Risk Management Archives - CAMICO

Five Common Missteps in Managing CPA Liability Risk

StyleSite Maintenance — Fri, 17 Apr 2026 10:40:58 +0000

Managing CPA liability risk exposures is a complex process, and it’s easy to underestimate the potential for risk along the way. The following five missteps can be avoided by being aware and taking the right actions.

1. Not discussing questions about the insurance application with your underwriter or agent.

Whether it’s for a new or renewal policy, the better the job you do with the application, the better your chances for avoiding missteps and problems. Take time to review the questions and determine what information and data you will need for it; if you’re unsure about a question or the information being asked, give your agent or underwriter a call to have them explain it to you. State the information accurately. Applications are not opportunities to market or embellish your firm’s profile. Misstatements may result in a higher premium or policy coverage issues if the wrong information is given. CAMICO encourages CPAs to call their underwriters or agents with questions about the application and the information requested. A phone call is an easy way to correct errors before they occur.

2. Not having appropriate policy limits for your firm profile.

Excessively high limits of insurance offered at a bargain prices are red flags. High limits will often put a bigger bullseye on your firm and potentially lengthen the claims process. However, you also need to carry enough limit to be able to protect yourself in the event of a bad claim, or to fight a frivolous claim. A specialized underwriter, agent or account executive can discuss your firm’s specific risk exposures, policy limits, and coverage options. Each accounting practice is unique—tax specialists have exposures that are different from those of auditors. An underwriter or agent experienced in CPA firms will work with you to create a policy that addresses your specific risk areas, with the appropriate limits and cost structure.

3. Admitting liability, assuming damages, voluntarily making any payments, or incurring claims expenses.

These are all actions a CPA firm must avoid without the prior written consent of the insurance company. Such actions will likely violate policy conditions, which may result in a denial of coverage. Policyholders should not take action without first receiving guidance from a risk adviser with the insurance company. Avoid agreements that include “hold harmless” or indemnification provisions that are one sided and not in the firm’s favor. Firms that go along with clients in attempting to handle a problem internally without reporting it are sometimes surprised to find out later that the problem is much larger than it appeared to be. If the problem was not reported timely in accordance with the policy, the damages might not be covered.

4. Not reporting a potential claim as early as possible.

The sooner claims and potential claims are reported, the more effective an insurer can be at achieving an early resolution. Early reporting will also help assure coverage for the potential claim. CAMICO encourages early reporting by reducing the deductible by 50 percent, up to $50,000, for early reporting of a potential claim during the policy period in which it becomes known. Further, if it is determined that it is appropriate to retain legal counsel to assist with a pre-claim situation, CAMICO will absorb the legal expenses, help policyholders achieve a resolution with the client, prepare a tax penalty abatement request, draft talking points for communicating the facts of the situation with the client, and provide subpoena and other services if the need arises.

CPAs are often so busy that they don’t recognize or acknowledge a potential claim as it is developing. This can be particularly devastating when the damages claimed are significant and are not covered because of late reporting. It’s important for CPAs to pay attention to potential issues and to report to their carriers as soon as they think there may be a problem. Also new for CPA firms is CAMICO’s “continuity of coverage for potential claims,” which helps eliminate coverage gaps for potential claims known to an insured and not timely reported by the insured, while coverage is consecutively renewed with CAMICO.

5. Not utilizing the insurance program’s advisory, loss prevention, and risk management services.

The best way to avoid a claim is to manage the risks that lead to claims. Some of the basic risk management tools, such as client screening, engagement letters and follow-up documentation, are crucial in managing potentially major problems into minor problems. The more tools and resources an insurance program provides its policyholders, the better those policyholders will be at avoiding or minimizing problems and disputes. A good insurance program will also advise you on how to utilize its resources to help your firm improve its practices. You can also get a good feel for a company’s service and attitude toward its policyholders by using its services. If you are interested in a good partnership with your company, the company should do its best to help you minimize your losses and control your premiums.

The information provided is a general overview and not intended to be a complete description of all applicable terms and conditions of coverage. Actual coverages and risk management services and resources may vary and are subject to policy provisions as issued. Coverage and risk management services may vary and are provided by CAMICO and/or through its partners and subsidiaries.

