Permitted workpaper sampling review is a bounded examination of selected engagement records under an established access basis to investigate documentation, service effort, technical concerns, and operating dependencies before a practice acquisition. Its purpose, selection method, reviewer competence, and limits need to be stated before files are opened.
What should a sampling review answer?
It should answer specific acquisition questions that aggregated financial records cannot resolve. Examples include whether reported work hours are credible, required review is documented, service scope is clear, and unusual engagements need further investigation.
Start with the buyer hub and the practice due-diligence guide. A sampling exercise is one review workstream, not a replacement for financial reconciliation, staffing analysis, contract review, or professional authority.
Define whether the work is an acquisition diligence procedure, a separate technical engagement, or another agreed assignment. Do not label an informal review an audit, peer review, quality-of-earnings engagement, or assurance report unless it actually meets the applicable requirements.
A reviewer should understand the services and relevant standards. A buyer familiar with individual returns may need different qualified support to investigate specialized business work, payroll, or other practice services.
What makes access permitted?
Establish the basis for disclosure and use before selecting identifiable records. A purchase opportunity and signed confidentiality agreement do not independently grant unrestricted access to every client file.
The IRS Section 7216 information center addresses restrictions involving tax-return information. Review applicable exceptions, consent requirements, actual recipient, intended use, and record category before deciding the permitted approach.
The AICPA Code of Professional Conduct addresses confidential client information and relevant member responsibilities. Applicable federal and state rules and actual agreements may impose additional conditions; one confidentiality analysis should not be presumed to settle every record type.
Use aggregated, redacted, or supervised review where appropriate to the approved purpose. Redaction needs to remove identifying content from attachments and metadata as well as obvious cover pages when the reviewed approach requires it.
Record permitted recipients, locations, copying rights, access dates, retention, disposition, and incident escalation. A seller-controlled screen session can reduce copying but does not itself establish a disclosure exception.
How should the review population be defined?
Define the universe using a reconciled engagement register with stable identifiers and relevant service periods. State whether it includes filed returns, open work, amended work, discontinued clients, or only a selected acquisition perimeter.
Without that population, fifty reviewed files can sound precise while representing an unknown fraction of the work. A seller-selected subset of clean engagements may not address the buyer’s actual questions.
Reconcile population counts to service and billing records. A return package, household, related business group, and annual engagement can be different units; choose the one suitable for the purpose and avoid duplicating it.
Include important exclusions in the report. For example, inability to access a category may leave a material risk unresolved rather than proving the category has no issues.
How should targeted and representative selection differ?
Use targeted selections to investigate known risks and separately designed representative selection when the purpose requires broader inference. A risk-focused sample is informative precisely because it overweights concerns, but that makes a raw finding rate unsuitable for the whole population.
| Selection group | Assumed files | Question tested |
|---|---|---|
| Largest fee engagements | Five | Scope, effort, and economic dependence |
| Technically complex work | Ten | Qualified preparation and review requirements |
| Recently reassigned staff work | Ten | Continuity and documented supervision |
| Separately selected random group | Fifteen | Questions within its defined selection universe |
| Known exceptions or unresolved matters | Ten | Specific concerns requiring follow-up |
| Total unique files | Fifty | Bounded acquisition review |
This illustrative plan is not a prescribed sample size or statistical design. Deduplicate files appearing in multiple groups and retain their risk tags. If the reviewer needs a valid population estimate, selection, weighting, precision, and methods require appropriate specialist design.
Assume twelve of the fifty files require follow-up. Twelve divided by fifty is twenty-four percent of reviewed files, not proof that twenty-four percent of all practice engagements have an error. Follow-up itself also is not a confirmed defect.
What should the reviewer record for each file?
Record the identifier, selected purpose, permitted scope, service period, reviewer, evidence examined, observation, interpretation, open question, and proposed next action. Keep client details limited to the authorized work.
Distinguish missing documentation, unclear scope, apparent technical questions, unrecorded effort, and confirmed matters requiring correction. The categories have different financial and operational effects.
An absent review signature may require investigation into the actual review process. It should not immediately be described as proof that no review occurred. Conversely, a signature alone is not a substitute for reviewing the relevant evidence.
Separate predecessor work from buyer observations. The Journal of Accountancy working-paper transition discussion addresses custody, confidentiality, and the importance of preserving working papers during ownership changes. Do not overwrite original records while assembling an acquisition issue log.
How should review findings change the financial model?
