The gaps to check first are a retroactive date that resets at closing, professional liability that may leave out data breaches and fines, thin or missing cyber and social engineering cover, weak protection for client money, and a business income setup that ignores tax season. Each one can usually be spotted in a policy document, and many can be addressed before the next busy season, depending on what carriers will offer and, for the retroactive date, whether a tail option is still open. This guide is for the buyer of an accounting, tax or bookkeeping practice who has the seller's policies in hand and wants to know where they stop short.
The short answer
- Professional liability policies commonly exclude or limit data breaches, fines and criminal acts, and a businessowners policy is generally written to exclude professional services. A general liability or businessowners policy is therefore not the one that answers a wrong-return claim. Read your wording, because some forms add limited extensions.
- A claims-made professional liability policy whose retroactive date equals your closing date leaves the seller's earlier work uncovered unless a tail or prior acts coverage is arranged, depending on who is insured and what carriers offer.
- A firm that holds client data and moves money faces cyber and social engineering losses that standard office policies are not built to pay.
- A standard business income form replaces lost income only when direct physical loss or damage to property stops or slows the office, usually after a 72 hour wait, so it may not match a revenue year that peaks before April 15 and October 15. Check your form.
- Not every gap needs buying. A firm with no client funds, for example, may not need client property crime coverage.
Where do the gaps usually sit in an accounting or tax firm program?
The table lists the gaps, how each shows up in the documents and the usual fix. It is a screening tool: your policies may already handle some items, and some fixes depend on what carriers will offer.
| Gap | How to spot it | Usual fix |
|---|---|---|
| Retroactive date resets at closing | The professional liability declarations page shows a retroactive date at or near your closing date | Tail on the old policy (it protects the entity it insures, so deal structure matters), or a new policy that keeps the earlier date |
| Professional liability exclusions | Exclusions for fraud, intentional or criminal acts, bodily injury, property damage, and sometimes fines and cyber events | Ask for written answers on regulatory proceedings, then buy separate cyber coverage for breaches |
| No cyber coverage, or a thin one | No cyber declarations page, or limits you have not tested against what a breach response and lost filing weeks could cost | Add cyber and match its conditions to your written security plan |
| Social engineering and client money | The crime form lists funds transfer fraud but not impersonation, or shows a low sublimit (a cap) | Ask for impersonation coverage and employee theft of clients' property if you touch client funds |
| Business income that ignores tax season | Limit or coinsurance based on a flat year (commercial property form), 72 hour wait, physical loss trigger only | Rework the income worksheet and consider extra expense and a longer period of income payment after the loss |
| Electronic files and paper records | On a commercial property form, a $2,500 default limit for corrupted electronic data. On a businessowners policy, check its own electronic data and valuable papers limits | Raise the electronic data limit, check what cyber pays to restore data, and add valuable papers coverage for paper records |
| Clients' original documents | Check whether the property form extends to clients' property in your care, custody or control, at what limit, and whether papers and records are capped or excluded | Ask whether coverage for other people's property in your care (bailee coverage) or valuable papers coverage can be added, and confirm records-reconstruction limits |
| Staff driving to clients | No hired and non-owned auto endorsement on the package or auto policy | Ask for hired and non-owned auto, usually an endorsement |
| Wage and hour and employment claims | No employment practices policy, or wage and hour excluded or sublimited | Ask what the form says and size it for seasonal staff |
| Umbrella that stops short | The umbrella does not sit over professional or cyber liability | Raise limits on the professional and cyber policies themselves |
The first row connects to prior acts and tail coverage after an acquisition. The rest are explained below.
Why is professional liability not enough on its own?
Professional liability is built for one failure: a client says your work product, such as a return, a financial statement or advice, was wrong or late. According to the International Risk Management Institute (IRMI), accountants' policies typically exclude fraud, intentional acts, criminal acts, bodily injury and property damage, and higher risk work such as investment advice and Securities and Exchange Commission related engagements may be added by endorsement. Forms vary by insurer, so check the one you hold. Three practical consequences follow:
- A data theft is a different failure. The Internal Revenue Service (IRS) tells tax preparers to check with their professional liability carrier about data theft coverage, so ask in writing.
- Penalties can land on you personally. Federal tax law can penalize a preparer personally in some situations when a return understates tax. Policies commonly exclude fines and criminal acts, so read what the form says about penalties and do not assume it pays them.
- Defense for regulators is a separate question. Ask whether the carrier offers any defense for regulatory proceedings, and ask your attorney about the rules that apply to you.
The professional liability vs cyber liability comparison shows how the two policies split.
What happens to my coverage if someone clicks a phishing link in March?
A hypothetical example. In the second week of March, a staff member enters credentials on a fake tax software login page. Thieves reach client files and file fraudulent returns. The IRS may deactivate the firm's Electronic Filing Identification Number (EFIN) while the firm finds and fixes how the intrusion happened, and in this example the firm cannot e-file for several weeks of filing season. Which policy responds?
- Cyber may pay forensic and notification costs, depending on its wording, and may or may not pay lost income.
- Professional liability is a poor fit, because commonly it excludes data breaches.
- Business income in a property policy generally needs direct physical loss to property, so it usually does not respond to a locked-out login.
Outside the policies, the Federal Trade Commission (FTC) Safeguards Rule asks a covered firm to notify the FTC as soon as possible, and no later than 30 days after discovery, of a security event involving unencrypted information of at least 500 consumers. State breach notification laws may add their own duties, so ask counsel which apply. Read how to review cyber coverage after an acquisition and which cyber controls can lower premium.
What if the firm handles client money?
