CTAPP Audits: reporting, compliance reviews and how to prepare

Annual reporting is the licensee’s disclosure and declaration through My State Bar Profile. A compliance review is a selected, records-based examination of safekeeping practices by a State Bar–approved CPA firm or State Bar CPA staff. An investigative audit is a distinct possible next step if review results warrant more investigation. The State Bar describes education and correction as goals, but neither reporting nor selection guarantees a favorable outcome. Reporting FAQ 1.2 · Review overview

The review program currently describes up to 800 selected attorneys annually. Its selection FAQ says the initial group represents a cross-section of the legal community; risk-based and random criteria may be used in the future. Do not assume that a complaint, an overdraft, or a particular self-assessment answer is a necessary trigger for a CTAPP review.

The State Bar’s reporting FAQs 2.2–2.3 say annual reporting covers California licensees active at any point in the reportable period, including those who later moved to voluntary inactive status. Even licensees who were suspended or not entitled to practice law during part of the period may still owe reporting. The stated annual-reporting exemption is voluntary inactive status for the entire period. For the 2026 cycle the stated reporting period is January 1–December 31, 2025; this is a cycle-specific example, not a perpetual date.

A lawyer who did not handle entrusted funds may still need to submit the screening answer and final declaration. The State Bar permits a no answer for a lawyer with no rule 1.15 responsibility, or whose only rule 1.15 responsibility involves the disclosure and agreement requirements in rule 1.15(b) for an advance flat fee properly deposited into an operating account. Otherwise, responsibility is broader than personally doing bookkeeping: signatories, supervisors and lawyers responsible for notices, liens or safekeeping may need to answer yes even when another person performs the tasks. A zero-balance but open trust account still must be reported and registered. A firm account maintained for a lawyer’s clients may count as maintained on that lawyer’s behalf. FAQs 2.7–2.10 and 3.1.2

For California licensees practicing elsewhere, there is no blanket exemption for out-of-state trust accounts; the Bar explains how to register non-California IOLTA accounts and report non-U.S. accounts where the portal cannot accept foreign banking fields. Mixed legal/nonlegal roles require fact-specific assessment. Consult FAQs 2.11 and 4.1–4.5 rather than assuming location or job title determines the result.

For lawyers who answer yes to the trust-funds screening question, the State Bar describes four steps: report whether IOLTA or non-IOLTA accounts were maintained; register each applicable account (including the required year-end or closing balance); complete the self-assessment; certify compliance; then submit the final declaration. If the answer is no, submit the declaration after the screening question. Check the Compliance Dashboard in My State Bar Profile to confirm completion. A firm using Agency Billing can register accounts for identified lawyers, but cannot submit those lawyers’ individual assessment, certification or declaration. FAQs 2.5 and 5.1

There is a specific former-firm account registration exception: under the State Bar’s FAQ 3.2.2, a lawyer who no longer worked with a firm as of December 31, 2025 did not have to register that former firm’s accounts for that cycle. If the former-firm answer was the lawyer’s only applicable yes answer, Step 2 could be skipped; any other accounts maintained by or on behalf of the lawyer still required registration. This does not excuse the lawyer’s remaining reporting steps, and the December 31 date is specific to the 2026 reporting cycle.

The reporting FAQ ties the deadline to the license-fee deadline: it identifies March 30 as the annual renewal deadline and 45 days from invoice for new attorneys. Verify the applicable current-cycle notice rather than treating these as review-response deadlines. Changes to trust-account information outside annual filing generally must be reported within 30 days. If changing an already submitted answer before the deadline, finish by resubmitting the declaration; opening it again without resubmitting can leave the filing incomplete. An honest “no” on a self-assessment item is not automatically a wrong answer; consider documenting why. FAQs 1.4, 2.6, 2.13 and 3.4.3

A selected lawyer receives instructions from the State Bar. The review process page says the first 30 days include notifying the Bar if someone else is the designated licensee, creating a secure-portal login and uploading initial requested records. The lawyer selects and engages an approved CPA firm unless an exemption to hiring one is approved. The CPA then conducts agreed-upon procedures and may make a second records request; the designated lawyer and recordkeeping staff should respond promptly. The Bar expects a review to take roughly four months, subject to turnaround time.

