The CPA's Moment: From Risky Comfort Letter to CPA-Verified SMB^™

The CPA profession has been reflexively declining verification work for as long as anyone can remember. The CPA's professional standing gets repeatedly extracted as free leverage in transactions, and the reflex to decline is correct. The training behind it is right, and the professional liability community has done its job protecting the profession from improperly-structured requests. But the same defensive reflex has obscured something else: that verification work, properly structured and engaged early, is some of the most valuable work CPAs can perform. The SSAE 19 framework to do it has existed since 2021. The clients who need it are already in every CPA's book. And the moment to claim that verification work is now.

The pattern starts in its smallest form, in a story every CPA recognizes.

Client calls Friday afternoon. Their broker needs a letter by Monday confirming the client's self-employment income, business profitability, and ability to fund a down payment. "It's the same numbers as last year's return, can you just write something?" You explain the professional standards issue. The client gets frustrated. The broker gets frustrated. You either decline (and feel like you've failed the client) or you write something carefully hedged (and feel like you've absorbed risk you weren't paid for). An hour goes by. Nothing gets billed. The professional standing of the CPA (the credential the lender wanted to lean on) gets used as free leverage in a transaction.

CAMICO and CNA have correctly trained the profession's reflex on these requests. Decline. The requests are structurally improper. No engagement letter, no scope, no compensation, full liability. The defensive training has been right.

But the comfort letter is the small version of a much larger pattern that plays out in SMB exits at much higher stakes, and CPAs are absorbing the same disrespect with millions of dollars in transaction value riding on it.

Every CPA who has served SMB clients has the exit story too. Client calls with urgency. "Hey, I accepted an LOI on the business. The buyer's QoE team wants three years of financials, customer concentration analysis, owner add-backs, working capital normalization, and a few other things. They need it by next Friday." The CPA is now expected to produce diligence-ready financials in a week, on a transaction structured by other parties, for normalized EBITDA calculations the original engagement letter never covered. Years of legitimate tax and advisory work get repurposed under time pressure for a context the work was never structured to support.

What follows is predictable. The buyer's QoE team surfaces issues that should have been resolved before the business went to market. The lender wants verification letters the CPA isn't positioned to write. The seller blames the CPA when the valuation drops. The CPA absorbs weeks of unpaid work, professional liability exposure, and relationship damage, all in service of a transaction the CPA wasn't invited to prepare properly first.

The dysfunction was allowed to exist because there was no operational alternative. The same skills the profession has been protecting from misuse become enormously valuable when applied at the right moment in the right framework. That framework exists.

SSAE 19 inverts the dynamic.

The Statements on Standards for Attestation Engagements have governed CPA attestation work for decades. SSAE 19, effective since 2021, specifically governs Agreed-Upon Procedures engagements: defined-scope attestation work where the CPA and the engaging party agree in advance on the specific procedures to be performed, the CPA performs them, and the findings are reported within a properly-structured engagement.

This is exactly the right structural fit for pre-transaction verification work in SMB exits.

The scope is bounded. The procedures are defined in advance. The CPA is not opining on financial statements as a whole, not providing assurance of any kind, not absorbing the open-ended liability of a comfort letter or the in-the-moment risk of last-minute QoE support. The agreed-upon procedures produce findings, not an opinion. The work is billed at the firm's standard rates as an attestation engagement, with no contingency on whether the underlying transaction closes. The fee structure, non-contingent and not commission-based, is consistent with AICPA Rule 1.510 (Contingent Fees) and Rule 1.520 (Commissions and Referral Fees). The CPA's attest independence is governed by ET 1.200, ET 1.295, and the AUP interpretation ET 1.297.020, the same independence framework that governs other attestation work. Independence here means independence with respect to the information being verified: the attesting CPA must not have prepared the underlying books, though they need not be a stranger to the business.

