Enjoy our library of free downloadable content includes white papers, webinars, product guides, case studies, industry analysis and much more, provided by experts and vendors within the accounting profession. 

Membership

CPE & Events

Advocacy

What's Happening

Become a CPA

Header

 update your Membership Auto-Renewal payment method

Your go-to source for expert insights, industry updates, and exclusive CalCPA content. Stay ahead with practical guidance, pro tips, and must-know trends—all designed to fuel your success.

Stay ahead with essential CPA resources

Trust Fund Recovery Penalty: What to Know

Think unpaid payroll taxes are just the company's problem? The IRS may disagree. Multiple officers, owners and employees can all be hit with the same penalty.

Staying Independent While Consulting: Part 1

Consulting for an attest client seems harmless—until it isn't. Part 1 of this two-part series breaks down the AICPA's conceptual framework for independence and what it means before you accept your next consulting engagement.

Staying Independent While Consulting: Part 2

Consulting for an attest client seems harmless—until it isn't. In Part 2 of this two-part series, learn about safeguards for reducing threats to independence, exceptions and applying the AICPA independence framework to consulting services. 

Accounting is Awesome

2026-27 CalCPA Chair Miklos Ringbauer’s passion for the profession is clear and runs deep. And now he's looking to inspire the next generation by changing how people see the profession.

2026 CalCPA Chair

Golden State wisdom straight from the experts

Professional Interest Areas

Accounting & Finance

Audit & Assurance

Business & Firm Management

Business & Industry

Client Advisory Services (CAS)

Estate & Trust Planning

Forensic Services

Government

International

Not-for-Profit

Personal Financial Planning

Professional Development

Technology

Morning coffee and curated news?  Get the top headlines and information to keep you ahead in the business world..

Daily Clips newsletter

Rise & Stride Podcast

brainfood bytes

Listen and watch...

Looking for an old article or a past issue from California CPA magazine? You're in the right spot!

Past articles and archives

CPAs: Making Sense of What Comes Next campaign

Artificial intelligence in auditing sits within a uniquely complex regulatory space. While AI tools are widely deployed, they remain largely governed by existing legacy standards. However, the profession is experiencing the most significant reforms. This two-part article serves as a practical guide to help CPAs involved in external audits of public or private companies navigate the latest available guidance regarding AI in the audit process. 

 covers the PCAOB and AICPA landscape regarding AI standards and guidance; here in Part 2, we dive into AI risk areas in audits and professional liability implications.

Deploying AI in an audit environment introduces operational and behavioral risks that traditional legacy software never faced. Practitioners must actively manage five core risk areas:

Undisclosed AI Reliance and Workpaper Gaps: 

If an auditor relies substantially on an AI tool without documenting that reliance, the auditor faces dual exposure: an evidentiary gap under AU-C 230/AS 1215, and a potential argument in litigation that professional judgment was abandoned. AI-related securities litigation is rising: NERA’s 2025 Annual Review found 17 securities class action filings with AI-related claims in 2025 (8 percent of all new filings), and Stanford’s Securities Class Action Clearinghouse reported 12 AI-related filings in H1 2025 alone, which is on pace to exceed the 2024 total of 15. Most allege ‘AI washing’ (misrepresenting AI capabilities), but auditor liability theories based on inadequate evaluation of AI-generated evidence are an emerging risk in this litigation environment.

: When an AI tool produces incorrect output and the auditor relies on it without independent verification, the auditor—not the vendor—bears professional responsibility. Vendor contracts universally disclaim liability for AI outputs used in professional services. This principle is now codified: the AS 1105 amendments require auditors to evaluate the reliability of technology-assisted outputs before treating them as audit evidence. The “I relied on the software” defense has been consistently rejected.

: The SEC Division of Examinations named AI a cross-cutting priority for the third consecutive year in its FY 2026 guidelines. Regulators are actively reviewing whether firms’ actual practices match their public AI disclosures, supervisory frameworks and security controls. Public company auditors must apply strict materiality standards to ensure client AI claims in annual reports are accurate and fully supported.

