What AICPA, FTC, and State Boards Actually Require When CPA Firms Use Testimonials and Reviews

When a CPA firm asks a client to leave a Google review or publishes a testimonial on its website, three separate regulatory frameworks apply simultaneously. Understanding how they interact is the starting point for any compliant review strategy.

Layer 1: AICPA Code of Professional Conduct — ET §1.600.001

The AICPA's advertising and solicitation standard prohibits CPAs from making statements that are false, misleading, or deceptive. This applies to all forms of marketing — including third-party content the firm promotes or amplifies. If a client's testimonial implies a specific tax outcome, designed to savings, or result the firm cannot consistently deliver, reproducing that testimonial in firm marketing may constitute a violation, even if the client wrote it independently.

Key practical implication: the firm is responsible for the marketing context around a testimonial, not just its literal accuracy.

Layer 2: FTC Endorsement Guides

The Federal Trade Commission's Endorsement Guides (16 C.F.R. Part 255, last updated 2023) require disclosure of any material connection between an endorser and the brand being reviewed. A material connection includes:

• Compensation of any kind (discounts, referral fees, gift cards)
• Employment or professional relationship
• Free services provided in exchange for a review
• Close personal relationships where objectivity may be assumed by a reader

The FTC also clarified in 2023 guidance that buying fake reviews or suppressing negative reviews is an unfair or deceptive act. These rules apply to any business — including licensed professional service firms.

Layer 3: State Board Advertising Rules

Most state boards of accountancy have adopted advertising rules that mirror or supplement AICPA standards. Some states go further. Texas State Board Rule §501.90, for example, includes specific requirements around testimonial disclaimers and prohibits advertising that creates unjustified expectations. Requirements vary by state, and firms operating across state lines face the rules of each jurisdiction in which they hold a license.

This is educational content, not legal or ethics advice. Verify current state rules with your licensing authority and qualified legal counsel.

The table below summarizes the primary compliance sources relevant to CPA firms managing online reviews and website testimonials. Treat this as an orientation guide, not a complete legal reference — rules change, and state variations are significant.

AICPA ET §1.600.001 — Advertising and Solicitation

• What it covers: All CPA advertising, including testimonials the firm reproduces or promotes
• Core prohibition: Statements that are false, misleading, or deceptive; claims creating unjustified expectations
• Testimonial risk area: Outcome-specific language ("saved $X," "designed to refund," "never pay penalties")
• Who it applies to: AICPA members; many state boards have adopted equivalent rules

FTC Endorsement Guides — 16 C.F.R. Part 255 (updated 2023)

• What it covers: Consumer reviews, influencer posts, testimonials, and any endorsement of a product or service
• Core requirement: Clear and conspicuous disclosure of material connections
• Testimonial risk area: Incentivized reviews without disclosure; fake reviews; selectively suppressing negative reviews
• Who it applies to: All U.S. businesses, including licensed professional service firms

State Board Advertising Rules (varies)

• What it covers: CPA-specific advertising standards beyond AICPA baseline
• Common additions: Required disclaimers on testimonials, restrictions on superlatives, solicitation limitations
• Testimonial risk area: State-specific disclaimer requirements that national review platforms do not enforce
• Who it applies to: CPAs licensed in that state; multi-state firms must track each jurisdiction

As of 2024, the AICPA Code and FTC Guides represent the baseline floors. State rules may raise those floors. Always verify current rules directly with your state board — this content reflects general educational guidance, not jurisdiction-specific legal advice.

In our experience working with accounting firms, compliance gaps in the review process tend to cluster around four specific situations. None of these require bad intent — they usually result from applying consumer marketing practices to a regulated profession without adjusting for professional conduct rules.

Scenario 1: Reproducing Outcome-Specific Client Reviews on the Firm Website

A satisfied client posts a Google review mentioning a specific dollar amount saved or a tax problem resolved. The firm screenshots it and adds it to the website's testimonial page. The problem: the firm is now amplifying an outcome claim in its own marketing materials. Under AICPA ET §1.600.001, the firm is responsible for not creating unjustified expectations — even through third-party quotes it chooses to highlight.

Risk level: Moderate to high, depending on the specificity of the outcome claim and how prominently it is featured.

