How to Start a CPA Firm in the U.S.: Licensing, WISP and Insurance Checklist

Important: This guide provides general educational information. It does not provide legal, tax, accounting, insurance, cybersecurity, or professional-standards advice. CPA and firm requirements vary by jurisdiction, services, ownership, entity, and client work. Confirm current rules with the appropriate state board of accountancy and qualified advisers.

Starting a CPA firm involves more than forming an entity and finding clients. A defensible launch plan should align six systems:

1. State accountancy licensing and firm-registration requirements.
2. Business entity, tax, banking, and ownership arrangements.
3. Service scope, professional standards, contracts, and quality controls.
4. IRS preparer and electronic-filing credentials when tax services are offered.
5. Information security, vendor oversight, incident response, and continuity.
6. Insurance that reflects the firm’s actual services and data exposure.

Complete these workstreams together. A website promising services that are missing from the firm’s registration, insurance application, engagement letter, or control environment can create avoidable risk.

Step 1: Verify individual and firm licensing requirements

CPA licensure and firm practice are regulated at the jurisdiction level. An active individual CPA license does not automatically answer every question about firm registration, permitted entity types, ownership, firm names, attest services, mobility, peer review, or practice in another state.

Start with the NASBA Boards of Accountancy directory, which links to the official board and statutes for each jurisdiction. The Accountancy Licensee Database also provides public CPA and firm-license information supplied by participating state boards.

Ask the board or qualified counsel:

• Must the firm obtain a permit, registration, or license before offering services?
• Which entity types are permitted for a CPA firm?
• What ownership, voting, management, or resident-manager rules apply?
• Does the proposed firm name require approval or particular wording?
• Which services trigger peer review, attest, compilation, or other requirements?
• What rules apply to remote clients or practice across state lines?
• Are assumed names, office locations, responsible licensees, or changes in ownership reportable?
• What continuing professional education and renewal dates apply?

Preserve the board’s response, application, approval, and renewal calendar.

Step 2: Define the service scope before forming the operating system

List each service the firm will perform during its first year:

• Tax preparation and representation.
• Bookkeeping and write-up work.
• Payroll processing or reporting.
• Financial statement preparation, compilation, review, or audit.
• Advisory, controller, CFO, valuation, or consulting services.
• Technology, data, or implementation support.
• Fiduciary, trustee, funds-handling, or payment authority.

The list affects licensing, competence, staffing, software, engagement letters, quality control, independence, insurance, cybersecurity, and pricing. Separate services the firm is ready to deliver now from services planned for later.

Step 3: Form and register the business

The Small Business Administration’s launch guidance directs businesses to choose a structure, register the business, obtain federal and state tax IDs, apply for licenses and permits, open a business bank account, and assess insurance.

A CPA-firm setup checklist can include:

• Select an entity after legal and tax review.
• Clear the proposed firm name with the state board and business-registration authority.
• File formation and assumed-name documents.
• Obtain an EIN and required state accounts.
• Prepare ownership, operating, shareholder, or partnership agreements.
• Open dedicated banking and accounting systems.
• Establish signature authority and segregation of duties.
• Register for state and local tax, payroll, and business requirements.
• Calendar annual reports, license renewals, CPE, insurance renewals, and security reviews.

Do not assume that forming an LLC eliminates professional or personal liability. Entity law, individual professional conduct, contracts, and insurance address different issues.

Step 4: Obtain the correct IRS credentials for tax services

The IRS distinguishes individual preparer identification from firm electronic-filing authorization.

PTIN

The IRS states that paid federal tax return preparers generally need their own current Preparer Tax Identification Number. A PTIN belongs to the individual and cannot be shared.

EFIN

An Electronic Filing Identification Number identifies a firm or provider approved for IRS e-file. The IRS describes three steps for becoming an authorized provider: create or use an e-Services account, submit the application, and pass the suitability process. The IRS notes that processing can take up to 45 days, so include it in the launch schedule.

The firm’s e-file application should be updated when required. Protect e-Services accounts and EFIN information from unauthorized use.

Useful starting points:

• IRS PTIN requirements
• IRS EFIN frequently asked questions
• IRS authorized e-file provider process

Step 5: Build the WISP before collecting client data

The IRS states that federal law requires tax professionals to create, implement, and maintain an information-security plan to protect client data. The FTC Safeguards Rule governs covered financial institutions, and IRS Publication 4557 provides tax-professional guidance.

A launch-ready WISP should reflect the firm’s actual environment—not a template left unedited. Document:

• The person responsible for the security program.
• Client-data types, locations, systems, devices, and transmission methods.
• Risk assessment and priority risks.
• Account provisioning, least privilege, and termination.
• Multifactor authentication for email, remote access, cloud, administrative, and tax-service accounts.
• Encryption, endpoint protection, patching, and supported software.
• Backups, separation, restoration testing, and recovery priorities.
• Vendor selection, contracts, access, and ongoing review.
• Security awareness and phishing response.
• Incident detection, escalation, evidence preservation, notification, and insurer coordination.
• Review dates, testing, exceptions, and improvements.