The post Five Common Missteps in Managing CPA Liability Risk appeared first on CAMICO.

Engagement Letter Do’s and Don’ts

ssAdmin — Wed, 14 Jan 2026 00:16:38 +0000

Signed engagement letters help CPA firms improve communication with clients and protect the firm from litigation as “the first line of defense.” Use the following tips to help you write more effective engagement letters.

Engagement letters should…
• State the purpose of the engagement.
• Define the scope and limits of the engagement.
• Specify known negative conditions or adverse situations.
• Include client instructions, responsibilities, deliverables and dates.
• Note reliance on facts provided by the client.
• Outline terms of fee collections and the consequences of late payment.
• Include a stop-work clause.
• Indicate the firm’s record retention policy.
• Include third-party service provider language, if applicable.
• Include alternative dispute resolution language (i.e., mediation for all disputes and an arbitration clause for fee disputes only).
• Confirm client’s acknowledgment to the terms of the agreement and request client’s signature.

Additional considerations
• Include protective language in traditional tax and financial statement engagement letters that specifically disclaims the firm’s responsibility related to advising on any legal, regulatory, or employment-related matters.
• Specify the client’s responsibility for the adequacy of a system of internal control.
• If applicable, explain limitations regarding financial statement distribution.
• Evaluate the appropriateness and efficacy of including limitation of liability clauses.

Engagement letters should not include…
• Marketing information. The engagement letter should be viewed and composed as a contract.
• All-encompassing language. Limit the scope of your firm’s work by avoiding superlatives and absolutes such as all, every, any, complete, confirm, totally, validate and verify.
• Legal jargon or ambiguity. Don’t use abbreviations or words only a CPA would understand. Any ambiguity will most likely be decided in the client’s favor in a court of law.

Additional tips
• Avoid evergreen letters — update letters annually to reflect changes in the scope of the engagement.
• Update engagement letters whenever engagements change.
• Avoid usurious interest charges. Instead, assess a “late fee” for unpaid balances.
• For tax engagements, include the full or exact name of the client, entity type, specific state name(s) and tax year(s), and purpose of the engagement.

Save yourself time and energy by using the letters specially crafted for CPA firms by CAMICO experts.
As seen above, a clear, comprehensive engagement letter is one of your best safeguards against future disputes. CAMICO offers policyholders with Professional Liability Insurance access to engagement letter review services. CAMICO’s internal Loss Prevention Specialists are happy to review and comment on your drafted engagement letters – at no cost. Furthermore, CAMICO has 150+ sample engagement and disengagement letter templates available on its Members-Only Site. CAMICO experts designed these sample letters to be clear and understandable for clients, provide appropriate documentation for you, and effectively outline the scope of your work.

The post Engagement Letter Do’s and Don’ts appeared first on CAMICO.

CAMICO Tip: Tax Engagements – Managing Client Expectations

Amber — Fri, 09 Jan 2026 15:39:49 +0000

Are you taking the right steps to manage (and document) client expectations? Effective communication is a key factor in any CPA-client relationship, and when you work to stay in control of managing client expectations, you help to safeguard your firm. To that end, good documentation is critical to successfully managing client expectations. Jurors (members of the public) generally consider CPAs to be experts in documentation, and falling short of that expectation may be viewed as negligent and perceived as falling below the standard of care.

Below are helpful documentation tips to get you through the remainder of tax season:

