Accounting Firm Insurance: The 2026 Liability Playbook

Most accounting firms arrive at their insurance program not by auditing their own risk but by reading the requirements a counterparty handed them. The engagement letter sets a limit. The audit committee asks for a certificate. The commercial lease names the landlord additional insured. By the time the firm is comparing quotes, most of what it will bind has already been decided by the people whose signatures the partners need.

That reframe is the point of this playbook. It is not a catalog of what each policy does — that work belongs on the sister library, isthiscovered.org. This is the professional-liability map: five exposures that actually generate claims at an accounting firm, who can assert each one, and which line of coverage is supposed to answer it. The decisions left to the partners are narrower than the brochure suggests, and they are the ones that matter.

Where these hit your timeline. Few arrive at licensure. They attach to milestones.

Milestone	What enters	Why then
Solo practitioner, no staff	Defer most coverage	No counterparty is demanding anything; no employees generate claims
First engagement letter with a limit clause	Professional liability	The client conditions the engagement on proof of a named limit
Firm holds client or trust funds	Crime / fidelity	Holding other people’s money activates a fiduciary exposure no E&O form covers
First hire	EPLI exposure	Every pay, promotion, and termination decision becomes a potential claim — and nobody requires it
Public-company audit client	Higher E&O stakes, independence scrutiny	SEC Rule 2-01 and PCAOB standards expand who relies on the work

1. A client says your tax, audit, or advisory work caused a loss

A client relied on your tax return, your audit opinion, or your advisory memo, the result was wrong, and they say it cost them money — or a third party who relied on the work says so. They sue. This is the central exposure of an accounting practice, and the coverage that answers it goes by two names that point at the same form: professional liability, usually labeled “accountant E&O,” and — colloquially — malpractice. See professional liability versus malpractice for why the label is profession-specific rather than a separate product. The policy pays to defend and settle claims that your professional service failed a client: a negligent tax position, a missed filing deadline, an audit that failed to detect a material misstatement, an advisory recommendation that caused a loss.

The claim turns on the standard of care, and that standard is set differently depending on the service. The AICPA’s professional-responsibilities guidance describes the duties that create recognizable claim themes: competence, due care, integrity, objectivity, confidentiality, and conflicts. Tax work is governed additionally by IRS Circular 230, which addresses practitioner competence, thoroughness, preparation, engagement letters, and client expectations. Audit work carries a heavier layer: for issuer audits, PCAOB AS 1000 sets the auditor’s responsibility for due professional care, skepticism, and reasonable assurance, and SEC Rule 2-01 governs accountant independence for public-company work. The public-company audit expands who may rely on the deliverable beyond the direct client.

Two details earn the attention they rarely get. First, general liability does not turn a client’s economic loss into a covered claim — the boundary between GL and professional liability is read from the policy, not assumed. Second, accountant E&O is overwhelmingly written on a claims-made trigger, so a lapsed policy or a changed retroactive date can reopen years-old returns and audits. See claims-made or occurrence for malpractice for the exit problem the trigger creates at retirement or partner departure.

2. Client financial data is breached

Ransomware, a phishing compromise, or a vendor failure exposes the tax files, payroll records, and client credentials your firm held. Accounting practices are concentrated targets precisely because they hold exactly the data identity thieves want. Two enforcement paths hit you at once, and that is what makes this exposure different from the first. Your client can sue or demand proof of coverage under the engagement letter — but your state’s attorney general can also act under state breach and privacy law, whether or not any client complained. The contract is one trigger; the statute is another.

The data-security duty is not only a matter of best practice. IRS Circular 230 addresses data security as part of a tax practitioner’s professional obligations, so a breach can also become a Circular 230 matter alongside the civil and regulatory exposure. The coverage is cyber, and what matters is the boundary between first-party and third-party response. The lawsuits that follow a breach of client data sit on the third-party side; the cost of your own forensic investigation, notification, and credit monitoring is first-party cyber, and a bare professional-liability form leaves that side bare. The mechanics of what cyber responds to live on the sister library, isthiscovered.org.

3. Client funds are mishandled or embezzled

Your firm holds client money — trust-account balances, payroll tax escrows, escrowed funds in a transaction — and an employee, a partner, or a vendor diverts it. The loss is not a professional error in the tax return or the audit; it is the disappearance of money you had a duty to safeguard. The coverage that answers it is crime and fidelity coverage, and it is a separate line from E&O. An E&O policy covers the firm’s negligent professional acts; it does not cover employee theft or the disappearance of client funds held in trust.

