compliance checklist is a working review of the authority, registrations, professional responsibilities, information controls, premises, and operational permissions relevant to a proposed sale. It records transaction-specific questions and evidence; checking boxes does not certify compliance or substitute for qualified professional and legal review.
How should the seller establish the review scope?
Establish the actual services, individuals, entities, jurisdictions, and proposed changes. Requirements can depend on facts that a general description such as tax firm or CPA practice does not capture.
Begin with the seller hub and a service inventory. Identify tax preparation, representation, bookkeeping, payroll, advisory, compilation, review, audit, and other engagements. Record where work is performed and where relevant clients and entities are located.
Use the state boards of accountancy directory to locate appropriate regulators for CPA-related questions. Prepare a specific description of ownership, firm structure, principal location, services, and changes rather than assuming the seller’s current arrangement answers every buyer requirement.
Appoint a coordinator and identify legal, tax, professional, security, insurance, premises, and systems reviewers as appropriate. Keep proposed requirements distinct from completed evidence. A pending application or adviser question should remain pending in the readiness file.
What is the numbered regulatory and office working checklist?
For each item, add the applicable requirement or question, responsible reviewer, current evidence, proposed transaction change, required action, due date, and completion decision. Mark inapplicable items with a supported reason.
- Map services and jurisdictions. Identify the actual engagement types, operating locations, client jurisdictions, and entities whose authority or obligations require review.
- Review individual professional status. Confirm relevant credentials, permitted roles, limitations, required updates, and qualified responsibility for the acquired work.
- Review firm authority and ownership. Examine applicable entity, ownership, voting, professional-control, name, and firm-permit questions for the proposed post-close structure.
- Review attest and engagement responsibilities. Identify independence, acceptance, professional review, quality-management, and other applicable questions arising from changed ownership or relationships.
- Review tax-provider readiness. Determine required individual and provider registrations, applications, updates, authorized entities, software arrangements, and readiness for upcoming filing work.
- Review client-information permissions. Identify proposed recipients, purposes, file transfers, confidentiality obligations, and any required consent or other permitted basis with appropriate advisers.
- Review security responsibilities. Determine applicable information-security requirements, responsible personnel, written plans, access, vendors, backups, incident response, and evidence of actual implementation.
- Review payroll and money handling. Identify provider structure, client authorizations, bank access, payment responsibilities, reconciliations, and jurisdiction-specific service questions.
- Review premises and office access. Examine lease or ownership terms, transfer rights, landlord requirements, operating permissions, signage, equipment, and proposed relocation or remote operation.
- Review employment and contractors. Examine relevant agreements, compensation, benefits, work arrangements, confidentiality, restrictions, and requirements affected by the transaction.
- Review insurance and claims. Examine applicable coverage, claims, notices, continuity, proposed changes, predecessor exposure, and specialist questions before relying on assumptions.
- Approve the readiness record. Reconcile findings with the agreements, financing, staffing, transition, and closing conditions; preserve evidence and assign continuing post-close actions.
The pre-sale preparation checklist organizes broader readiness. This review supplies evidence about authority and operation rather than a generic assurance that the firm is compliant.
How should individual and firm authority be distinguished?
Distinguish an individual’s professional credentials from the entity’s authority, ownership structure, name, and obligations for the actual services. One fact does not automatically establish the others.
Provide advisers with before-and-after organization diagrams and service maps. Identify the people directing and reviewing professional work, their locations, and any shared-service or investor arrangements. Record questions arising from non-CPA ownership or separate attest and nonattest entities.
Do not rely on a copied model-law summary as proof of current law in a particular state. Locate the actual regulator and relevant current rules through the reviewed process. Preserve written adviser conclusions and required approval or filing evidence.
A seller’s business can operate through one existing entity while the buyer plans a new one. That change may affect practical authority, registrations, contracts, and client communications. Keep the proposed structure consistent across purchase documents, provider planning, insurance review, and staff instructions.
What should the review establish about an EFIN?
It should establish the authorized provider and the steps required for the actual acquiring entity and transaction. A computer or password transfer does not determine whether the buyer can use the seller’s filing identifier.
IRS EFIN frequently asked questions states that an EFIN is not transferable, including when a business is sold. Determine required applications or updates through the applicable IRS process and confirm readiness before relying on electronic filing operations.
Record the current entity, proposed entity, responsible person, application or update status, software dependencies, and upcoming service events. A pending provider process should appear in the transition and closing schedule with its consequence understood.
The closing-day checklist should confirm the resulting evidence. An owner saying the seller will remain available does not itself establish a valid provider arrangement or remove the buyer’s need for an approved operating plan.
What should information-security review actually verify?
Verify the obligations applicable to the operation and evidence that relevant controls work. A policy document and a secure-platform subscription are useful inputs, but neither alone proves implementation.