Engagement letters. While engagement letters won’t immunize you from lawsuits, they can be your first line of defense if a client makes a claim against you. Although you likely already have executed engagement letters in place with your tax clients, for those engagements that have had some engagement creep, memorialize the additional services by updating your engagement letter or obtaining a signed addendum clarifying the revised scope and limits.
Always document significant meetings and communications. Follow up with written communications in circumstances including, but not limited to:
- Change in engagement scope (may require a new engagement letter)
- Negative information (e.g., tax return is already late, client’s failure to timely provide information, client is facing an audit)
- Judgment calls (e.g., aggressive tax positions taken by your predecessor)
- Client agreement to take significant action
- Conversations regarding transactions, extensions, or estimated tax payments
“Advise” clients of opportunities and “warn” clients about risks. Consider the need for additional documentation (e.g., client notification letters, tax representation letters, etc.) to mitigate high-risk issues such as the following:
- Recent legal and regulatory developments regarding the Beneficial Ownership Information (BOI) reporting requirements under the Corporate Transparency Act (CTA) have implications for reporting companies’ compliance obligations and FinCEN’s enforcement of the CTA reporting rules as currently promulgated. As the CTA-BOI saga continues, CAMICO strongly recommends that CPA firms continue to keep clients informed and advised as these significant developments occur.
- For clients with significant digital asset transactions, it may be prudent to have them sign a tax representation letter or a stand-alone certification letter at the conclusion of the engagement addressing cryptoasset implications. The additional defensive documentation provides evidence of the client’s understanding and acceptance of their responsibilities regarding digital asset transactions and the limitations of the services your firm provided.
Written documentation should be factual, professional, and without personal commentary or unsubstantiated opinions. Unprofessional and/or inappropriate comments can damage the integrity of documentation. Ask yourself whether your documentation would be helpful or harmful if presented at trial.

The post CAMICO Tip: Tax Engagements – Managing Client Expectations appeared first on CAMICO.

Claim Chronicles 127-B

Amber — Tue, 18 Nov 2025 16:24:49 +0000

Topic: Employee Discrimination / Termination

In September 2021, Lindsay Johnson began working as an accountant for Brown Jones & Williams CPA firm. A year later, when her mom was diagnosed with cancer, she informed the company’s Human Resources (HR) director of the diagnosis and said that she would need to take a leave of absence to care for her mom while she underwent treatment. HR approved her request; however, Johnson alleged that managing partner at the firm, Matt Williams, retaliated against her by giving her a heavier workload and refusing to communicate with her. Johnson said she was a high performer at the company and received a pay increase in October 2022 because of her work performance (the firm claimed that all employees received a raise at that time and that it wasn’t related to her performance). Two weeks later, when Johnson informed Williams that she needed time off on October 22 to attend her mother’s treatment session, Johnson claimed that Williams scheduled a meeting with her that day and made a sarcastic comment about her not being in the office when she joined the meeting remotely. A few days later, the firm involuntarily terminated Johnson’s employment, citing poor work performance that culminated in an act of dishonesty as the basis for her dismissal. Williams stated that after he discovered multiple errors in a tax return that Johnson was responsible for reviewing and submitting, she admitted that she had not reviewed it. Following her termination, Johnson filed a claim against the company with a pre-litigation demand of $980,000 for reasons that included: associational discrimination in violation of the Fair Employment and Housing Act (FEHA), FEHA retaliation, intentional infliction of emotional distress, wrongful termination of employment in violation of public policy, and failure to provide reasonable accommodation. Instead of proceeding to trial, the case was settled during mediation for $150,000.

Select the answer that is the correct response:

1. What is the biggest factor regarding the claim above?
a. The amount of time off that Johnson (the employee) requested to care for her mother during treatment.
b. Substantial documentation the CPA firm had regarding issues related to Johnson’s work performance before and after she disclosed her mother’s cancer diagnosis to the company.
c. What Williams (partner at the CPA firm) specifically said to Johnson when he made a sarcastic comment during their meeting.

2. What would have been the primary challenge for the CPA firm if the case had proceeded to trial?
a. The number of claims that Johnson was making against the company.
b. The firm’s ability to disprove Johnson’s allegations in court.
c. The amount of money Johnson was demanding along with defense costs that the firm would be required to cover.

Correct Answers:
1. b. The firm had documentation showing its frustration with Johnson’s work performance; however, the documentation came after she disclosed her mother’s cancer diagnosis. And even if the firm had earlier documentation, Johnson wasn’t terminated for poor work performance, she was primarily terminated for dishonesty, which came after she made the firm aware of the diagnosis. Given the lack of documentation of work performance issues before the cancer disclosure (Johnson also received a pay raise right before her termination), the firm would have had a hard time disposing the claim of associational discrimination under FEHA on summary judgment. This case illustrates how proper documentation and timing can significantly impact employee termination and potential litigation.