Use the tax-preparer WISP requirements guide, editable WISP template, and WISP readiness scorecard as starting resources.

Step 6: Create engagement and quality-control systems

Before serving the first client, define:

• Client acceptance, conflicts, independence, and risk-screening procedures.
• Engagement-letter approval and renewal.
• Scope, client responsibilities, deadlines, assumptions, deliverables, and fee terms.
• Information requests, client representations, and approval checkpoints.
• Preparation, review, release, and correction procedures.
• Record retention, secure disposal, legal holds, and access restrictions.
• Complaint, error, demand-letter, subpoena, and potential-claim escalation.
• Use and review of contractors, seasonal staff, and offshore or third-party services.
• Documentation for tax positions, advisory recommendations, and client decisions.

Engagement letters cannot eliminate every liability, and contract wording should be reviewed by qualified counsel familiar with the firm’s services and jurisdiction.

Step 7: Choose vendors and systems through a risk lens

Inventory the planned technology and critical providers:

Record vendor decisions and contracts in the WISP. A well-known vendor does not eliminate the firm’s responsibility to configure, monitor, and terminate access appropriately.

Step 8: Build an insurance program around actual services

Common coverages considered by CPA and accounting firms include:

Compare the application, quote, policy forms, exclusions, endorsements, and contracts. Do not treat a certificate or marketing summary as the complete policy.

• CPA professional liability guide
• Accountant professional liability guide
• Cyber insurance for accountants
• Insurance quote worksheet

Step 9: Plan continuity before launch

A firm handling deadlines and sensitive records needs a continuity plan even when it has one owner.

• Identify who can access critical systems if the owner is unavailable.
• Document client communication and deadline procedures.
• Maintain secure emergency contacts for software, IT, bank, insurer, counsel, and state/IRS reporting.
• Test restoration and alternative-work procedures.
• Address ownership transition, disability, death, retirement, and records custody.
• Review key-person or buy-sell needs with qualified legal, tax, and insurance professionals.

Startup-cost categories

Avoid relying on a universal “cost to start a CPA firm.” Build a local budget from documented quotations:

Request current, comparable quotes rather than presenting unsupported national averages.

90-day launch sequence

Days 1–30: authority and design

• Confirm state-board requirements and service scope.
• Select the entity and clear the name.
• Begin firm registration and EFIN application where needed.
• Choose core contracts, WISP owner, risk assessment, and insurance submission.

Days 31–60: systems and controls

• Configure software, MFA, devices, backups, portal, retention, and vendor access.
• Finalize engagement letters and quality-control procedures.
• Complete insurance comparison and continuity planning.
• Test client intake, approval, billing, incident, and restore workflows.

Days 61–90: verify before accepting clients

• Confirm licenses, registration, IRS credentials, banking, and insurance are effective.
• Complete staff and security training.
• Run a tabletop exercise for a filing error, phishing compromise, and owner unavailability.
• Correct identified gaps and preserve evidence of testing.
• Launch only the services the firm is authorized and prepared to deliver.

Frequently asked questions

Can one CPA license cover an entire firm?

Firm and individual licensing rules vary by jurisdiction. Confirm firm registration, responsible-licensee, ownership, service, and practice-location requirements with the relevant state board.

Does every owner need to be a CPA?

Ownership rules vary by jurisdiction and entity. Some states permit non-CPA ownership subject to conditions; others impose different restrictions. Verify before finalizing the ownership agreement.

Does a CPA need both a PTIN and EFIN?

A CPA preparing federal returns for compensation generally needs an individual PTIN. A firm electronically filing client returns needs appropriate IRS e-file authorization and an EFIN. Confirm the firm’s services and roles against current IRS guidance.

Is professional liability insurance legally required?

The answer depends on jurisdiction, services, licensing rules, contracts, lenders, and client requirements. Even when not required by statute, it may be required contractually or selected as a risk-management measure.

Can a small CPA firm outsource cybersecurity?

Yes, but outsourcing work does not eliminate governance, vendor oversight, access control, incident planning, or legal obligations. Document responsibilities and verify the provider’s controls and contract terms.

Sources and methodology

• NASBA Boards of Accountancy directory
• NASBA Accountancy Licensee Database
• IRS PTIN requirements
• IRS EFIN frequently asked questions
• IRS e-file for tax professionals
• IRS identity-theft information for tax professionals
• FTC Safeguards Rule
• SBA launch-your-business guidance

This guide uses national sources for orientation but directs readers to the controlling state board and jurisdiction-specific rules rather than implying that CPA-firm requirements are uniform nationwide.