AICPA Code of Professional Conduct Sec. 1.700.001

 prohibits disclosure of client information without consent. Uploading client data to third-party AI platforms without client consent and appropriate data processing agreements may violate this obligation. Under the CCPA/CPRA, processing personal information via AI workflows can trigger strict data subject rights and processing limitations. California practitioners must exhaustively review vendor data-handling agreements against both AICPA and state privacy standards before letting any client data touch an AI workflow.

Managing AI risk within a CPA practice requires distinguishing between two separate operational environments: how the firm governs its own internal use of technology and how the firm designs procedures to audit clients who use AI in their financial reporting systems.

Firms must first establish clear internal protocols before deploying AI tools on live engagements. This begins with maintaining an updated inventory of all firm-used AI applications, classifying each by function and level of reliance to ensure workflows remain transparent for peer reviews.

Additionally, firms need a defined vetting process for both legacy software updates and new tools. This process must evaluate vendor data security, model limitations and compliance with confidentiality standards before ingesting client data. Once vetted, clear firm-wide policies must dictate exactly where these tools are permitted or restricted. Finally, continuous staff training is required to counter automation bias, paired with a structured internal process for teams to exchange practical deployment practices and documentation standards.  

The second layer focuses outward on how a client’s technology impacts their financial records. When a client implements AI within its accounting functions, the auditor's risk assessment must expand to evaluate those specific applications.

If a client relies on algorithms to generate estimates, automate journal entries or classify transactions, these systems directly affect the reliability of the information produced by the entity. The audit team may need to test the internal controls surrounding the client’s automated environment. The objective is to verify that client-generated AI data is accurate, complete and free of systemic error before it integrates into the general ledger.

The regulatory landscape indicates that the integration of AI into the audit workflow has transitioned from a theoretical concept into active practical application. At this stage, standard-setters are primarily leveraging modernized, existing baselines, such as the active AS 1105 amendments for public issuers and the core technology-validation requirements of AU-C Section 500 for private companies, to reinforce that final professional responsibility for the audit opinion remains strictly with the practitioner.

However, this framework represents only the starting point of a long-term, fluid transition. Because new software applications and automated tools are entering the market at a rapid pace, the regulatory guidelines and interpretations governing them are actively changing and will be subject to continuous modification in the future.

For practitioners, navigating this shift requires moving away from static compliance checklists in favor of continuous monitoring. To maintain a defensible audit methodology as technology matures, auditors must stay closely aligned with updates from primary authoritative channels and remain prepared to adapt their internal review procedures as official guidance evolves.

The opinions expressed are those of the author and should be taken as informational purposes only.  

AI Standard Setting, Regulation in Audit: Part 2

While AI tools are widely deployed in auditing, they remain largely governed by existing legacy standards. In Part 2 of this two-part series, dive into AI risk areas in audits and professional liability implications.

Artificial intelligence in auditing sits within a uniquely complex regulatory space. While AI tools are widely deployed, they remain largely governed by existing legacy standards. However, the profession is experiencing the most significant reforms. This two-part article serves as a practical guide to help CPAs involved in external audits of public or private companies navigate the latest available guidance regarding AI in the audit process. Part 1 covers the PCAOB and AICPA landscape regarding AI standards and guidance, while 

dives into AI risk areas in audits and professional liability implications.

Following the appointment of Chairman Demetrios (Jim) Logothetis in early 2026, the PCAOB issued a 

 (RFC No. 2026-001)  to shape its 2026–30 strategic plan. A central focus of this reset is gathering stakeholder input on how to update auditing standards to reflect the rise of AI in financial reporting. The Office of the Chief Auditor is also establishing a formal consultation process to handle novel AI-related auditing questions. 

Amendments targeting technology-assisted analysis of electronic information are now fully effective for calendar-year 2026 audits:

The PCAOB explicitly noted that these amendments target general technology-assisted analysis, not AI-specific applications or firm-level AI governance. Because a formal safe harbor does not exist, firms operate on the assumption that legacy standards permit AI use, provided proper validation is in place.