2. c. Johnson was demanding $980,000 and the CPA firm only had a $250,000 burning limits policy. If the firm chose to fight the case in litigation, most likely the company would have burned through the policy in defense costs and possibly left exposed to an adverse verdict award that the firm would not have been able to cover. Also, it was unlikely that the case would have been disposed before trial due to factual disputes about requests for leave and the proximity of termination in relation to the cancer diagnosis.

The “Claim Chronicles” are drawn from CAMICO claims files and illustrate some of the risks and pitfalls in the accounting profession. All names were changed.

The post Claim Chronicles 127-B appeared first on CAMICO.

Navigating Change, Client Expectations, and Professional Risk Under the OBBB Act

Amber — Thu, 13 Nov 2025 18:01:41 +0000

The recently enacted One Big Beautiful Bill Act (“OBBB Act”) ushers in some of the most significant tax law changes since the Tax Cuts and Jobs Act. While many provisions are designed to simplify or stimulate economic activity, they also create traps for the unwary. CPAs need to remain alert to compliance challenges, client misperceptions, and liability exposures as the IRS and state taxing authorities continue to issue implementing guidance.

As professionals who help CPA firms manage risk, we recognize that major tax legislation is a leading source of malpractice claims. The OBBB Act introduces both planning opportunities and new stress points that can easily evolve into disputes if expectations are not clearly communicated and documented. Although not meant to be all-inclusive, this article highlights several current risk areas and practical strategies for managing them through communication, documentation, and engagement-scope clarity.

Depreciation and Expensing Provisions — The Timing and Documentation Trap

The restoration of 100% bonus depreciation for property placed in service after January 19, 2025, and the increased Section 179 expensing limit to $2.5 million (with a $4 million phase-out threshold) are welcome, but the effective dates create traps for accurate application.

Determining when an asset was “acquired” — based on the binding contract date — remains one of the most frequent sources of bonus depreciation errors. This rule, unchanged under the OBBB Act, still governs when property qualifies as newly acquired for purposes of the 100% deduction. Eligibility depends on both when the asset is placed in service and when the binding purchase contract was executed. Property acquired under a contract signed before January 20, 2025, is treated as acquired under prior law and may qualify only for the reduced bonus percentages in effect at that time.

From a best-practices perspective, practitioners should obtain and retain supporting documentation — such as contracts, invoices, or purchase orders — confirming both the contract date and the placed-in-service date to avoid potential risks associated with timing errors. The IRS enforces these transitional rules strictly, and missteps can easily lead to audit adjustments and potential professional liability.

Taxpayers who benefit from increased bonus depreciation and Section 179 expensing may assume those tax benefits will continue in future years, even though these provisions are temporary. Without proactive communication, clients may be unprepared for the higher tax liabilities that will follow once the provisions sunset after 2028 and normal depreciation patterns resume. This misunderstanding can create frustration or even allegations of poor planning. CPAs should confirm in writing how clients intend to time asset purchases, emphasize that these accelerated deductions are temporary, and remind them of state conformity differences that may sharply limit the benefit. Engagement letters and planning correspondence should frame projections as estimates subject to change. Clear, written communication — supported by signed client acknowledgments — remains the best safeguard for managing expectations.

Research and Development Costs — The Retroactive Burden

The Act restores immediate expensing of domestic Section 174 R&D costs for tax years beginning after 2024 while foreign research must continue to be amortized. This makes it important to distinguish domestic from foreign research activities; misallocating these costs can result in material errors, particularly where research is spread across multiple locations or functions.

For many taxpayers, the shift back to immediate expensing of domestic R&D will require an Accounting Method Change, filed on Form 3115, along with a Section 481(a) adjustment to reconcile prior-year treatment. Errors in Form 3115 preparation are a frequent audit trigger and often lead to broader examinations. To help manage this exposure, firms should treat the preparation of Form 3115 as a separate engagement — identified in the engagement letter with its own scope, timeline, and fee structure — rather than incorporating it into standard tax return preparation.

