CTAPP Compliance Review

California attorneys are responsible for safekeeping over $14 billion in funds held in trusts for their clients and other persons. The State Bar’s Client Trust Account Protection Program (CTAPP) was designed to proactively enhance public protection related to an attorney’s handling of entrusted funds and property by ensuring proper accounting and safeguards for client and third-party funds entrusted to attorneys and by educating and supporting attorneys with the ethical and accounting requirements of managing client trust accounts.

What is a CTAPP compliance review?

A CTAPP compliance review evaluates compliance with the Rules of Professional Conduct and applicable laws regarding the safekeeping of funds entrusted by clients or others and any related obligations. The compliance review will assess whether licensees and their firms maintain accurate and complete records, and all transactions and communications are in accordance with their clients’ or others’ documented expectations.

Compliance reviews will be completed by accountants at State Bar–approved certified public accountant (CPA) firms and by CPA staff at the State Bar. The State Bar will annually require up to 800 attorneys, representing a cross-section of the legal community, to complete a compliance review.

Overview of the compliance review process

View the Step-by-Step Process (PDF)

Prepare for a compliance review

Attorneys and their firms are encouraged to prepare for a compliance review of their trust accounting practices, even if they are not selected for a compliance review. This preparation:

• Saves time and money when you are required to complete a compliance review
• Helps you evaluate the compliance of your trust account records with the Rules of Professional Conduct, rule 1.15
• Establishes or clarifies your firm’s trust accounting policies, procedures, roles, and responsibilities
• Allows you to evaluate and enhance your firm’s supervision procedures
• Enhances your firm’s recordkeeping practices before you participate in a compliance review

Resources to help you prepare

• Attorneys and firms may complete an Attorney Self-Assessment of their trust accounting practices.
• A Firm Self-Assessment with Practice Aid is a comprehensive evaluation of a firm’s trust accounting practices that allows attorneys and firms evaluate areas of noncompliance and implement changes to the firm’s trust account management practices.

Trust account recordkeeping requirements

You may use any rule 1.15 compliant recordkeeping software or system you choose. The State Bar has published trust account recordkeeping forms and a template that you may use as well. Please note that you are not required to use the State Bar’s forms and templates. See additional trust accounting resources.

Benefits of a compliance review

At the end of the compliance review, State Bar staff will meet with the designated licensee to review the results. One of the primary goals of CTAPP is education. Minor issues will be addressed by explaining the rules of trust account management and recordkeeping and by advocating for the licensee to adopt best practices. If the licensee appears willing and capable of conforming their trust account management practices to the rules, some significant issues may not warrant a discipline referral to the Office of Chief Trial Counsel (OCTC) and will instead result in the issuance of a mandatory corrective action plan.

The benefits of a compliance review include:

• Learning how to reduce the likelihood of client complaints to OCTC for failure to communicate
• An independent evaluation of trust accounting practices to ensure compliance with applicable laws, including the Rules of Professional Conduct
• Identifying any areas of noncompliance with the Rules of Professional Conduct and other related obligations
• Identifying risks in your current trust account management
• Receiving best practice guidance to enhance trust account recordkeeping practices
• Enhancing compliance with nondelegable supervision practices
• Increasing confidence that proper trust accounting practices are in place to safekeep clients’ and other persons’ funds

Steps of a compliance review

Rules of the State Bar, rule 2.6 outlines the requirements for a licensee to complete a compliance review. If selected by the State Bar, the licensee must comply with and complete a trust account compliance review and cooperate with requests for information. The scope of a compliance review will encompass at least one year of trust account activity, generally from January 1 to December 31 of the prior year.

If you are selected to complete a compliance review, you will receive instructions from the State Bar about the process and next steps.

Within the first 30 days, you must:

• Notify the State Bar if you are not the designated licensee of your firm’s trust accounts and provide the name and bar number of the designated licensee (see Rules of the State Bar, rule 2.4(D) and rule 2.5(E) for definition and duties of a designated licensee)
• Create a login to the secure portal and upload initial records requested by the State Bar
• Engage a CPA firm to perform the compliance review (see Working with certified public accountant firms)

Once initial requirements have been completed, the State Bar will assign the engagement to the CPA firm engaged by the law firm (or to CPA staff at the State Bar if exempted from hiring a CPA firm; see Exemption to hiring CPA firm for compliance review). The CPA will begin the compliance review procedures, which include a second records request.

The designated licensee and their staff responsible for the day-to-day trust account recordkeeping should expect to dedicate time to promptly and clearly respond to requests from both State Bar staff and the CPA firm.

The compliance review is expected to take four months to complete, considering the turnaround time for records requests.

When the compliance review is complete, the State Bar will make conclusions and recommendations based upon the CPA firm’s observations from applying the compliance review procedures. The four possible outcomes of a compliance review are to close the compliance review and provide any including feedback to the attorney about best practices and areas of noncompliance, implement a mandatory corrective action plan, escalate to an investigative audit, or make a referral to the Office of Chief Trial Counsel for possible discipline.