Scenario 2: Offering Incentives for Reviews

A firm offers a gift card, account credit, or referral discount to clients who leave a Google or Yelp review. This creates two simultaneous problems: a potential FTC disclosure violation (material connection not disclosed) and a potential AICPA issue if the incentive program is structured in a way that could be characterized as improper solicitation or fee-splitting under state rules.

Risk level: High. This is the most common scenario where both FTC and professional conduct exposure collide.

Scenario 3: Staff or Partner Reviews Without Disclosure

Employees, partners, or close associates of the firm leave reviews on Google or other platforms without disclosing their relationship. The FTC 2023 guidance explicitly addresses insider reviews — they require clear disclosure of the material connection.

Risk level: High for FTC purposes; also reputationally damaging if discovered publicly.

Scenario 4: Using Testimonials Without a Results-May-Vary Disclaimer in States That Require One

Several state boards, including Texas (Rule §501.90), require that testimonials used in CPA advertising include a disclaimer that results may vary. Firms that publish testimonials on websites or in digital ads without these disclaimers may be out of compliance even if the testimonial content itself is accurate.

Risk level: Moderate; varies significantly by state. Multi-state firms face the highest exposure.

The practical difference between a compliant and non-compliant testimonial is usually specificity of outcome versus quality of experience. Here are examples illustrating the distinction. These are illustrative templates — have your legal counsel review any testimonial program before implementation.

Language to Avoid

• "They saved me $18,000 in taxes last year." — Outcome-specific dollar amount; creates unjustified expectations if not universally achievable
• "Best accountant in Dallas — designed to to get you a refund." — Contains an absolute guarantee; violates AICPA false/misleading standard
• "They found deductions my previous CPA missed for 10 years." — Implies prior CPA incompetence and outcome-specific claim; high risk in several states

Language That Tends to Be Compliant

• "The team responded to every question within 24 hours during tax season — that level of responsiveness was unexpected." — Experience-focused, no outcome claim
• "They explained our options clearly and we felt confident in our decisions." — Process and relationship quality; no designed to result implied
• "Filing has been straightforward since we switched to this firm three years ago." — Longevity of relationship; subjective experience only

Disclaimer Language for States That Require It

If your state board requires a disclaimer on testimonials, the language typically reads similarly to: "Client experiences may vary. Past results do not guarantee similar outcomes." Placement matters — it should appear proximate to the testimonial, not buried in a site-wide footer disclaimer that a reader would not reasonably associate with the specific testimonial content.

Important: Confirm the exact disclaimer language and placement requirements with your state board or legal counsel. States differ on what satisfies this requirement, and digital advertising contexts (Google Ads, social posts) may have different requirements than static website content.

Google reviews are a meaningful local ranking signal. Firms with a higher volume of recent, genuine reviews tend to rank more prominently in Google's Map Pack for local accounting searches. This creates a real business incentive to build a review profile — and that incentive is where compliance risk enters the picture.

The core tension: the fastest ways to generate reviews are often the highest-risk ways for CPA firms. Incentive programs, bulk review requests to large client lists, and internal staff reviews are all shortcuts that carry regulatory exposure.

What Compliant Review Generation Looks Like in Practice

The approaches that hold up under both FTC and AICPA scrutiny share a few characteristics:

• Organic timing: Asking for a review at the natural end of a service engagement — after a tax return is filed, after a successful audit, after onboarding is complete — when client satisfaction is genuinely high and no inducement is involved
• No quid pro quo: The request is made without any offer of compensation, discount, or preferential treatment, explicitly or implicitly
• No scripted outcome language: The request does not suggest what the client should say — it invites honest feedback
• Disclosure where applicable: If anyone with a material connection to the firm leaves a review, that connection is disclosed in the review itself

Reputation Management Is Not Review Manipulation

Monitoring your Google Business Profile, responding to reviews professionally, and following up on negative feedback through service recovery are all legitimate reputation management practices. Selectively flagging accurate negative reviews for removal, or pressuring clients not to post critical feedback, crosses into territory the FTC has explicitly flagged as problematic.

For CPA firms pursuing compliant SEO strategies for CPA firms, the review strategy is one component of a broader approach that includes technical site health, local citation accuracy, and content authority — not a standalone tactic that can be pushed to generate volume at the expense of compliance.