Translate supported findings into specific costs, capacity needs, contingent questions, or exclusions. Avoid subtracting an arbitrary percentage from price because a file needed follow-up.
For an illustrative budget, fifty files at four reviewer hours each require two hundred hours. At an assumed $120 hourly cost, direct review is $24,000. Add twenty lead-review hours at $180, or $3,600, for $27,600 total.
That is a selected diligence cost, not a quoted fee or required standard. If an expanded review needs another twenty files at the same four-hour assumption, direct incremental cost is $9,600 before added supervision.
If the review identifies continuing annual technical support of $30,000, that belongs in recurring earnings. A one-time $27,600 diligence budget does not fund that annual need indefinitely.
Use the staff evaluation guide to investigate whether existing qualified staff can address the work. A financial cost allowance alone does not prove the needed reviewer is available before deadlines.
What follow-up should be triggered by a concern?
Follow-up should match the observed issue and be controlled by the agreed review process. It may involve a seller explanation, additional supporting evidence, a qualified technical assessment, or a broader permitted sample.
Do not contact a taxpayer, alter a filed return, notify a third party, or promise remedial work as an incidental diligence action without the necessary authority and reviewed instructions. The review assignment and service engagement are separate.
Material unresolved concerns should remain conditions or documented limitations. A seller’s plausible explanation can guide further investigation but should not silently replace missing evidence in the final findings.
When issues involve possible claims, confidentiality, reporting, or correction duties, involve appropriate advisers. Preserve factual observations and review history while distinguishing them from legal or technical conclusions not yet established.
What ordered process keeps sampling reproducible?
Use a written scope and controlled evidence register that another qualified reviewer can follow. The resulting record should show what was examined and what remains unknown.
- Define the acquisition questions, reviewer competence, assignment scope, and permitted access basis.
- Reconcile the engagement population, service periods, identifiers, exclusions, and relevant selection groups.
- Select and deduplicate files using documented targeted and representative methods appropriate to the purpose.
- Record observations, evidence, limitations, follow-up, and supported financial or capacity effects without altering originals.
- Resolve material findings or state explicit conditions, then follow approved access, retention, and disposition instructions.
The technology and migration guide addresses later operational transfer. Completion of diligence access does not establish readiness for a bulk export or future production use.
What belongs in the final sampling report?
State purpose, authorized scope, population, selection method, unique files, reviewers, time period, findings, limitations, follow-up, and financial consequences supported by evidence. Keep confidential detail within approved access boundaries.
Identify confirmed matters separately from questions still open. Explain whether findings affected staffing, service acceptance, price assumptions, funding, or closing conditions, and who owns each unresolved action.
The report should help the buyer make a defined acquisition decision. A file count and raw follow-up percentage alone do not show that work quality, replacement labor, client continuity, and future obligations have been adequately evaluated.
A few common questions
What else should you know?
Does a nondisclosure agreement permit reviewing every tax return?
No. Establish the actual disclosure and use basis for the intended records, recipients, and purpose. Tax-return information and professional confidentiality requirements need separate review. Aggregated, redacted, or supervised access may be appropriate, but the access method itself does not create an exception or replace required consent under applicable rules.
Is the illustrative fifty-file plan a recommended sample size?
No. It demonstrates a mixture of targeted and separately selected files, not a prescribed statistical design. Actual scope depends on the population, questions, services, material risks, reviewer competence, access limits, and required inference. A representative estimate needs appropriate selection and interpretation methods rather than reliance on a convenient round number.
Can twelve follow-up files establish a twenty-four-percent error rate?
Not for the whole practice. Twelve of fifty is twenty-four percent of reviewed files, and follow-up is not necessarily a confirmed defect. The risk-focused selection intentionally includes known concerns. Report selection groups, observations, limitations, and resolved findings before deciding whether any broader inference or financial adjustment is supportable.
Should diligence reviewers correct the predecessor’s files?
Not as an unapproved incidental action. Preserve originals and record observations separately. Technical correction, taxpayer communication, amended filings, third-party notification, and remedial service require proper authority and a reviewed assignment. The sampling report should identify the concern, evidence, follow-up owner, and any acquisition condition without assuming a new service engagement.
Which sources support this guide?
Primary rules and guidance support the factual statements in this article. The worked examples and decision frameworks are original educational analysis.
- Section 7216 information center — Internal Revenue Service
- AICPA Code of Professional Conduct — AICPA
- Changes at the firm? What to do with working papers — Journal of Accountancy