A CPA firm client onboarding checklist usually opens with a welcome packet and a contract. The professional standards open two steps earlier, with three conditions under which a firm should not accept the engagement at all. The IRS adds a constraint of its own, processing a third-party authorization 14 business days after receipt, which often makes that form, rather than the kickoff call, the item that decides when work can begin. Sequencing onboarding around those two facts is what keeps a new client's first month from slipping.
What a CPA Firm Client Onboarding Checklist Has to Produce
The checklist has one job, which is to make the first piece of real work signable, on time, without a partner rebuilding the file. Five things have to be true before that happens.
- An acceptance decision you could defend. Someone named made it, on stated grounds, and wrote it down.
- Terms in writing, countersigned. Scope, exclusions and fees exist in a document both sides signed, not in a proposal the client skimmed.
- Authorization on file. The firm can pull what it needs from the IRS without asking the client to forward a transcript.
- The records, plus agreed access to more of them. Not a folder dump, and not a monthly chase.
- One cycle delivered and reviewed. The first period proves the setup instead of assuming it.
The rest of an onboarding process exists to produce one of those five.
The Acceptance Decision Comes Before the Welcome Packet
Statements on Standards for Accounting and Review Services, the AICPA standards that govern preparation, compilation and review work and abbreviated SSARSs, treat acceptance as a gate. AR-C section 60 says at .30 that the accountant should not accept an engagement performed under SSARSs if any one of three things is true: the accountant has reason to believe that relevant ethical requirements, including those related to independence where they apply, will not be satisfied; the accountant's preliminary understanding of the engagement circumstances indicates that information needed to perform the engagement is likely to be unavailable or unreliable; or the accountant has cause to doubt management's integrity such that it is likely to affect the performance of the engagement (AICPA, AR-C sections).
Any one of the three is enough on its own. That matters, because the third condition is the one firms talk themselves out of during a good sales conversation.
The same section then sets preconditions at .31. Before accepting, the accountant determines whether the financial reporting framework management selected is acceptable, and obtains management's agreement that it acknowledges and understands its own responsibilities: for selecting that framework, for the design, implementation and maintenance of the internal control relevant to preparing and fairly presenting statements free from material misstatement unless the accountant decides to take that responsibility on, for preventing and detecting fraud, for the entity's compliance with the laws and regulations that apply to it, and for the accuracy and completeness of the records, documents, explanations and judgments it hands over (AICPA, AR-C sections).
Read that list as an onboarding artifact rather than as boilerplate. It is the moment the client formally accepts that the books are theirs, which is the only version of that conversation that is cheap to have.
Paragraph .30 was renumbered and amended by SSARS No. 26, effective for engagements performed under SSARSs for periods beginning on or after December 15, 2025. Paragraph .31 was only renumbered by SSARS No. 26, and its last amendment was SSARS No. 25, effective for periods ending on or after December 15, 2021 (AICPA, AR-C sections). A tax-only engagement is not performed under SSARSs, so the wording does not bind it. The three questions still decide whether the file is worth having, and a firm that cannot answer them about a prospect is guessing.
Ask the Predecessor Before You Answer the Client
When a prospect is leaving another firm, the outgoing accountant knows things the prospect will not volunteer. For an initial audit, including a reaudit, which is an audit of statements a predecessor auditor already audited, that conversation is a precondition. AU-C section 210 says at .11 that before accepting, where a predecessor auditor exists, the auditor should request management to authorize that predecessor to respond fully to inquiries that will assist in deciding whether to accept, and that if management refuses to authorize the predecessor auditor to respond, or limits the response, the auditor should inquire about the reasons and consider the implications of that refusal or limitation in deciding whether to accept (AICPA, AU-C sections).
Once management authorizes the response, .12 sets a floor rather than a closed list. The auditor should ask about matters that will assist in deciding whether to accept, including identified or suspected fraud involving management, involving employees who have significant roles in internal control, or involving others where the fraud resulted in a material misstatement in the financial statements, and matters involving noncompliance or suspected noncompliance with laws and regulations that came to the predecessor auditor's attention during the audit, other than when matters are clearly inconsequential. That inquiry was added by SAS No. 147, effective for audits of financial statements for periods beginning on or after June 30, 2023 (AICPA, AU-C sections).
