Every dollar sitting in a law firm’s trust account belongs to someone else. It isn’t earned until the work is done, it isn’t released until the client signs off, and the lawyer holding it has direct access to it the entire time it sits there. California’s State Bar built an entire compliance infrastructure around that single fact, and other states are starting to pay attention. As part of our Five Points series, here’s what firm leaders across the profession should understand about the Client Trust Account Protection Program, and why California’s version of it may end up being the one other states copy.
1. CTAPP Turned an Honor System Into Infrastructure
For years, safeguarding client trust funds came down to Rule of Professional Conduct 1.15 and an attorney’s word. CTAPP changed that. Every California attorney with a trust account now registers it with the State Bar, completes an annual self-assessment of their trust accounting practices, and certifies compliance with Rule 1.15 during their renewal period.
That’s a real shift. Compliance is no longer something a lawyer simply attests to once and forgets. It’s now a standing obligation, checked every year, with the State Bar building a complete picture of who holds trust accounts and how they say they’re managing them.
2. The Deeper Layer Is an Agreed-Upon Procedures Engagement, Not an Audit
Self-assessment is only the first layer. A smaller group of attorneys is selected each year for a compliance review, and the program is scaling fast. The State Bar reviewed 100 attorneys in 2025 and expanded that to 400 in 2026, drawn randomly from a cross-section of the attorney population.
Here’s the detail that matters most for CPAs watching this unfold. Those reviews are performed by State Bar approved CPA firms, and they’re structured as agreed-upon procedures engagements. There’s no opinion and no pass or fail. The CPA firm performs defined procedures against trust ledgers, bank statements, three-way reconciliations, and settlement statements, then reports factual findings back to the State Bar. The process runs in sequence, from notification through a records request, CPA firm assignment, fieldwork, and submission of findings. Firms that keep organized documentation move through it quickly. Firms that don’t create their own delays.
3. The Risk CTAPP Is Built to Catch Is Structural, Not Hypothetical
Trust money follows a simple rule. The principal belongs to the client until the lawyer has actually earned it, and any interest on pooled accounts is swept into the state’s IOLTA program to fund legal aid rather than the lawyer’s own pocket. Funds only move out once the service has been rendered and the client has approved the release.
The problem is that the lawyer controls the account the whole time that money sits there. Nothing structurally stops an attorney from dipping into client funds to cover payroll, rent, or a rough month, short of ethics rules and the risk of getting caught. Annual self-certification alone doesn’t verify anything. It only asks attorneys to say they’re following the rules. Independent, periodic review is what actually tests whether they are.
4. California Isn’t Alone, but It’s Doing Something Different
Other states already police trust accounts. New Jersey’s Office of Attorney Ethics has run a Random Audit Program for years, using computerized random selection and its own staff auditors to review firms of every size. Connecticut’s Statewide Grievance Committee can conduct surprise audits of any trust account under Practice Book Section 2-27. New York is moving in the same direction. In May 2026, the New York City Bar Association formally endorsed a bill, A.10145-A and S.9129-B, that would create a periodic random audit program for law firm trust accounts through the Lawyers’ Fund for Client Protection, citing New Jersey and Connecticut’s programs directly as precedent.
What none of those states have done is what California did. New Jersey, Connecticut, and New York’s proposed model all keep the review work in-house, run by bar or court staff rather than outside professionals. California is the only state that built a formal pipeline for independent CPA firms to perform the deeper compliance work.
5. Why Other States May Follow California’s Version of This Specifically
As more states look at trust account oversight, California’s model has an advantage the others don’t. Bringing in CPA firms trained in evidence gathering and procedural rigor lends the process a level of objectivity that in-house staff reviews can’t fully replicate. That matters beyond the State Bar’s own credibility.
It also creates a market incentive that state bars care about. A prospective client comparing two law firms now has a reason to ask which one can point to a clean trust accounting track record. A firm that can demonstrate it follows properly reviewed protocols has a real edge over one that can’t. As that incentive plays out in California, other state bars watching New York’s bill move through its legislature have a working example of the more credible version to reach for next.
Where This Leaves the Profession
CTAPP is still young, and how it matures will shape whether other states adopt it wholesale or build their own version of it. A few things are already clear.
- CTAPP replaced an honor system with annual reporting and a structured compliance review layer
- The deeper review is an agreed-upon procedures engagement performed by State Bar approved CPA firms, not a traditional audit
- The risk it targets is structural. Lawyers control money that isn’t theirs until it’s earned and released
- New Jersey and Connecticut already run in-house random audit programs, and New York has a bill advancing that cites both as precedent
- California’s use of independent CPA firms is the more credible model, and the one other states are likely to reach for next
At CPAClub, we think the profession the rest of the country ends up looking to is the one already building this the right way. This kind of agreed-upon procedures work draws directly on the skills audit professionals spend their careers building, testing documentation against defined criteria, tracing transactions, staying independent, and reporting findings without dressing them up as opinions. CPA firms are the professionals best equipped to do this reliably and at scale. Yes, it adds a cost law firms didn’t carry before. Weighed against what these engagements protect, client funds that were never the lawyer’s to begin with, that cost is a small price for the accountability it buys. We support programs like CTAPP for the same reason we support auditing more broadly. It’s the mechanism that lets clients, courts, and the public trust that money held on their behalf is exactly where it belongs.
CPAClub works with CPA firms building the technical capability and quality infrastructure to perform agreed-upon procedures and assurance engagements with confidence, including trust accounting compliance reviews like CTAPP. If your firm is exploring this kind of work, we’d love to talk.
