How Slippery-Slope Engagements Grow Exposure Risk

In CPA professional liability cases, too often we see a disconnect between what CPAs understand their roles to be and the client’s view.

Consider the following. (The scenario presented is fictional, but it is based upon actual issues and recurring themes found in professional liability cases.)

A CPA’s longtime friend from high school, Mary, starts a small business selling a line of clothing for toddlers out of her home. She handles all the books and records herself, as well as the production side of the business.

The CPA had been preparing her personal tax returns for years, and Mary asks him to also prepare her business returns. The CPA agrees, but never bothers with an engagement letter because he and Mary have known each other for years.

Mary’s business is “discovered” after she attends a trade show, and her sales explode. As her business expands, Mary is unable to keep up with all the business functions she had been handling, so she asks the CPA for help.

First, he recommends that she move the business out of her home. The CPA also recommends that she hire more people and outlines the positions she needs to fill for the financial operations. He recommends a specific accounting system and offers to provide training to newly hired employees on how to use this system.

To make things easier, Mary arranges for the CPA to have full-time remote access to her accounting system so he can respond to questions easier and more efficiently. Given the expansion in the scope of her business, Mary needs financial statements. She again turns to her friend to prepare compiled financial statements.

Still, no engagement letter has been issued. The CPA bills Mary monthly: some bills explicitly itemize his time for the preparation of tax returns and financial statements; others are issued under the catchall category of monthly retainer.

Mary hires two employees to perform accounting and billing functions. One, Emma, had a criminal record for forgery and passing bad checks, but Mary never conducted a background check or screening. After an initial period of time earning Mary’s trust, Emma resorted to her criminal ways and began a two-year period of embezzlement.

The theft was uncovered by a bank employee who contacted Mary about a questionable check. It turned out some of the fraudulent checks had been signed by Mary who had not paid attention to the back-up documentation, while others contained a forged signature.

After being contacted by the bank, Mary called the CPA asking for help. He set up on site for two weeks to investigate the extent of the theft.

He discovered about $50,000 and reported this to Mary as what he believed was the extent of the fraud. Days later, Mary terminated the engagement and hired a new accountant. This new accounting firm conducts its own investigation and concludes that the full extent of Emma’s theft is $500,000.

One year later, the CPA is served with a lawsuit alleging professional negligence, breach of contract, and breach of fiduciary duty. Mary is seeking damages for the $500,000 embezzled, fees incurred to pay the subsequent accountant to uncover the fraud, and attorney fees.

Potential Liability and Defense Considerations

When the CPA first speaks to his lawyer, he expresses shock at being sued. He insists Mary knew all along that his engagement was limited to tax preparation and compilation of the financial statements. He never represented to her that he would perform an analysis of internal controls or any attestation function. He speculates that Mary failed to supervise her employees and is just trying for a money grab.

Despite the CPA’s assertions, there are concerns arising from the fact scenario. Here are some of the factors that would impact his defense.

No Engagement Letter

The lack of an engagement letter is a big problem. Some accountants think they will offend clients by asking them to sign engagement letters, but when you don’t it creates a “he-said-she-said” scenario.

Mary will claim she relied upon the CPA’s expertise and provided him with remote access to the accounting system for the very purpose of watching over things. The CPA will testify that his role was simply to prepare the company’s tax returns and to compile the financial statements, but he does not have the benefit of explicit disclaimer language contained in an engagement letter.

Nor does he have the benefit of reference to specific professional standards that define and clarify his role and responsibility. That language is critical in defending malpractice claims where the scope of the engagement is at issue.

Juries understand and accept disclaimers and standards that define the extent of a CPA’s role. Without them, though, juries will often empathize with the victim of a theft and may be more inclined to accept that person’s version of events.

The Slippery-Slope Engagement

As mentioned, the CPA maintains that his role was limited to tax preparation and compilation of the financial statements. Mary’s lawyer will attempt to undercut this argument by showing how the engagement was actually much broader. While there are bills issued specifically for tax preparation and compiled statements, the lawyer will present bills simply characterized as “monthly retainer.” When there is no engagement letter, the content of bills become even more critical in professional liability cases.

Mary’s lawyer will point out that the CPA had made recommendations for employment positions and the implementation of new systems, and had provided training to the newly hired employees. The lawyer also will point to the perpetual remote access to the books and that Mary did so with the expectation that he would be monitoring the company’s finances.

The lesson to be learned here is that when a client gives an accountant remote access, there should be documentation that this access does not expand or alter the scope of the engagement. It should be made clear that the remote access is simply intended for more efficient access, and it does not shift or remove management’s responsibilities.

An additional engagement-creep difficulty arises from when the CPA was first informed of the fraud. He injected himself into the investigation and spent weeks examining records. Mary’s lawyer will spin these facts to suggest that, by undertaking the investigation, the CPA was trying to protect himself and his own exposure by minimizing the damages.

The lesson here is that best practice would be to arrange for an independent accountant to investigate possible fraud and to remove the perception or ability to argue bias. Further, such an investigation should be conducted by someone qualified to do so.

Management’s Responsibilities

The CPA’s defense team will focus on Mary’s role and her ultimate responsibility as management. In particular, they will stress that not conducting employee background checks, particularly where employees are handling finances, is plainly poor management. They will also argue that Mary neglected her oversight role of the financial operations and was only in the office to supervise employees a couple of days a week. In addition, at least one of the fraudulent checks was actually signed by Mary.
Because she failed to adequately review the back-up documentation before signing a check, she did not catch this fraud. Had she done so, she likely would have terminated Emma – or at least been on notice to investigate Emma’s activities. Management’s engagement along those lines would no doubt have prevented further theft.

Management’s lack of diligence can be an effective defense. Being “asleep at the wheel” while employees are stealing from under management’s nose does not play well in front of a jury when the manager looks to shift blame. The defense of pointing to management incompetence can minimize a damage claim, particularly when there had been several opportunities for management to detect the fraud.  

The original article appeared in the Pennsylvania CPA Journal, the official magazine of the Pennsylvania Institute of CPAs.