Skip Ribbon Commands
Skip to main content

​Best-in-class personal and business insurance solutions customized for CPAs, their families and firms.

Education Center

Third Party Verification Letters

Professional Liability, Practice Management, Other


Increasingly, CPAs are receiving requests from clients, lenders, loan brokers, health insurance providers, adoption agencies, regulators and various other agencies to confirm client information.  The requested information may relate to a pending loan, employee medical insurance, child adoption applications or use-tax certification.  Mortgages originated by private mortgage companies, which were resold to Fannie Mae and Freddie Mac and past due, are subject to required quality reviews. Quality review standards may require the mortgage originator to contact CPAs whose comfort letters are contained within the loan file to confirm the statements made in such letters.  In most cases, CPAs are asked to provide a confirmation letter containing specific language, a verification statement, a comfort letter, or a certification form (collectively “Verification Documents”). 


By providing such Verification Documents, a CPA may unintentionally violate professional standards.  The CPA also may confront the risk of a malpractice claim in the event that a third party detrimentally relies on an alleged inaccurate statement made in a Verification Document. 


This article will discuss the types of requests for Verification Documents that may be received by a CPA and how the CPA can respond to such requests, manage any associated risks, and comply with professional standards. 


Requests from Lenders


The most common type of request for a Verification Document is associated with mortgage loan applications of self-employed tax return preparation clients.

Examples of information requested by lenders and loan brokers include:

  • Confirmation of a client’s self-employment status;
  • Verification of income from self-employment;
  • Verification of a self-employed borrower’s business ownership percentage;
  • Profitability or sustainability of a self-employed client’s business; and
  • The impact on a self-employed client’s business if money is withdrawn to fund the down payment on a real estate purchase.

A self-employed borrower often uses business assets from a sole proprietorship, partnership or corporation to fund a down payment and closing costs for a home mortgage.  Lenders or brokers are required to assess the borrower’s creditworthiness and verify the accuracy of information provided by the borrower. Nevertheless, in the case of a self-employed borrower, the means to obtain available financial information may be limited.  By obtaining a comfort letter from a CPA, lenders or brokers may attempt to shift the responsibility for confirming the accuracy of the information — and possibly the risk of non-repayment of the loan — to the self-employed borrower’s CPA.  If the self-employed borrower later defaults on the loan, the lender may raise the comfort letter received from the CPA, prior to funding the loan. The lender may then take the position that the representations made in the letter were a substantial factor in its decision to extend credit.


As a result, the lender may be in a better position to recover loan losses by suing the CPA, alleging that it detrimentally relied on the negligent misrepresentation(s) made in the comfort letter.  The comfort letter also may be used to establish the lender’s legal standing to sue the CPA where such standing may not otherwise exist.


Such mortgages often are resold to Freddie Mac, which is a secondary market for residential mortgages.   Historically, Freddie Mac’s Single Family Seller/Servicer Guide (the Guide) provided secondary market sellers with two methods for analyzing whether the withdrawal of business funds would negatively affect the ability of the business to continue operations.  One of the methods described in the Guide was to obtain a comfort letter from an accountant stating, “[T]he Borrower has access to the funds and the withdrawal of the funds for the down payment and closing costs will not have a detrimental effect on the business.”  The Single Family Selling Guide published by Fannie Mae, another secondary market for residential mortgages, does not contain similar guidance (seeSection B3-3.2-01 of the Fannie Mae guide, titled Underwriting Factors and Documentation for a Self-Employed Borrower for the relevant guidance).


In 2012, Freddie Mac revised the Guide by deleting the practice of obtaining a comfort letter from an accountant as a method of determining the impact of a withdrawal on a self-employed borrower’s business.  Section 37.13(b) of the Guide, which is related to stable monthly income and asset qualification sources, now states that when business assets are used for down payment and closing costs, financing costs, prepaids/escrows and reserves:

  • the assets must be verified in accordance with the documentation requirements in Sections 37.20 through 37.23;
  • the assets must be related to the business that the borrower owns that is documented in the mortgage file;
  • the seller of the mortgage is required to document a cash flow analysis for the borrower's business using the individual and/or business tax returns, as applicable; and
  • the mortgage file must contain the seller's written cash flow analysis and conclusions.