Confidentiality and preservation of privileged records and information

Business and Professions Code section 6091.4 maintains confidentiality, privilege, and work product protections for any client information shared pursuant to a request during a compliance review and/or investigative audit. The statute also makes clear that State Bar licensees are not violating these protections by providing the information requested to State Bar staff or the CPA firms acting as State Bar agents for the purposes of conducting a compliance review. Any information, records, or communications provided during a compliance review shall remain confidential unless disclosure by the State Bar is required to fulfill its licensing, regulatory, and disciplinary functions. Information turned over to the State Bar or its agents during a compliance review shall not be disclosed pursuant to any state law, including but not limited to the California Public Records Act. Disclosure by the State Bar or its agents shall not be deemed a waiver of the confidential character of the information for any other purpose.

For more information about protecting confidential client information, watch this video about California Rules of Professional Conduct, Rule 1.6: Protecting Confidential Client Information.

Redacted records

As part of the compliance process, the attorney must provide information that may be attorney-client privileged or attorney work product. 

• Redacted records are not permitted in the compliance review process and will result in a noncompliance with the compliance review, as required by Rules of the State Bar, rule 2.6.
• Confidentiality clauses in engagement or settlement agreements do not justify redacting or withholding documents requested as part of a compliance review or investigative audit and, as a result, clauses requiring notice to opposing parties or counsel will not serve as good cause necessitating the extension of time to provide the required information.
• Failure to comply may result in a referral to the Office of Chief Trial Counsel pursuant to rule 2.6(F) and (G) for failure to comply with applicable law regarding the safekeeping of funds entrusted by clients or others or any related obligations, including, but not limited to, sections 6068(a), 6068(i), and 6091.4 of the Business and Professions Code, the California Rules of Court 9.8.5, and the California Rules of Professional Conduct.

Working remotely with certified public accountant firms

The Supreme Court of California approved California Rules of Court, rule 9.8.5 to establish CTAPP. Specifically, Rule 9.8.5(a)(2)(B) states that if selected by the State Bar, a licensee must complete and submit to the State Bar a client trust accounting compliance review to be conducted by a certified public accountant at the licensee’s expense.

The State Bar has approved certain CPA firms with specific qualifications and experience to complete compliance reviews on behalf of California attorneys. All approved CPA firms have made certain agreements with the State Bar, which include:

• Applying specific agreed-upon procedures provided by the State Bar to complete the compliance review
• Completing all State Bar–provided trainings
• Maintaining all files and analysis solely within the State Bar–provided audit management software system
• Agreeing that the State Bar will retain all CPA firm files upon completion of the compliance review to ensure data privacy and privilege protections
• Prohibiting the CPA firms’ regulators or peer reviewers from accessing or reviewing the CTAPP compliance review engagements

When an attorney is selected to complete a compliance review, they must select and engage a State Bar–approved CPA firm. Tips for selecting a CPA firm:

• Contact and engage directly with the State Bar–approved CPA firm to ensure that you select the right fit to perform your compliance review before submitting your firm selection to the State Bar.
• Communicate early to ensure a smooth review process and a clear understanding of the next steps.
• The compliance review will be conducted remotely rather than in person. Any State Bar–approved CPA firm is able to perform the review regardless of the physical location of your law firm or the CPA firm.

List of approved CPA firms

The compliance review is a specific type of engagement called Agreed-Upon Procedures. This type of engagement requires the CPA to complete a set of specific procedures without providing an opinion or conclusion about their findings. Instead, the CPA will provide a description of factual findings based solely on their observations that result from applying the procedures established by the State Bar. For example, the accountant will review a sample selection of records to evaluate whether the client was notified within 14 days of the licensee’s receipt of funds as required by rule 1.15(d)(1) of the Rules of Professional Conduct. The CPA will provide a description of their findings along with supporting documentation that indicates whether the communication was made within the relevant time frame.

During the compliance review, the CPA may ask for clarifying information or additional documentation if the records provided are not sufficient to complete the procedures.

The State Bar estimates a standard compliance review will take approximately 20–40 hours for the CPA to complete, and most compliance reviews costs between $5,000-$10,000. Poor recordkeeping, slow response times in turning over requested documents, and unclear communications will generally require the CPA to spend more time completing the compliance review increases the cost. On the other hand, records that are well-maintained and comply with the rules outlined in the scope of the compliance review procedures published for public comment will likely result in lower costs to attorneys.

Exemption to hiring CPA firm for compliance review

Solo practitioners and small firms with gross income of $150,000 or less may apply for an exemption to hiring a CPA firm for the compliance review. If exempt, a State Bar–employed CPA will be assigned to complete the compliance review with no cost to the attorney or firm. You will not be exempt from completing the compliance review.

This exemption does not exempt the attorney from the compliance review process, which is the same for those completed by a State Bar–employed CPA and external CPA firms.

• Qualifications: Gross revenue (gross receipts) of $150,000 or less
• Required documentation: Income support documentation
• Timeline: Approval or rejection of exemption application within seven (7) days

Complete and submit the Application for Exemption from Hiring a CPA Firm for Compliance Review to apply for an exemption.

Related links

• CTAPP Compliance Review FAQ
• CTAPP Compliance Review Process: One-pager
• Trust Account Bookkeeping Resources