Staff Spotlight: Where GenAI Stands in Practice

,  generative AI deployment in public audits remains concentrated in administrative and research tasks, such as drafting memos, summarizing accounting policies and researching internal guidance. While full deployment in substantive testing is nascent, audit firms largely believe existing standards aren’t an impediment to adoption. However, the PCAOB has not formally confirmed this interpretation, meaning firms are proceeding on an assumption rather than a guaranteed safe harbor. To help bridge the gap, the PCAOB issued follow-up 

evaluating electronic information reliability under AS 1105

The Technology Innovation Alliance (TIA) Working Group’s ‘Future State Deliverable’ recommended four strategic pillars: 

While none of these are binding standards yet, major firms heavily emphasized the need for action in their responses to the PCAOB's March 2026 strategic request. Stakeholders are actively calling for clear, principle-based guidance on emerging tech to reduce compliance uncertainty, making AI and private equity the top two themes in recent submissions.

Inspection Findings: The Documentation Gap

Recent PCAOB inspection reports contain AI-related deficiencies concentrated in journal-entry testing: firms using AI-assisted anomaly detection without documenting how the algorithm was calibrated, what data it used, or how false-positive results were evaluated. Under AS 1105, this is a standard deficiency regardless of whether the AI output was ultimately correct. A PCAOB Board member publicly warned of a second risk: that inspectors might demand firms “turn over every rock” on AI model documentation, potentially making AI-assisted procedures costlier to defend than manual sampling—the opposite of the intended benefit.

Other PCAOB guidance to be aware of includes 

AS 2110—Identifying and Assessing Risks of Material Misstatement

PCAOB Release No. 2024-007—Adopting Release for AS 1105/AS 2301 Amendments

PCAOB Data and Technology Research Project

AICPA: Non-Issuer and Private Company Guidance

While major technology shifts can feel decentralized, the AICPA has established explicit guardrails for integrating AI into private company audits. Firms must evaluate their AI adoption through two distinct, but interconnected, prisms: tactical execution on the engagement level and macro-level firm governance.

AI and Technology Execution at the Engagement Level

Rather than waiting for a standalone AI auditing standard, practitioners must evaluate AI tools through the lens of existing authoritative literature. In practice, the AICPA’s collective standards and framework resources from the AICPA & CIMA AI Resource Center dictate six core areas for the engagement team: 

Continuous Monitoring of Authoritative Guidance

Because authoritative auditing standards and regulatory interpretations are dynamically evolving to keep pace with technology, practitioners cannot treat AI risk management as a static exercise. To maintain a defensible audit methodology, the key is knowing where to find the most current updates. Firms should continuously monitor changing compliance baselines through centralized primary repositories, specifically the AICPA & CIMA AI Resource Center. 

To maintain an up-to-date and defensible audit methodology, firms should routinely consult centralized, primary authoritative repositories, specifically the 

 and the technical implementation updates managed by CPA.com. 

Dive into Part 2, which covers AI risk areas in audits and professional liability implications.

The opinions expressed are those of the author and should be taken as informational purposes only. 

AI Standard Setting, Regulation in Audit: Part 1

While AI tools are widely deployed in auditing, they remain largely governed by existing legacy standards. In Part 1 of this two-part series, learn about the PCAOB and AICPA landscape regarding AI standards and guidance to help CPAs involved in external audits of public or private companies.

When a business falls behind on payroll tax deposits, owners, managers and employees often assume the IRS problem belongs only to the company. That assumption can be financially devastating. 

If the business failed to pay trust fund taxes, the IRS may pursue the Trust Fund Recovery Penalty against individuals it believes were responsible for collecting, accounting for and paying over those taxes, but willfully failed to do so. Once assessed, the IRS can collect the TFRP from owners, managers and employees’ personal assets and income, not merely from the business’s property or income.

Form 4180, Report of Interview with Individual Relative to Trust Fund Recovery Penalty

, is one of the most important documents in that process. It is not a casual interview outline. It is the government’s roadmap for determining who had authority, who knew the payroll taxes were unpaid, who signed checks, who directed payments, who dealt with payroll providers, who controlled bank accounts, who decided which creditors got paid and who had the practical ability to ensure that the IRS received the withheld taxes.

 explains the basic standard. The penalty may be assessed against a person who was responsible for collecting or paying withheld income and employment taxes, or collected excise taxes, and who willfully failed to collect or pay them. A responsible person is someone with the duty to perform and the power to direct the collecting, accounting and paying of trust fund taxes. Willfulness can exist where the person was, or should have been, aware of the unpaid taxes and intentionally disregarded the law or was plainly indifferent to its requirements. No evil motive is required. The most common fertile ground for assessing the penalty is that an individual chose to pay other creditors rather than the IRS. 