While lenders and brokers have always been responsible for conducting their own due diligence prior to making a credit decision, the revision to the Guide places the burden of determining the impact on the ability of the business to continue operating as a result of the withdrawal solely on the lender or broker.

If a self-employed borrower is informed that he/she will not qualify for a mortgage unless his/her accountant provides a comfort letter, accountants should challenge this assertion by referencing the fact that such guidance does not exist in either the Fannie Mae or Freddie Mac seller guides for residential mortgages.

Other Requests

Recently, other types of Verification Document requests have emerged.  Examples include:

  • Requests from adoption agencies and foreign countries for a Verification Document confirming the client’s self-employment, citizenship status and the financial stability of the client’s business; 
  • Requests from health insurance providers for a business Verification Document from a CPA, Certified Management Accountant (CMA), licensed tax consultant or attorney attesting that the listed, eligible employees worked the minimum hours required under state law, and that the business is a bona fide business qualifying as a small employer under state law and health plan underwriting guidelines; and
  • Requests from state taxing authorities for a Verification Document from a CPA, enrolled agent or attorney certifying that the taxpayer and the “authorized representative” have reviewed the books and records of the taxpayer and determined that there is no use tax due or reportable.

Regardless of the nature of such requests, there is one basic principle that should be followed — CPAs providing written assurance must comply with the AICPA Statements on Standards for Attestation Engagements (SSAE).  Attesting to client information without performing attestation services in accordance with the SSAE constitutes a violation of professional standards, resulting in licensure implications.


In response to such requests, CPAs should remind clients that tax returns are prepared based on their information and representations, which are neither audited nor verified. CPAs also should inform clients that assurances cannot be provided to a third party about information in tax returns or with regard to any other client matters. 


An Alternative


Although it is preferable, from a risk control perspective, to avoid confirming any client information to a third party, refusing to provide any information may alienate clients. As an alternative, the CPA may send a letter to the third party confirming only that the firm prepared the applicable income tax return(s) for the client to meet the client’s tax-filing obligations.1 If the individual income tax returns were filed electronically on the client’s behalf, the letter also could state that the client provided the CPA with a signed copy of IRS Form 8879, which includes a declaration that the taxpayer examined a copy of his or her electronic individual income tax return and accompanying schedules and statements for that tax year and declared that it is true, correct and complete to the best of his or her knowledge.2


Ideally, clients should provide any requested information directly to third parties.  If a client asks the CPA to send a copy of his or her tax return to a third party, the CPA must obtain the client’s signed written consent prior to doing so.  Protecting the confidentiality of client information is required under professional ethics standards, the Gramm-Leach-Bliley Act, the Internal Revenue Code, state board of accountancy rules or regulations, and federal and state privacy statutes and regulations.


Even after offering this practical solution, clients may continue to implore you to provide the specific representation that a lender, broker or other third party is seeking.  The third party may assert that the client will not be approved for a loan or may otherwise fail to meet their requirements if the CPA does not provide the requested Verification Document.  When this occurs, the CPA may wish to remind the client about the limited nature of the scope of services provided, and why the Verification Document is inconsistent with such representations. 




Third parties are responsible for performing their own due diligence rather than relying on a representation or verification of information by a CPA.  This is especially true when the requested representations are outside the scope of the CPA’s engagement and the requested verification relates to information that comes from the client, for which the CPA has no first-hand knowledge.  Additionally, while clients desire the flexibility to obtain credit in the marketplace, the responsibility for underwriting a loan and determining the creditworthiness of the borrower lies with the lender — not the client’s CPA. 

Appendix A – Sample Response Letter to Lender or Broker


ABC Company
City, State ZIP


Dear _______________:


I am writing to you at the request of Mr. & Mrs. ____________________.


The purpose of this letter is to confirm that I prepared the 20XX federal individual income tax return of Mr. & Mrs. ______________ and delivered this return to them for review and approval before filing it electronically with the Internal Revenue Service (IRS) and [state tax authority]. 


Mr. & Mrs. ______________  provided the firm with a signed and dated copy of IRS Form 8879, which includes a declaration that they examined a copy of their electronic individual income tax return and accompanying schedules and statements for that tax year and declared that it is true, correct and complete to the best of their knowledge.


This return was prepared from information furnished to me by Mr. & Mrs. _______________. This information was neither audited nor verified by me, and I make no representation nor provide any assurance regarding the accuracy and completeness of this information, or the sufficiency of this tax return, as it relates to your decision to extend credit to, or make any other determination regarding, Mr. and Mrs. ________ or any other persons or entities.