The Act also permits taxpayers to amend prior-year returns (2022–2024) to retroactively expense domestic R&D costs. While doing so may produce refunds, it also introduces the audit-risk-of-amendment — the risk that filing the claim opens the entire return to IRS review, not only the R&D adjustment. In other words, while the refund may be justified, amending a return effectively invites the IRS to take another look at every item reported on that return. Practitioners should document discussions weighing the potential benefit of the refund against the increased examination risk. Written client acknowledgment is particularly important where the refund amount is relatively small compared to the cost and risk of an IRS examination, where prior-year documentation may be incomplete or uncertain, or where the taxpayer has other positions on the return that could draw scrutiny. In these situations, obtaining a signed acknowledgment helps ensure the client understands both the benefit and the associated exposure before choosing to proceed.

Business Interest Expense, QSBS, and Opportunity Zones

The easing of Section 163(j) limitations through EBITDA-based calculations expands deductibility, but risk remains where intercompany debt allocations, thin capitalization, or aggressive financing structures exist. CPAs should limit their role to tax compliance and planning guidance and refer clients to legal counsel or other advisors for any questions involving the terms of financing arrangements or the structure of the underlying debt.

Both Qualified Small Business Stock (QSBS) and Opportunity Zone provisions received extensions and modifications, including expanded exclusion limits. These remain complex and closely scrutinized. Practitioners should refrain from offering definitive advice until the IRS and Treasury issue regulations. Any interim planning guidance should be accompanied by written disclaimers clarifying that the advice is preliminary and subject to change.

Energy Credits — A Renewed Source of Risk

The OBBB Act modifies and consolidates several energy-related credits, including provisions affecting solar investments, electric vehicles, and energy-efficient property. As with prior legislation, these areas are frequently associated with aggressive marketing claims, promoter involvement, and inflated valuation assumptions. CPAs should not endorse or recommend specific investment programs and should document all client communications regarding energy-credit eligibility and substantiation.

When assisting clients with credit calculations or filings, engagement letters should clearly limit the firm’s role to compliance — based on client-provided documentation — and disavow responsibility for the underlying economic or legal validity of these investments.

Individual Provisions — The 2029 “Tax Cliff” and Temporary Deductions

For tax years 2025 through 2028, taxpayers may claim new temporary deductions: up to $25,000 for tips, $25,000 for overtime pay (joint filers), and $10,000 for car loan interest on new U.S.-assembled vehicles. The SALT deduction cap also increases to $40,000 through 2029.

These benefits create a significant “tax cliff” beginning in 2029, when they expire and the SALT cap reverts to $10,000. CPAs should incorporate these reversions into projections to prepare clients for higher future liabilities and avoid allegations of poor planning.

The 20% Qualified Business Income (QBI) deduction is now permanent, but eligibility — particularly for specified service trades — must still be tested carefully. Documenting the assumptions used in determining QBI eligibility is a key risk-management safeguard.

Compliance, Credits, and Penalties

The Act increases due diligence obligations across multiple credits and deductions. Some examples include:

Ongoing Employee Retention Credit (ERC) scrutiny reinforces the need for separate, detailed engagement letters and client representation letters confirming eligibility. CPAs must not assume responsibility for verifying eligibility — this distinction is central to malpractice prevention.

For self-employed clients, the Form 1099-K reporting threshold increases to $20,000 and 200 transactions. This change can heighten the potential risk of income understatement and reinforces the best practice to issue engagement letters and clarify the clients’ responsibility to provide complete and accurate information for preparation of their tax returns.

The Act also makes the Alternative Minimum Tax (AMT) exemption permanent but reintroduces phase-outs beginning in 2026 and expands Disaster Relief provisions to cover certain state-declared events. Practitioners should confirm eligibility, secure documentation, and avoid filing claims prematurely.

Practical Loss Prevention Takeaways

The OBBB Act is a complex mix of permanent, temporary, and transitional provisions. Effective risk management depends on communication, documentation, and clear scope definition.