The first review covers at least one year of activity, usually the preceding January–December. An escalated investigative audit covers at least three years but no more than five, per the review FAQ on record scope. The Bar says requested documents must be submitted through its secure portal. It says redaction is not permitted in this process and cites statutory confidentiality and privilege protections under Business and Professions Code § 6091.4; discuss specific sensitive-record concerns with appropriate counsel and the Bar, rather than withholding or sending records over an unapproved channel. Confidentiality guidance

As outlined in the State Bar review records FAQ, assemble a chronological account journal for each trust account with a daily running balance; individual client/matter ledgers showing receipts, disbursements and running balances; bank statements and check copies; and monthly three-way reconciliations tying bank, journal and ledgers together with supporting outstanding-deposit and disbursement lists. Keep records of notices of received funds, deposit and payout support, engagement and fee agreements, settlement documents, invoices and communications about accounting or disputes. Missing records should be disclosed promptly to the reviewer with available alternative evidence—not silently recreated as if contemporaneous.

Use the IOLTA records checklist for a broader records inventory and the three-way reconciliation guide for the mechanics. The Bar allows any system that meets rule 1.15; its sample forms are not mandatory. A software export by itself does not prove the underlying entries, authorizations, client notices or judgment were correct. Recordkeeping guidance

Approved external CPA firms perform the Bar’s specified agreed-upon procedures, report factual observations and do not issue an overall compliance opinion. The State Bar evaluates findings and decides the result. The Bar estimates 20–40 CPA hours and says most reviews cost $5,000–$10,000, with actual costs dependent on records and responsiveness. Reviews are remote. Solo practitioners and small firms with gross receipts of $150,000 or less can apply for exemption from hiring an external CPA; if approved, a State Bar CPA performs the same review at no CPA-firm cost. This is not an exemption from review. CPA and exemption guidance

For subsequent document requests, follow the due date in each notice. Ask the reviewer early if a record is unavailable or an extension is needed; do not substitute the annual March filing date for a review-response deadline. Review response FAQ

Possible review outcomes include closure with feedback, a mandatory corrective action plan, an investigative audit or referral to the Office of Chief Trial Counsel for possible discipline. Minor problems may lead to education, but serious findings and noncooperation can escalate. Separately, missed annual reporting can trigger a noncompliance penalty and, if unresolved, inactive enrollment; the Bar explains reinstatement requires overdue reporting, applicable fees and a reinstatement application. These are different processes and none should be described as an automatic disciplinary verdict. Review outcomes · Reporting FAQs 2.4 and 2.12

1. Identify the designated licensee and list all open and closed trust accounts, responsible lawyers and applicable reporting periods.
2. Reconcile each month’s bank statement to the account journal and sum of matter ledgers; document and resolve differences without overwriting history.
3. Trace a sample settlement from receipt to client notice, signed statement, lien/fee determination, approved payment and bank clearance. Confirm matter balances and support for each transfer.
4. Export organized, access-controlled records and preserve source documents; ask the Bar how to submit privileged material if selected.
5. Compare practices with the Bar’s firm self-assessment and practice aid, assign remediation owners and document corrections.
6. Verify individual dashboard status, balances and declarations before the applicable filing deadline; maintain a calendar for changes within the separate 30-day window.

Disbo’s applicable live safeguards include three-way reconciliation, two-person IOLTA payment approval, two-factor approval, matter-linked payment history and exportable audit packages. These can help organize reviewable evidence, but firms remain responsible for accurate records, legal and accounting judgment, and responding to the Bar. See the audit-package workflow and California IOLTA guide. Requirements vary by situation and jurisdiction; no tool guarantees compliance.

Primary State Bar sources reviewed September 25, 2026. Rules and program instructions may change; check the official pages for current requirements. This guide is independent educational content, not legal advice or State Bar endorsement.

• State Bar of California, CTAPP reporting FAQs — annual applicability, filing steps, deadlines, exemptions, changes and noncompliance (2026 cycle covers 2025).
• State Bar of California, CTAPP Compliance Review — process, scope, CPA procedures, costs, exemption, confidentiality and outcomes.
• State Bar of California, Frequently Asked Questions: CTAPP Compliance Review — selection, record types, lookback, responses and remediation.
• California Rules of Professional Conduct, rule 1.15 — safekeeping and recordkeeping authority linked by the State Bar.

Explore the Resources hub or the related trust-account review guide for other audit contexts; CTAPP selection should not be conflated with all complaint- or overdraft-driven inquiries.