For a business owner, CFO, controller, payroll manager, director, shareholder, partner, bookkeeper or investor with signature authority, the Form 4180 interview can decide whether the IRS views the person as a witness, a marginal actor or a primary TFRP target.

Multiple People Can Be Responsible for the Same Payroll Tax Debt

A common mistake is believing that the IRS must choose one responsible person. It does not. The TFRP can be proposed against more than one individual for the same trust fund tax periods. The IRS may look at owners, officers, employees, partners, directors, shareholders, nonprofit board members, third-party payers, payroll service providers, professional employer organizations and responsible parties within those organizations or within the common-law employer.

This makes multi-person payroll cases especially dangerous. One officer may insist that another officer handled payroll. A bookkeeper may say she only followed orders. A minority owner may say he lacked day-to-day control. A spouse may say he or she was only added to the bank account for convenience. A CFO may blame the CEO’s cash-flow decisions. The IRS will not stop at titles. It will ask who had actual authority and independent judgment over the company’s financial affairs. It will focus on who chose which creditors got paid. 

The IRS specifically recognizes that responsibility turns on whether the individual exercised independent judgment with respect to the business’s financial affairs. An employee is not a responsible person merely because the employee paid bills as directed by a superior, rather than deciding which creditors would or would not be paid. But once a person had authority to direct funds, decide payment priorities, sign checks, initiate electronic payments, approve payroll, control deposits or influence whether the IRS got paid, the risk changes dramatically.

Multiple responsible-person cases also create conflicts. Statements made by one executive can implicate another. A payroll provider’s records can contradict internal explanations. Bank records may show that vendors, landlords, lenders, or net payroll were paid while payroll deposits were missed. A person trying to shift blame without a careful defense strategy can create admissions that support both responsibility and willfulness.

What the IRS Is Really Testing During a Form 4180 Interview

The Form 4180 interview usually tests two core issues: responsibility and willfulness. Responsibility focuses on power and duty. Willfulness focuses on knowledge and conduct after knowledge.

On responsibility, the IRS will want to know who controlled bank accounts, signed checks, had online banking authority, prepared or signed payroll tax returns, authorized payroll, decided which creditors to pay, hired or fired employees, managed payroll providers, had ownership or officer status, handled tax notices, and communicated with the IRS. No single factor controls. The government looks at the whole financial-control picture.

On willfulness, the interview becomes even more dangerous. 

The IRS says using available funds to pay other creditors when the business cannot pay employment taxes indicates willfulness. In practical terms, that means the most damaging facts often involve payment choices after the responsible person knew payroll taxes were unpaid. Paying rent, vendors, lenders, suppliers, owners, or net wages while ignoring payroll deposits can support the IRS’s theory that the person knowingly preferred other creditors over the government.

The interview can also affect criminal tax exposure. The TFRP itself is a civil penalty, but payroll tax cases involving repeated nonpayment, false Forms 941, hidden cash payroll, payroll pyramiding, misleading IRS statements or diversion of trust fund taxes can escalate. IRS collection guidance warns that the government may refer employment tax matters to the Department of Justice for civil collection or criminal prosecution where reporting and payment requirements were not followed. A careless Form 4180 interview can therefore do more than create personal collection exposure. It can give the government signed or documented admissions that shape a broader civil and criminal tax investigation.

Letter 1153, Form 2751, and the Short Window to Fight the TFRP

If the IRS decides to propose the TFRP, it generally sends Letter 1153 and Form 2751, Proposed Assessment of Trust Fund Recovery Penalty. This is the point where many taxpayers make another costly mistake. They delay, sign without understanding the consequences, or respond informally while the appeal period runs.

