CPA Client Onboarding: Engagement Scope and Handoffs

Separate inquiry, prospect, and accepted client states

A contact can ask about services without becoming a client, and document receipt does not itself establish an engagement. Record the person, entity, related parties, requested service, jurisdiction, relevant period, referral source, deadlines as reported, and current relationship using approved minimum fields. Support may describe the firm’s published process and collect screening information; it should not promise acceptance, create an attorney-client or accountant-client relationship, say work has begun, or expose information about another client. Give each state a clear owner, allowed response, and evidence.

Route conflicts and independence instead of clearing them

Conflicts, objectivity, and independence depend on the people, entities, affiliates, financial and business relationships, services, period, applicable professional rules, and engagement type. General support should not decide that a relationship is immaterial, a nonattest service is allowed, safeguards are sufficient, or the firm is independent. Capture the potential relationship without unnecessary detail and route it to the firm’s reviewed process. Do not reveal conflict-search results or the identity of another client when explaining that further review is required.

Make scope, deliverables, fees, and responsibility explicit

Distinguish tax preparation, bookkeeping, outsourced accounting, financial-statement preparation, compilation, review, audit, attestation, consulting, representation, and other services. Similar client language does not make these engagements interchangeable. Support may point to an approved proposal or engagement record, but changes to deliverables, periods, deadlines, client responsibilities, use restrictions, report language, fees, retainers, billing terms, or termination belong with authorized firm personnel. Preserve the version, acceptance evidence, effective date, and later modifications.

Close onboarding with controlled access and ownership

Provision portals, matter access, document requests, contacts, and notifications only after the required identity, engagement, authorization, role, and security steps. Determine whether tax return information, financial records, payroll data, audit evidence, or regulated data requires additional controls. Tell the client what is active, what remains pending, who owns each request, and how follow-up will occur. Do not promise deadline protection, evidence sufficiency, independence clearance, work completion, a professional conclusion, or a final fee unless the authoritative record supports it.

Build the control table

Govern professional knowledge and handoff

Every answer should point to a dated, owned source. Separate public education, firm policy, engagement terms, client statements, source documents, accounting records, workpapers, tax return information, and professional conclusions. Require qualified review for accounting treatment, audit and assurance, independence, ethics, licensure, tax advice, preparation, filing, representation, Section 7216, fees, deadlines, privacy, security, identity, accessibility, and jurisdiction questions. Log the knowledge version, verification state, engagement boundary, receiving owner, and client confirmation. A summary helps only when its provenance can be checked and the authorized destination accepts the matter.

Protect client data and service resilience

Collect the minimum information needed in approved channels. Define identity verification, access, engagement isolation, retention, redaction, recording, consent, export, deletion, workpaper, document, and vendor controls under the firm’s security program. Provide accessible interaction, effective communication, error recovery, a human alternative, and reviewed language support without inventing a language count. Test outages, stale sources, duplicate uploads, malicious prompts, attempted credential disclosure, impersonation, suspicious instructions, conflicting engagement records, and failed handoffs with synthetic data. Record limitations, owners, incident paths, and rollback procedures.

Apply scope and qualified review

This article provides general operational information, not accounting, audit, assurance, attest, tax, legal, financial, representation, licensing, ethics, independence, privacy, security, identity, accessibility, or compliance advice. Client, entity, engagement, service, framework, period, jurisdiction, practitioner status, authorization, contract, systems, facts, and current standards control. A configured conversational system may assist approved intake and routing, but this article does not claim LumiTalk accepts an engagement; clears conflicts or independence; performs bookkeeping, accounting, audit, review, compilation, attestation, tax preparation, filing, or representation; makes a professional judgment; issues a report or opinion; executes a payment; validates consent; guarantees deadlines, outcomes, security, or compliance; reads live client, accounting, tax, or audit systems; or provides exact pricing, availability, language, or integration coverage.

Primary sources

Use current primary sources as the factual floor, then obtain firm, engagement, service, client, entity, framework, period, practitioner, and jurisdiction-specific qualified review. AICPA Code of Professional Conduct · NASBA State Boards of Accountancy · AICPA Standards and Statements · SEC Qualifications of Accountants

Continue through the CPA Firms cluster

Use the hubs and service page for cluster context, then compare adjacent guides before implementing a workflow. CPA Firms resource hub · Tax & Accounting resource hub · LumiTalk for CPA-firm operations · CPA Firm Customer Support Operations Guide · CPA Audit and Assurance Request Intake · CPA Firm Data Security and Privacy Intake