CPA firms have many agencies, organizations, and standards they must be in compliance with: state boards of accountancy, the PCAOB, the IRS, the AICPA Code of Professional Conduct, and the AICPA Statements on Auditing Standards are just a few that come to mind.
While managing partners and shareholders ultimately bear responsibility for the firm’s compliance, ownership of the day-to-day work is often less clear. Does it all sit with the General Counsel? Operations? HR? Firm administrations? Individual staff?
One of the greatest risks to effective compliance isn’t that no one is responsible. It’s that everyone is responsible.
In many firms, compliance responsibilities have evolved organically over time. Human Resources may oversee employee onboarding and individual professional licenses. Firm administrators may coordinate firm registrations, insurance, and operational policies. Practice leaders monitor engagement quality. IT manages cybersecurity requirements. Finance oversees tax filings and payroll obligations. General counsel or outside advisors may become involved only when a problem arises.
Each department may be doing an excellent job within its own area, yet critical information can still fall through the cracks because no one is responsible for connecting the dots.
Consider a common scenario: An experienced CPA relocates from Illinois to North Carolina while continuing to serve clients in multiple states. Human Resources updates the employee’s address for payroll and benefits. But was the firm’s compliance function notified? Does the engagement scheduler know the CPA’s principal place of business has changed? Has anyone evaluated whether the CPA’s mobility status or individual license requirements have changed? Does the firm need to update any firm registrations or attest signer records?
In many firms, each of these questions is owned by a different person – or, in the case of mobility and licensure requirements, often by no one at all.
The result may not be intentional noncompliance, but it is a governance gap. Individually, each department completed its assigned task. Collectively, however, the firm may have created compliance risk because critical information was never communicated across functional areas.
Strong compliance governance recognizes that compliance is rarely the responsibility of a single department. Instead, it is a cross-functional business process that depends on clear ownership, defined workflows, and timely communication among the people responsible for carrying them out.
For firm leaders and administrators, this presents an opportunity to strengthen governance. At the same time, though, they must also be careful not to create unnecessary bureaucracy. To achieve that fine balance, here are a few practical steps:
Designate a compliance owner. Larger firms may have an entire team responsible for this function. In smaller firms, however, it is important that there is a clear owner. This individual does not need to perform every compliance task but should be responsible for maintaining visibility across the firm’s various compliance functions, coordinating communication, and ensuring nothing falls through the cracks.
Document cross-functional workflows. Identify events that should trigger compliance reviews, such as hiring, employee departures, promotions, address changes, new office locations, mergers, or expanding into new states. For each such event, clearly define who must be notified and what actions should occur.
Create regular compliance touchpoints. Schedule periodic meetings between Human Resources, Operations, firm administration, scheduling, and other relevant stakeholders to review upcoming changes, staffing updates, and regulatory obligations before they become problems.
Maintain a centralized view of compliance information. Whether through technology or well-managed internal processes, firms should avoid storing critical compliance information in disconnected spreadsheets or individual email inboxes. Decision-makers need a reliable source of truth.
Treat compliance as an enterprise risk, not simply an administrative task. Firms routinely discuss financial, cybersecurity, and operational risks at the leadership level. Compliance deserves the same attention, since failures can affect regulatory standing, firm reputation, client service, and the firm’s ability to grow.
Key takeaways
- Name a compliance owner.
- Map trigger events to workflows.
- Hold regular cross-functional check-ins.
- Keep one source of truth.
- Treat compliance as enterprise risk.
Ultimately, effective compliance governance is strengthened by systems that allow people to work together effectively. As firms become increasingly multi-state, embrace remote work, and navigate an ever-changing regulatory environment, the firms that succeed will be those that move beyond asking, “Who owns compliance?” and instead ask, “How do we ensure everyone responsible for compliance is working from the same playbook?”