I prepared Mr. & Mrs. ___________________ tax return in accordance with applicable tax law and regulations, and guidance by IRS and [state tax authority], solely for filing with the tax authorities.  As a result, the tax return does not represent any assessment on my part as to their creditworthiness, and does not include any statement of their financial position or income and expense for the year 20XX in accordance with generally accepted accounting principles, and should not be construed to do so. 


As you know, a credit decision, or any other determination for which this information might be used, should be based upon the exercise of due diligence in obtaining and considering multiple factors and information. Any use by you of Mr. & Mrs. __________________ 20XX federal individual income tax return and this letter is solely a matter of your responsibility and judgment. This letter is not intended to establish a client relationship with you, nor is it intended to establish any obligation on my part to provide any future information to you regarding Mr. & Mrs. ____________________.



(Firm Name)

cc: Mr. & Mrs. ______________________ (Client)


In addition, if a CPA is aware that the purpose of a client’s request for copies of tax returns is to provide them to third parties, the CPA should consider adding the following language in the transmittal letter that accompanies the copies of tax returns:


We prepared the tax returns solely for filing with the Internal Revenue Service (IRS) and state and local tax authorities.  They are not intended to benefit or influence any third party, either to obtain credit or for any other purpose.


As a result, you agree to indemnify and hold our firm and any of its partners, principals, shareholders, officers, directors, members, employees, agents or assigns harmless from any and all claims arising from the use of the tax returns for any purpose other than filing with the IRS and state and local tax authorities, regardless of the nature of the claim, including the negligence of any party.”

1. Appendix A sets forth a  Sample Response Letter to Lender or Broker  that could be used to respond to a comfort letter request from a lender or broker, and may be modified for other similar requests. 

2. If electronic tax returns are prepared, signed copies of IRS Forms 8878 and 8879 (as applicable) must be retained for CPA’s records and as part of the working paper file for the client engagement.


Additional Resources


For more than 50 years, CNA has been serving accounting firms with solutions that help reduce the risks of managing their practice and insurance that helps cover a firm and its employees. With products and services designed for accountants by experienced professional risk consultants with practical experience in the profession, CNA insures more accountants than any other carrier. CNA’s broad portfolio includes professional liability, general liability, cyber liability, property, employment practices liability, and our industry-leading P&C package for small firms. We are proud to be the endorsed professional liability insurance carrier for the American Institute of CPAs® member insurance program.
CNA, Accountants Professional Liability, 333 S. Wabash Ave., 39S, Chicago, IL 60604



Updated November 2012


This information is produced and presented by CNA, which is solely responsible for its content.


The purpose of this article is to provide information, rather than advice or opinion. It is accurate to the best of the author’s knowledge as of the date of the article. Accordingly, this article should not be viewed as a substitute for the guidance and recommendations of a retained professional. In addition, CNA does not endorse any coverages, systems, processes or protocols addressed herein unless they are produced or created by CNA.


Any references to non-CNA websites are provided solely for convenience, and CNA disclaims any responsibility with respect to such websites.


To the extent this article contains any examples, please note that they are for illustrative purposes only and any similarity to actual individuals, entities, places or situations is unintentional and purely coincidental. In addition, any examples, including the sample letter, are not intended to establish any standards of care, to serve as legal advice appropriate for any particular factual situations, or to provide an acknowledgement that any given factual situation is covered under any CNA insurance policy. Please remember that only the relevant insurance policy can provide the actual terms, coverages, amounts, conditions and exclusions for an insured. All CNA products and services may not be available in all states and may be subject to change without notice.


IRS Circular 230 Notice: The discussion of U.S. federal tax law and references to any resources in this material are not intended to: (a) be used or relied upon by any taxpayer for the purpose of avoiding any federal tax penalties; (b) promote, market or recommend any products and/or services except to the extent expressly stated otherwise; or (c) be considered except in consultation with a qualified independent tax advisor who can address a taxpayer’s particular circumstances.


Continental Casualty Company, a member of the CNA group of insurance companies, is the underwriter of the AICPA Professional Liability Insurance Program.

CNA is a registered trademark of CNA Financial Corporation. Copyright © 2012 CNA. All rights reserved.