That requirement is written for initial audits and reaudits, so it does not reach a bookkeeping or tax engagement on its own terms. The signal it captures travels anyway. A prospect who will not let you call the last firm has told you something, and that belongs in the acceptance file rather than in a footnote after the first invoice.
Put the Terms in Writing, and Get Both Signatures
AR-C section 70 covers an engagement to prepare financial statements, meaning one where the accountant is engaged to prepare them and is not engaged to audit, review or compile those same statements. Merely assisting management in preparing statements is a bookkeeping service the section does not cover, and the section is not required to be applied to statements prepared solely for submission to taxing authorities. Where it applies, the engagement letter is a requirement with named contents. The section says at .10 that the agreed terms should be documented in an engagement letter or other suitable form of written agreement, covering seven items: the objective of the engagement, management's responsibilities, the responsibilities of the accountant, the limitations of the engagement, identification of the applicable financial reporting framework, management's agreement that each page will state that no assurance is provided or that the accountant will issue a disclaimer to that effect, and whether the statements will contain a known departure from the framework or omit substantially all required disclosures (AICPA, AR-C sections).
Two signatures close it. The letter should be signed by the accountant or the accountant's firm and by management or those charged with governance, meaning the people or body responsible for overseeing the entity and its financial reporting, which in a private company is usually a board or an owner group (AICPA, AR-C sections). The application material is blunt that an oral understanding is insufficient. So the checklist item is a countersigned letter, not a sent one.
What the standard does not write for you is the boundary. Name the work that is out of scope, say who reconciles the bank accounts, and price cleanup separately from the recurring engagement. A prior-period mess discovered in week two is a different engagement from the one that was signed, and the letter is the only place that distinction survives a disagreement.
Start the IRS Authorization on the Day You Sign
On a new tax client whose transcripts or IRS correspondence the firm will handle, third-party authorization is the longest-lead item, and it is the one that can be started the moment the letter comes back. The IRS processes both Form 2848, Power of Attorney and Declaration of Representative, and Form 8821, Tax Information Authorization, 14 business days after receipt (IRS, processing status for tax forms).
Which of the two to file, and what each one grants or withholds, is a separate decision, worked through in the guide to outsourcing bookkeeping. The faster online route through Tax Pro Account, and the two client conditions it depends on, are covered in the write-up on tax preparation automation. Either way, the sequencing point holds: file on signature day, and the authorization stops being the thing that delays February.
One piece of firm housekeeping sits underneath both forms. A CAF number, short for Centralized Authorization File, is a unique nine-digit identification number assigned the first time a practitioner files a third-party authorization with the IRS, and it belongs on every authorization filed after that (IRS, Centralized Authorization File authorization rules). A practitioner filing their first authorization does not have one yet, and enters None in the CAF number box, after which the IRS issues the number directly to the representative (IRS, Instructions for Form 2848).
Collect the Records Against Access You Already Agreed
The document request is where onboarding usually stalls, and the leverage for it was created at acceptance rather than in a follow-up email. The management acknowledgment required at .31 of AR-C section 60 includes an agreement to provide the accountant with access to all information management is aware of that is relevant to preparing and fairly presenting the statements, with any additional information the accountant requests for the purpose of the engagement, and with unrestricted access to persons within the entity the accountant determines it necessary to ask (AICPA, AR-C sections).
Then ask for specific artifacts rather than a folder. Prior-year returns and the depreciation schedule show what positions the last preparer took and what carries forward. A trial balance with the chart of accounts tells you whether the books are usable or need rebuilding before anything else can run. Bank, credit card and loan statements covering the periods you will touch let you test opening balances instead of inheriting them. Payroll registers and the last filed employment returns surface the liabilities that otherwise appear at year end. Entity documents, meaning the operating agreement or bylaws and the ownership schedule, decide who may sign and who may receive information, which is a question that gets awkward if it is asked late.
Collecting all of that in one window concentrates the firm's exposure at intake. The written information security program covering it is a rule in its own right, worked through in the guide to cybersecurity for CPA firms.
If any of the work will be handled by a preparer located outside the United States, or will extend to substantive determinations or advice affecting the tax liability, the taxpayer consent required by the tax return preparer confidentiality rules belongs in the same intake pack, signed before anything moves, not in an email in March. A substantive determination is one involving an analysis, interpretation or application of the law. Disclosure to another preparer located in the United States, for the purpose of preparing or assisting in preparing the return and short of substantive determinations, does not require that consent (26 CFR 301.7216-2(d)(1)).