The legal analogue for the duty is safekeeping. ABA Model Rule 1.15 governs how lawyers must hold client and third-party funds — separate accounts, recordkeeping, and prompt delivery. It is the lawyers’ rule, not the accountants’, but the principle is shared: a professional who holds other people’s money bears a fiduciary duty to keep it separate and accounted for, and the breach of that duty is what crime and fidelity coverage is built for. Firms that never hold client funds — pure advisory or pure tax-prep shops — face a smaller version of this exposure; firms that run payroll, hold trust balances, or custody escrow face the full version and should not assume their E&O answers it.

4. An employment claim surfaces

Your first real termination, a reduction in force, a dispute over a partner track, or a claim that a manager’s conduct crossed a line. The former employee — or a candidate you never hired — alleges discrimination, harassment, or retaliation. The coverage is EPLI.

This one is unlike the others, and the difference matters: nothing requires it. No state board, no client engagement letter, no landlord demands EPLI. It is a judgment call, and that is exactly why it is underbought. The exposure starts at the first hire, because every hiring, pay, promotion, and termination decision is a potential claim that none of your other policies will answer — professional liability, general liability, and workers’ comp all exclude employment acts. The EEOC identifies retaliation as the most frequently alleged basis of discrimination, which compounds quietly: whatever the firm does after an employee complains can become a second claim even when the first fails. The Insurance Information Institute frames EPLI’s most-used benefit as paying for a defense that ends in no finding of wrongdoing.

5. Someone is hurt or property is damaged on your premises

A visitor injured in your office, a slip at the client site where your auditor is working, or damage to a client’s property while your staff is on-site. The coverage is general liability for bodily injury, property damage, and certain advertising injuries.

For most accounting firms this is real but modest — a small physical footprint, low premises exposure. What makes it non-optional is the lease. Commercial landlords require general liability, commonly at $1 million per occurrence, and name the landlord additional insured. The client-site exposure is the wrinkle that distinguishes a professional-services firm from a desk-bound one: your auditors and consultants are routinely on someone else’s property, and a GL claim can arise there even when the underlying engagement is a professional-liability matter.

The decisions that are actually yours

Strip away the requirements and a pattern emerges across the five. The same three questions decide almost every line, and buyers conflate them constantly:

Exposure	Legally required?	Someone will require it?	Prudent even if not?
Professional liability (E&O)	No	Yes — client engagement letter	Yes — the central exposure of any accounting service
Cyber	Partly — state breach law, Circular 230	Yes — client contract	Yes — you hold client financial data
Crime / fidelity	No	Sometimes — client holding funds	Yes — if you hold client or trust funds
EPLI	No	Sometimes — client or partner agreement	Yes, at your first hire
General liability	No	Yes — your landlord	Premises or client-site exposure

Those are different reasons to buy the same policy, and they point at different limits. The genuine decisions — the ones a brochure will not make for you — are narrower still. Size limits against your worst single exposure, not a generic tier. The floor is whatever your largest engagement letter demands; the sanity check is the most plausible loss from one failed engagement, defense costs included. Read the claims-made trigger before you switch carriers or lose a partner. Accountant E&O responds when the claim is made, not when the return was filed, so a changed retroactive date, a lapsed policy, or an unmaintained tail at a partner’s departure can open a gap over years-old work. Decide where E&O ends and crime begins if you hold client funds, because the two lines answer fundamentally different failures.

A short checklist

1. Signing a new engagement letter → read the insurance clause; the limit it names is your E&O floor.
2. Holding client or trust funds → evaluate crime and fidelity coverage separately from E&O.
3. Made your first hire → get an EPLI quote and confirm workers’ comp status with your state.
4. Signing a lease → confirm the general-liability limit and the additional-insured endorsement before you take the keys.
5. Renewing, switching carriers, or losing a partner → check the retroactive date, prior-acts language, and tail obligations before you replace a policy.

---

Sources are linked below. This playbook frames the liability exposures; the coverage mechanics — forms, certificates, mandates, claims — are on isthiscovered.org, and each exposure above links to its own question page for the sourcing behind the claim.