The current FTC Safeguards Rule in 16 CFR Part 314 contains information-security requirements for covered financial institutions. Its limited exceptions for institutions maintaining information on fewer than 5,000 consumers do not remove every obligation. Obtain a fact-specific coverage and requirement review for the practice.
Identify responsible leadership, written plans, data inventory, risk review, access controls, service providers, monitoring, incident procedures, and other applicable duties. The specialist should distinguish verified controls from untested claims and determine which proposed transaction changes require action.
For access, review who can invite users, export records, change permissions, and administer critical systems. For backups, obtain appropriate evidence that required data can be restored. Do not place passwords or unrestricted credentials in the transaction room as a substitute for controlled access.
How should office and contractual permissions be reviewed?
Review actual agreements, proposed use, and relevant permissions rather than assuming the buyer can inherit every office or vendor arrangement unchanged. A business sale and a premises transfer can have different conditions.
Examine leases, equipment agreements, software licenses, communication services, bank arrangements, insurance, and other material contracts. Identify consent, assignment, new-account, cancellation, or replacement questions with the responsible advisers and providers.
For a remote transition, review record custody, employee access, client communication, mail, signage, and any proposed change in principal location. Eliminating an office expense can also create moving, support, or alternate-space costs; quantify the actual plan before underwriting savings.
The data-room index provides controlled locations and version references for this evidence. Keep commercially sensitive agreements restricted appropriately and route questions through the agreed review process.
Which findings should alter the closing or transition plan?
Findings should alter the plan when they affect lawful service delivery, authority, access, money handling, professional responsibility, or an essential contract. Document the consequence and required action explicitly.
| Finding | Required review | Evidence of resolution |
|---|---|---|
| New operating entity | Authority, provider, contracts, and ownership | Reviewed structure and required completed steps |
| Pending provider process | Filing readiness and service contingency | Status evidence and approved operating plan |
| Lease transfer uncertainty | Assignment or alternative premises | Required consent or reviewed replacement arrangement |
| Unverified security claim | Applicable obligations and actual controls | Specialist findings and documented corrective work |
| Unclear professional review | Qualified capacity and responsibility | Assigned reviewer and supportable workload |
| Restricted client records | Recipient, purpose, and permitted sharing basis | Reviewed disclosure procedure and access controls |
These are illustrative review scenarios, not findings about a particular practice. Record what is confirmed and what remains uncertain. A missing document is initially an evidence gap, while a verified restriction has its own implications and potential remedies.
How should the checklist remain current after the sale?
Assign continuing duties and update the readiness record when entities, services, people, jurisdictions, premises, systems, or contracts change. Closing does not automatically end regulatory, professional, or operational responsibilities.
Keep approval evidence, adviser conclusions, deadlines, access ownership, and unresolved actions in a controlled file. Set review dates based on actual requirements and material changes rather than an invented universal renewal calendar.
The seller and buyer should understand who handles predecessor records, open matters, notices, and future authorized requests. A useful checklist leaves a reviewable responsibility map and a specific action register, allowing the transition team to maintain service while completing the obligations identified by qualified reviewers.
A few common questions
What else should you know?
Does a CPA’s license establish every firm requirement?
No. Individual credentials and the entity’s authority, ownership, name, locations, and professional responsibilities require separate review for the actual services. Provide advisers with the proposed structure and jurisdiction map. Preserve required evidence and approvals rather than assuming one licensed person resolves every firm or acquisition readiness question.
Is an EFIN transferable with the practice’s computers?
No. IRS guidance states an EFIN is not transferable, including in a business sale. Review the acquiring entity and proposed structure to identify required applications or updates through the applicable process. Confirm filing readiness separately from equipment, password, software, or seller-assistance transfers and record any unresolved service dependency.
Does the FTC’s fewer-than-5,000-consumer exception remove all duties?
No. The current rule provides limited exceptions to specified requirements, not a blanket exemption from every obligation. Obtain a fact-specific review of coverage and applicable duties. Then verify the operation’s actual security controls, responsible people, written plans, vendors, and corrective actions instead of relying on a general small-firm label.
What should an unresolved office-transfer issue do to the plan?
Identify the actual contractual question, responsible adviser or provider, needed consent or alternative, cost, and effect on service readiness. Record its closing or transition dependency. Do not assume a business sale automatically transfers premises or vendor rights, and do not underwrite office savings before the reviewed replacement plan and obligations are understood.
Which sources support this guide?
Primary rules and guidance support the factual statements in this article. The worked examples and decision frameworks are original educational analysis.
- Boards of Accountancy — NASBA
- FAQs about electronic filing identification numbers — Internal Revenue Service
- 16 CFR Part 314: Standards for Safeguarding Customer Information — Electronic Code of Federal Regulations