Communicate early and often. If engaged to do so, model estimated impacts and emphasize that all projections are subject to change as guidance evolves.
Obtain written authorization. Confirm elections and timing decisions — especially for depreciation, R&D, and energy credits — in writing.
Clarify your role. CAMICO recommends that your tax engagement letters specifically detail the scope and limits of the engagement, which should define the firm’s services as limited to tax compliance and planning (if applicable).
Document thoroughly. Maintain comprehensive workpapers, including if applicable eligibility analyses, and client representation letters for all high-risk positions.
Monitor developments. Stay current on IRS and Treasury guidance. If appropriate, inform clients when prior advice may need to be revisited.

Final Word

The OBBB Act presents both opportunity and exposure. By staying proactive — communicating clearly, confirming assumptions, and documenting diligently — tax practitioners can help clients benefit from new provisions while minimizing professional risk. Large, accelerated deductions and temporary relief should be clearly communicated as timing benefits rather than permanent tax reductions. Clear communication, sound planning, and thorough documentation remain a tax practitioner’s strongest defense.

CAMICO policyholders with questions regarding this article or other risk management topics should contact the Loss Prevention department at lp@camico.com, or call our advice hotline at 1.800.652.1772 and ask to speak with a Loss Prevention Specialist.

The post Navigating Change, Client Expectations, and Professional Risk Under the OBBB Act appeared first on CAMICO.

Generative Artificial Intelligence (AI) Frequently Asked Risk Management Questions (FAQ) on CAMICO’s Advisory Hotline

Amber — Wed, 12 Nov 2025 02:22:34 +0000

This FAQ document is not intended to be used or relied upon as a substitute for a firm’s compliance with applicable professional standards nor is it intended to be a substitute for seeking legal advice. CAMICO presents this FAQ guide for reference purposes only to highlight common policyholder inquiries regarding the risk management implications of using Generative Artificial Intelligence. CAMICO policyholders are welcome to contact CAMICO with specific questions, comments, or concerns at 1.800.652.1772 or by email at lp@camico.com. Additional risk management resources are available on CAMICO’s Members-Only Site.

Section I: General Information

Q1. How is generative artificial intelligence impacting CPA firms?

A1. Artificial intelligence (AI) is transforming CPA firms, along with many other businesses, as many seek to leverage the use of generative AI to reduce repetitive tasks and similar pain points, accelerate innovation, and increase productivity. AI utilization for most CPA firms generally falls into the following two primary categories:

1. AI as a “professional tool.” For example, when AI assists professionals with tax and accounting research, audit automation, document drafting, or other analysis subject to human oversight.
2. Direct AI-to-client interaction. For example, autonomous AI tools used to communicate directly with clients — such as chatbots, automated tax and accounting guidance, or AI-driven customer service.

As the use of any AI technology is organization-specific, CPA firms need to establish a solid understanding of their unique needs and objectives and gain an understanding of how AI works before they can begin to identify what, if any, AI opportunities are appropriate for their firm.

For risk management purposes, it is important to distinguish between (1) AI used to assist professionals under their supervision, judgment, and review, and (2) AI systems that autonomously generate advice, interact directly with clients, and/or make operational decisions without human oversight. The former generally presents lower regulatory and liability exposure. The latter requires heightened controls, including monitoring mechanisms, to ensure accuracy, privacy, ethical use, and compliance with applicable laws and regulations.

Q2. With the plethora of AI tools on the market, what guidance does CAMICO have for firms beginning their AI due diligence?

A2. For those just starting out on this journey, it may be difficult to understand how AI tools work and how they have been trained. Consider engaging an IT professional to help you navigate the due diligence process. Any tool you deploy within your firm needs, at a minimum, to secure and protect confidential data. Therefore, it is imperative that a firm’s due diligence process include obtaining an understanding of the specific AI tools being considered. Some basic but important questions to consider include:

- How does the AI tool manage privacy and security (third-party with training, third-party without training, firm-controlled environment, or locally on devices)?
- How is data stored and processed?
- Do contractual terms and conditions provide for the AI tool’s compliance with applicable laws and regulations?

Q3. Is implementing an AI governance structure important for CPA firms?