What this looks like in practice: an independent CPA performs scope-bounded AUP engagements on the evidence behind the specific disclosures lower-middle-market buyers commonly ask to see checked. Stated revenue agreed to source records. Owner add-backs and add-back schedules agreed to support. Customer concentration figures agreed to the underlying detail. Contract terms agreed to the executed agreements. Stated balance sheet items agreed to documentation. Each disclosure has defined procedures, defined evidence requirements, and defined reporting language. The CPA performs the procedures against the evidence behind each disclosure, documents the work, and reports the findings, months or years before the business goes to market, scheduled and scoped, structured as a recurring attestation engagement type within the firm's practice management workflow.

By the time a buyer arrives, the disclosures are already checked. The buy-side QoE process becomes confirmatory rather than investigative. The lender doesn't need to ask for letters because the findings already exist. The seller arrives at the market prepared. The CPA doesn't get the Friday afternoon call asking for magic.

The clients are already in the book.

The CPAs reading this don't need to find new clients to perform this work. The clients are already in the existing book. They're the owners every CPA already knows, and every CPA can recognize them by archetype within minutes of considering their practice.

The sixty-something founder approaching retirement, with no clear succession plan. Built the business over decades. Kids aren't taking it over. Spouse wants them to slow down. They've been talking vaguely about "selling someday" for years without doing anything operational about it. The CPA has watched this client postpone the conversation for a decade.

The mid-fifties owner with the unsolicited offer. Business doing well. A competitor, strategic acquirer, or search fund just made an approach. The owner is intrigued but doesn't know how to evaluate it. They call the CPA: "Should I take this seriously?" The financials aren't structured to present the business at its actual value.

The partner group with mismatched timelines. Two or three founders. One wants to retire. Another wants to keep going. They've never formalized how the buyout would work. The business is profitable but the partner dynamic is becoming untenable. The CPA has been watching this tension build through tax season conversations for years.

Every CPA reading this can name specific clients who fit these archetypes. Probably three or four within sixty seconds. The recognition has always been there. What's been missing is the framework to convert that recognition into a properly-scoped engagement before the chaos starts.

This is the source of the work. Not new clients arriving from somewhere. Existing clients whom the CPA already knows, whose situations the CPA has been observing for years, who will need verification work in the next one to three years.

Twelve million baby-boomer-owned SMBs are approaching transition over the next decade. The Exit Planning Institute consistently finds that 70 to 80 percent aren't ready to sell. The buyer base has diversified toward search funds, ETA buyers, family offices, and smaller PE platforms, all of whom rely on third-party verification because they lack the operational context strategic acquirers once brought. SBA financing is becoming more rigorous on self-employed borrowers. Buy-side QoE costs are climbing.

If CPAs don't lead their clients through this verification work, the dysfunction will continue.

The comfort letter dynamic is what gets replaced. The exit-prep chaos pattern is what gets replaced. The CPA-Verified SMB^™ is what replaces them with a structured engagement for the verification work.

The same professional standing that's been extracted as free leverage becomes enormously valuable when structured properly and engaged early. The framework exists. The clients are in the book. The dysfunction that allowed the old pattern to persist is ending because the structural alternative is here.

The profession has the standing, the skill, and now the moment.

A note on this thinking.

SoForma was built on these principles: that CPA-led pre-transaction verification, structured under SSAE 19 and engaged early, is the path that replaces the dysfunction the profession had no choice but to absorb. The platform exists to operationalize what CPAs are already qualified to do under standards they follow. The CPA's moment is now. Some firms are already capturing it. The rest of the profession can claim it next.

SoForma is the verification platform building the CPA-Verified SMB^™ category.

See also: Why AI Needs CPA Verification — And Why the CPA's Moment Is Now: why AI raises the value of credentialed verification. Tell the Truth: "CPA-Verified SMB^™" Is What Buyers Always Wanted: the foundational thesis. What CPA Verification Is — and What It Isn't: distinguishing verification from adjacent work.

Michael d'Amato is the founder of SoForma, verification infrastructure for CPAs preparing SMB clients for sale. Based in Miami.