Payroll and bookkeeping lines can put a firm in the middle of client bank accounts. The 2022 Insurance Services Office (ISO) crime forms include an insuring agreement for employee theft of clients' property, and an optional one for fraudulent impersonation. Social engineering, where an employee is tricked by a spoofed email into sending money, often falls outside computer fraud and funds transfer fraud coverage and, where covered, is commonly sublimited (capped well below the main limit).
Controls and coverage work together: segregation of duties (the person who requests a payment is not the person who approves it), a call-back rule for changed payment instructions, and a crime policy that names clients' property. See funds transfer fraud for new owners and the commercial crime page. A firm that never touches client funds may need little of this, and should say so to the broker.
Does business income coverage match a revenue year with two peaks?
Individual returns for calendar year filers are due April 15, and an automatic six month extension, which does not extend the time to pay, implies a second wave around October 15. The standard ISO commercial property business income form pays the net income the firm would have earned plus continuing expenses, including payroll, after a 72 hour waiting period, and only for direct physical loss at the described premises. If a coinsurance percentage applies, the limit is measured against twelve months of net income plus operating expenses, so a flat estimate can reduce a payment.
A pipe that bursts in the first week of April costs far more lost income than the same pipe in July. Ask the broker to build the worksheet around the busy months, and ask about extra expense so you can move staff and keep working. Computer data is a separate hole: the standard form limits interruption from corrupted electronic data to $2,500 per policy year unless a higher limit is shown, and valuable papers coverage excludes money and, usually, data programs.
These figures describe the standard commercial property form. A businessowners policy is a different form: the ISO businessowners policy is reported to include business income for up to 12 consecutive months, and its electronic data, valuable papers and waiting period terms differ, so read your own form. See business income coverage.
Which gaps should I fix first, and which can wait?
A reasonable order, not a rule:
- The retroactive date. Tail and prior acts decisions are tied to closing and renewal, and are hard to revisit later.
- Cyber and the written security plan. The filing-season risk is highest, and the plan is a legal expectation for covered firms, not only an insurance question.
- Crime and client money, if the firm handles it.
- Business income and records limits, before the next January.
- Employment practices, hired and non-owned auto and umbrella, at renewal.
Salaried staff who are not licensed accountants and who work long filing-season weeks raise a wage and hour question, so ask what the employment practices form says. An umbrella usually does not sit over professional or cyber liability, so check the limits on those policies before you price an umbrella. Higher limits and umbrellas are compared in higher limits vs umbrella after an acquisition.
A lender or investor may ask for proof of professional liability, cyber and crime coverage in diligence or at the first covenant check, so keeping the retroactive date, the cyber plan and the lease endorsements in one folder makes that update short. A gap is also not a verdict on the seller's broker. A program built for a solo owner can be sensible for that owner. The question is fit for you. See exclusions that quietly kill coverage and the core stack in what insurance you need after you buy an accounting or tax firm. If you send the declarations pages and the lease, Morrow can check them against this list and request quotes. Any new terms depend on carrier underwriting, and a quote is not coverage.
Keep reading
- Just Bought an Accounting and Tax Firm? What Insurance Do You Need?
- What Drives Insurance Cost for an Accounting and Tax Firm?
- Insurance Exclusions That Quietly Kill Coverage
- Funds Transfer Fraud: Why New Owners Are a Favorite Target
- Was the Seller Underinsured? How to Tell and What It Costs You
- All guides for new business owners
Frequently asked questions
If a phishing attack gets my e-file number shut off, will insurance cover my lost filing season?
It depends on the wording. Cyber policies may pay breach response costs and, on some forms, lost income. A property business income form usually needs physical damage, and professional liability commonly excludes data breaches. Ask your broker in writing what each policy says about lost income during a regulator or IRS suspension.
Will insurance pay the fine if the IRS penalizes me as a preparer?
Do not count on it. Accountants' policies commonly exclude fines, penalties and criminal acts. Ask the carrier whether any defense for regulatory proceedings is offered and what the form says about penalties, and ask your attorney about the rules that apply to you.
What happens if an employee wires client money after a fake email?
Coverage depends on the crime form. Social engineering often falls outside computer fraud and funds transfer fraud coverage, and where an impersonation option exists it is commonly sublimited. Controls such as a call-back rule also matter.
Do I need an umbrella policy for an accounting firm?
Maybe, if a lender or landlord asks for one. An umbrella usually does not sit over professional liability or cyber liability, so for many practices the limits on those policies matter more than an umbrella.
I bought the firm last month. How late is too late to ask for a tail?
Ask now. Tail and prior acts options are usually tied to closing and to the date the old policy ends, so the window may be short or already closed. Your broker and deal counsel can tell you what is still open.
References
- IRMI: Accountants Professional Liability Insurance
- IRS Publication 4557: Safeguarding Taxpayer Data
- IRS Publication 5293: Data Theft Resource Guide
- FTC: Safeguards Rule, what your business needs to know
- 26 U.S.C. 6694: Understatement of taxpayer's liability by tax return preparer (Cornell LII)
- IRS: When to file
- IRMI: Business Income Coverage
- IRMI: Valuable Papers and Records Coverage
- IRMI: Employee Dishonesty Coverage
- IRMI: Need To Know, Major Changes to the ISO Commercial Crime Program
Just bought a business? Get your insurance reviewed.
Send Morrow the declarations pages, loss runs and key contracts you inherited. Morrow can review them against the business you bought, flag gaps and request quotes where it makes sense. Any new terms depend on carrier underwriting.
Morrow · 25 New Chardon Street, 4th Floor, Boston, MA 02114
This article is general information, not legal, tax or financial advice, and not a coverage determination. Coverage depends on the actual policy wording, carrier underwriting, your purchase agreement and your contracts. Ask your attorney and accountant about deal and legal questions.