A3. Yes. Establishing an AI governance framework helps to promote security, compliance, and ethical AI use while helping firms maintain operational integrity, as well as client trust. Without clear governance, firms risk exposing sensitive confidential data, making flawed decisions, or potentially escalating their risk of noncompliance with evolving regulations. The key isn’t just adopting AI — but adopting it responsibly. From CAMICO’s perspective, “responsible use” of AI for CPA firms includes implementing and maintaining protocols and procedures designed to ensure transparency, privacy, accountability, compliance, and ethical use. For example, firms should adopt clear principles and practices for responsible AI use by establishing written guidelines to clarify that these technologies must not be used to create content that is inappropriate, discriminatory, or otherwise harmful to others (clients, employees, etc.) or the firm.

Section II: Risk Management Considerations

Q4. What are some of the risk management considerations for our firm as we evaluate potential AI utilization?

A4. Generative AI is not infallible. Whether using AI for assisting with research, automating calculations, crafting emails, or explaining the tax code, be alert for its inaccuracies. Often, AI-generated information is outdated, misleading, or even fabricated (referred to as “hallucinations”). Therefore, all AI-generated outputs must be reviewed to ensure accuracy and reliability. A proper review will also help mitigate the risk of inappropriate, discriminatory, or otherwise harmful content being shared and relied upon by your firm and others.

Another source of risk is inadvertently compromising the confidentiality of data. Before using a generative AI provider, we recommend performing due diligence on the AI provider to ensure their system complies with professional standards and regulations. For tax-related engagements, firms must also ensure compliance with IRC §7216 and the associated regulations, which restrict the use or disclosure of taxpayer information to third parties (including certain AI platforms). In some cases, written taxpayer consent may be required before transmitting data to external systems.

When conducting your due diligence, firms should research the AI provider’s reputation and confirm whether provider has a history of training its models on unauthorized data. Firms should also review the provider’s terms of use to understand how data and output are handled. Some vendors may reserve rights to access, store, reuse, or further train models on firm-generated content unless explicitly restricted. Contract terms should clearly state that the firm maintains ownership of its work product and client-related materials, that the provider will not use the firm’s data to train or improve models unless expressly authorized, and that confidentiality and data-protection obligations apply.

Q5. What should our firm do to mitigate potential risks as we move forward with AI adoption?

A5. As you explore the opportunities afforded by generative AI, it is imperative to understand its overall risks and countervailing safeguards to develop an appropriate comprehensive AI governance framework (see Question 3 in Section I above) for your firm. In addition, successful integration of generative AI tools requires a well-crafted implementation plan, including specific firm education and training to ensure responsible use. Firms should document that employees receive training regarding responsible use, confidentiality safeguards, verification of accuracy, and escalation procedures for any questionable AI-generated output.

Important aspects of maintaining confidentiality are ensuring data privacy and mitigating security risks. Firms should encrypt data as appropriate, implement access controls, and adhere to applicable data protection regulations. It may be necessary to consult with qualified legal counsel and update the firm’s Privacy Policy to ensure transparency about the categories of sensitive information collected; the sources of that information; the purposes for its collection; and how the firm stores, secures, and shares such information.

CAMICO also believes that a clear and concise generative AI policy to document your firm’s authorized usage is paramount in establishing responsible use of AI. Please see CAMICO’s generative AI policy template available on CAMICO’s Members-Only Site. As this will be unique to your firm, we recommend working with your firm’s legal counsel and IT specialists, as appropriate, as you develop, tailor, and implement your generative AI strategy and related usage policy.

Q6. Should I inform clients and update my existing engagement letter if my firm is using AI?

A6. Not all AI applications require client disclosure under legal and regulatory guidance as currently promulgated. At this time, the key distinction lies in whether AI is directly interacting with clients or merely a tool assisting professionals with their work. As AI tools become more sophisticated, firms will need to consider when and how to disclose their use of AI to clients.

As laws evolve, AI disclosure may become more important as regulatory bodies increase oversight. Current laws, including the European Union’s (“EU”) General Data Protection Regulation (GDPR), require businesses to inform individuals when AI tools make automated decisions that significantly impact them. The Federal Trade Commission (FTC) has issued warnings about AI transparency, emphasizing that companies must avoid misleading consumers and, therefore, should disclose AI use. Some states, including California, have passed AI transparency laws that specifically require businesses to disclose when customers are engaging with AI rather than humans.

