The accounting firm should, first of all, immediately tender the matter to their malpractice insurance company to make sure that they have triggered coverage, as they need to do. The second thing to do, and immediately, is to issue a litigation hold or document preservation notice to all parties who are affected, including administrative staff and the audit engagement team, so that they don’t destroy anything and, at the same time, do a firm-wide service systems backups, do mirror imaging of hard drives, and make sure that holds are placed on any paper files.

In addition to that, the company, the CPA firm, really needs to get in outside legal advice, to make sure that communications are cloaked in the privilege and the attorney work product confidentiality doctrine, and then very quickly to bring in outside, independent – not from within the firm – objective forensic help to start kicking the tires on the audit engagement records to get a sense of how strong, or not, the files might be. And then to take that information, to do a case assessment and make a determination as to whether or not the firm is best off to fight the matter and – presumably, hopefully – win it or do very well, or to attempt to maneuver for an early resolution.