Run the First Cycle as a Calibration
Treat the first delivered period as a test of the setup rather than as the start of production. Pick a period the client can confirm, run it end to end on the firm's own process, and have the reviewer grade it against the standard the recurring work will be held to. Where that process is a monthly close, the sequence and the controls that hold it together are set out in the month-end close checklist.
Two things get settled here that no kickoff call can settle. The first is whether the books support the scope that was signed. The second is whether the firm has the hours to do the work at the promised rhythm. A client accepted into a full calendar is a capacity decision wearing a sales badge, and capacity planning is the honest place to make it.
The Checklist, Stage by Stage
Each stage below ends in a piece of evidence, because a stage without evidence is a stage someone will claim was done.
| Stage | What has to be true | The evidence it happened |
|---|---|---|
| Acceptance | No disqualifying condition, framework agreed, management's responsibilities acknowledged | A dated acceptance memo naming who decided |
| Predecessor | The outgoing firm was contacted where there is one, or the refusal was recorded | The inquiry and the response in the acceptance file |
| Terms | Scope, exclusions, fees and cleanup treatment written | A letter signed by both sides |
| Authorization | The form filed, or the online request approved | The filed form with its submission date, or the approved authorization |
| Records and access | Returns, trial balance, statements, payroll and entity documents received, plus the access to information and people agreed at acceptance | A request list with dates received against each item |
| First cycle | One period delivered and reviewed | Reviewer sign-off against the firm's own standard |
When the Answer Should Be No
Some clients are better declined at the acceptance stage than fixed during onboarding. The three conditions in the accounting and review standards are the clearest cases. Below them sit the practical ones: records so incomplete that the engagement becomes a reconstruction project priced as a monthly service, an owner who will not name a single point of contact, a scope that keeps growing between the proposal and the signature, and a start date that lands inside the firm's own peak without a plan for who absorbs it.
Declining is not the only option. Accepting with a narrower scope, a separate cleanup engagement, or a later start date is usually the honest middle, and it survives contact with April better than optimism does.
Questions Firms Ask About Client Onboarding
How Long Should CPA Firm Client Onboarding Take?
Work backwards from the real constraints instead of picking a target. Records arrive when the client sends them, and the first cycle cannot start until the books are usable. A firm that files the authorization on signature day and issues the request list the same week has taken out the delay it controls. What remains depends on the route, because a filed Form 2848 or Form 8821 is processed 14 business days after receipt, while a request made through Tax Pro Account is processed in real time where the client meets its conditions (IRS, processing status for tax forms).
What Documents Do You Need From a New Client?
Enough to test the opening balances and to see the positions the last preparer took, which is a much shorter list than everything the client owns. Ask for named items with a due date against each, and treat a missing depreciation schedule or a missing payroll register as a blocker rather than as something to chase later.
Does a Bookkeeping-Only Client Need an Engagement Letter?
If the firm is engaged to prepare the client's financial statements, AR-C section 70 applies and the countersigned written agreement is required. If the firm is merely assisting management in preparing them, that is a bookkeeping service the section does not reach, and which of the two you are doing turns on the services the client asked for and the accountant's professional judgment. Either way, the letter is still the only place the scope boundary exists in a form that survives a disagreement about what was promised.
What Goes Wrong Most Often?
Running onboarding in parallel instead of in order. The letter goes out, the portal goes up, the kickoff happens, and week three discovers that the authorization was never filed and the prior-year depreciation schedule never arrived.
Where to Start
Onboarding is not admin. It is the last cheap moment to decide a client is not a fit, and the first moment the client decides whether the firm is organized. Run the acceptance test before the welcome packet, get both signatures, file the authorization the day the letter comes back, and let the first delivered cycle prove the setup rather than assume it.
What usually breaks that sequence is not process, it is people. If onboarding stalls because nobody is free to run the first cycle, Accountably places trained offshore accountants and tax preparers inside a firm in three to four weeks, and the Free 40-Hour Proof Pilot puts a block of the firm's own work through full review before a single client file is committed. Don't trust us. Test us.