Even if not required, transparency is considered best practice, as it provides an opportunity to reassure your clients of your responsible AI use, and that you are taking reasonable measures to safeguard their data and privacy. Refer to CAMICO’s illustrative engagement letter language below, which should be tailored as appropriate to address your firm’s specific utilization of AI:

Our firm may use generative artificial intelligence (“AI”) tools to improve efficiencies in areas such as tax and accounting research, document drafting, or other analysis to assist us with rendering services to you under the terms of this agreement. We have policies and procedures in place to ensure that any AI-generated content is subject to our firm’s strict quality control guidelines which include protocols for applying professional expertise, judgment, and oversight in the review and interpretation of any AI-generated content. In addition, we maintain reasonable safeguards to ensure responsible use of AI which includes strict adherence to the requirements set forth for confidentiality, privacy, security, and ethical use of AI in accordance with applicable laws and our professional standards.

Q7. If we use an AI tool to automate processes in Human Resources, what should we be considering?

A7. Employers must tread carefully when considering implementing AI in areas such as recruiting, performance management, or compensation. While AI tools promise efficiency and cost savings, they also create new risks, including the potential for discrimination claims. When evaluating potential AI tools, the key is to balance efficiency with compliance to ensure that such AI technology doesn’t undermine fairness or expose the firm to avoidable lawsuits.

For example, one of the biggest legal risks associated with using AI in the recruitment process is the concept of “disparate impact,” a policy or practice that appears neutral on its face but results in disadvantaging a protected group. The Equal Employment Opportunity Commission (EEOC) has already issued guidance warning that automated decision-making tools fall under the same anti-discrimination laws as traditional practices. Employers should be aware that claims may be brought not only by rejected applicants, but also by government agencies seeking to enforce civil rights laws. This type of risk underscores the need for firms to do their due diligence on AI tools and conduct bias audits before relying on AI algorithms when making employment decisions.

As many states are starting to regulate how employers may use AI in HR practices, with many of these new laws reflecting a trend towards transparency and informed consent, it is imperative that firms are current with federal and state AI-related employment laws. Other proactive, risk-mitigating controls for AI use in HR workflows include:

- Conducting regular bias audits of AI tools
- Requiring human review of AI-generated outputs
- Maintaining transparency with employees and applicants regarding AI use

Q8. What other risk management best practices should I consider?

A8. CAMICO encourages the following additional best practices:

- Get educated, as AI is here to stay. Learn more about the generative AI tools that are available and take appropriate due diligence steps to assess which, if any, of these tools may be appropriate to utilize in your firm.
- Develop an implementation strategy. Successful integration of generative AI, or any new technological solution, requires a well-crafted implementation plan, including firm-specific education and training regarding responsible use.
- Engage experts (IT professionals, legal counsel, etc.) as needed. Consider consulting with an attorney if you have questions regarding compliance with laws and regulations applicable to your firm. IT professionals may also be needed to appropriately address security measures and safeguards for the transmission of confidential client information.
- Educate employees. Document your firm’s authorized usage (e.g., open use, limited use, or prohibited use) of generative AI and specific AI tools and communicate these terms and conditions to your staff. CAMICO offers a sample Generative Artificial Intelligence Chatbot Usage Policy template for this purpose on CAMICO’s Members-Only Site.
- Stay informed. CPA firms need to stay informed about evolving AI regulations, as new laws continue to emerge at both state and federal levels in the U.S., in addition to stricter transparency requirements under the European Union (EU) AI Act. By proactively adapting to regulatory changes, businesses can more responsibly mitigate legal risks while leveraging AI’s benefits.

Section 3: Additional Resources

Q9. Where can I find additional information regarding AI?

A9. Refer to the following resources:

- Artificial Intelligence | AICPA & CIMA
- Artificial Intelligence | CPA.com

Policyholders with questions should contact the Loss Prevention department by email at lp@camico.com or call 1.800.652.1772 and ask to speak with a Loss Prevention Specialist. Additional risk management resources are available on CAMICO’s Members-Only Site.

The post Generative Artificial Intelligence (AI) Frequently Asked Risk Management Questions (FAQ) on CAMICO’s Advisory Hotline appeared first on CAMICO.