IRS guidance states that a person generally has 60 days from the date of Letter 1153 to appeal the proposed assessment, or 75 days if the letter is addressed to a person outside the United States. If the person does not respond, the IRS may assess the penalty and send notice and demand for payment. Once the IRS assesses the TFRP, it can pursue the person’s personal assets, including filing a federal tax lien, or taking levy or seizure action. It commonly levies against a responsible party’s sources of income like W2 wages directly. 

The amount of the TFRP equals the unpaid trust fund taxes. For employment tax cases, that means the unpaid federal income taxes withheld from employees plus the employee share of FICA taxes. It does not generally include the employer’s matching FICA share or FUTA, although the business may still owe those amounts separately.

A person assessed with the TFRP may have statutory contribution rights against other responsible persons who paid less than their proportionate share, but that is a separate proceeding and does not prevent the IRS from pursuing collection. Therefore, the best time to contest responsibility, willfulness, payment credits, period calculations and factual errors is before assessment, not after personal collection begins.

CPAs frequently provide consulting or other nonattest services to clients for whom they also perform attest services. These engagements can add significant value, but they also require careful attention to independence. Under the AICPA Code of Professional Conduct, a CPA in public practice must be independent when the CPA or firm performs attest services such as audits, reviews and agreed-upon procedures.

Consulting engagements for attest clients are not evaluated in isolation. The Code recognizes that nonattest services may create threats to independence—particularly self-review, management participation and advocacy threats—and that independence may be impaired unless those threats are reduced to an acceptable level and the applicable nonattest service requirements are met. 

Because not every relationship or circumstance can be specifically listed in the Code, CPAs should apply the conceptual framework for independence when a specific interpretation does not directly address the situation.

Part 1 of this two-part series looks at the independence rule and categories of independence threats; 

 discusses safeguards for reducing those threats, exceptions and applying the independence framework to consulting services.

The Independence Rule provides the foundation: a member in public practice must be independent when performing attest services. For a CPA serving an attest client, this means that consulting and other nonattest services must be assessed for their effect on independence whenever independence is required for the attest engagement.

The Independence Rule is not limited to actual impairments of objectivity. The Code also focuses on whether independence would be perceived as impaired by a reasonable and informed third party who is aware of the relevant information. As a result, a firm’s analysis should address both actual threats and appearance-based threats.

Handling Situations Not Addressed in the Code

The conceptual framework applies when there is no independence interpretation that specifically addresses a particular relationship or circumstance. In that situation, the CPA should evaluate whether the relationship or circumstance would lead a reasonable and informed third party, aware of the relevant information, to conclude that there is a threat to the CPA’s independence that is not at an acceptable level.

A threat is at an acceptable level when, because of the type of threat and its potential effect or because safeguards have eliminated or reduced the threat, a reasonable and informed third party would perceive that the member’s professional judgment is not compromised. However, the Code describes some situations where it’s impossible to eliminate or reduce the threat to an acceptable level.

The Code identifies seven broad categories of threats to compliance with the Independence Rule, and these categories are especially useful when evaluating consulting engagements because consulting services may create more than one threat at the same time.

: The CPA will not act with objectivity because the CPA’s interests are opposed to the interests of an attest client (such as, when the client or the firm commences litigation against the other or expresses an intent to do so).

: The CPA will promote an attest client’s interests or position to the point that independence is compromised (such as, promoting an attest client’s securities as part of an initial public offering, providing expert witness services to an attest client, or representing an attest client in U.S. Tax Court or another public forum).

: When there’s a long or close relationship with an attest client, the CPA will become too sympathetic to the client’s interests or too accepting of the client’s work or product (such as, an attest engagement team member having an immediate family member or close relative in a key client position, a partner serving on the attest engagement team for a prolonged period, or another professional at the firm recently serving as a director or officer of the attest client).

: The CPA will take on the role of attest client management or otherwise assume management responsibilities for an attest client (such as, serving in a key position as an officer or director of the attest client, accepting responsibility for designing, implementing, or maintaining internal controls, or hiring, supervising, or terminating client employees).

: The CPA could benefit, financially or otherwise, from an interest in or relationship with an attest client or persons associated with the attest client (such as, a direct financial interest or material indirect financial interest in the attest client, certain loans from the client or related persons, excessive reliance on fees from attest and nonattest services from a single attest client, or a material joint venture or other material joint business arrangement with the attest client).

: The CPA will not appropriately evaluate the results of a previous judgment made, or service performed or supervised by the CPA or another individual in the firm, and that the CPA will rely on that service in forming a judgment as part of an attest engagement.

: The CPA will subordinate professional judgment to an individual associated with a client or a relevant third party because of that individual’s reputation, expertise, aggressive or dominant personality, or attempts to coerce or exercise excessive influence over the member (such as, management threatening to replace the CPA or firm over a disagreement on accounting principles, management pressuring the CPA to reduce necessary audit procedures to reduce fees, the CPA receiving a gift from the attest client or related parties, or a large proportion of fees charged to a client being generated by nonattest services).

Continue reading Part 2, which discusses safeguards for reducing those threats, exceptions and applying the independence framework to consulting services.

CPAs frequently provide consulting or other nonattest services to clients for whom they also perform attest services. These engagements can add significant value, but they also require careful attention to independence. Under the AICPA Code of Professional Conduct, a CPA in public practice must be independent when the CPA or firm performs attest services, such as audits, reviews and agreed-upon procedures.

In Part 2 of this two-part series, learn about safeguards for reducing threats to independence, exceptions and applying the independence framework to consulting services. 

, which looks at the independence rule and categories of independence threats.

Safeguards: Reducing Threats to an Acceptable Level

Safeguards may partially or completely eliminate a threat or diminish its potential influence. To be effective, safeguards should eliminate the threat or reduce it to an acceptable level. The Code identifies three broad categories of safeguards:

The effectiveness of a safeguard depends on the specific facts and circumstances, proper identification of threats, whether the safeguard is suitably designed, who is subject to it, how it is applied, the consistency of application, who applies it, how it interacts with other safeguards, and whether the client is a public interest entity.

When a CPA applies safeguards to eliminate or reduce significant threats to an acceptable level, they should document the identified threats and safeguards applied. The failure to prepare the required documentation would be considered a violation of the Code.

Applying the Framework to Consulting Services

When a member performs consulting services for an attest client, self-review, management participation or advocacy threats may exist. If significant independence threats exist during the engagement or the period covered by the attest report, independence will be impaired unless those threats are reduced to an acceptable level and any requirements included in the nonattest-services interpretations have been met.

In practical terms, before accepting a consulting engagement for an attest client, the CPA should evaluate questions such as:

Considering the Cumulative Effect of Multiple Consulting and Nonattest Services

The independence analysis should not stop with each consulting or nonattest service considered separately. In fact, the Code requires the firm to consider the aggregate effect before agreeing to perform the services. Before agreeing to perform nonattest services, the CPA should evaluate whether multiple consulting and nonattest services performed by the CPA or the firm, in the aggregate, create a significant threat to independence that cannot be reduced to an acceptable level by safeguards.

This cumulative-effect analysis is important because several consulting and nonattest services that appear manageable individually may, in aggregate, create a more significant threat. For example, multiple consulting services may increase the risk of self-review, create greater familiarity with management’s processes, or increase the proportion of fees generated from nonattest services. 

The Code provides a limited circumstance in which independence would not be impaired even if the firm performed nonattest services that would otherwise have impaired independence during the period covered by the financial statements. This exception applies only if all of the following conditions exist:

Because all three conditions must exist, the exception should be applied carefully. If the consulting services occurred during the professional engagement period or related to the period covered by the financial statements, the exception may not be available under the excerpted guidance.

Independence in consulting engagements requires more than concluding that a service won’t impact the attest service. When a firm provides consulting or other nonattest services to an attest client, it should evaluate whether the service creates threats to independence; determine whether those threats are significant; apply effective safeguards when available; consider the cumulative effect of multiple nonattest services; and document the threats and safeguards when safeguards are used to address significant threats.

The central question is whether a reasonable and informed third party, aware of the relevant information, would perceive that the CPA’s professional judgment is not compromised. If the answer is “yes” because threats are not significant or because effective safeguards reduce them to an acceptable level, then the CPA may conclude that independence is maintained under the Code. Otherwise, the CPA’s independence is impaired and the consulting or nonattest service should not be performed.