What is AICPA? Facts That Every Business Owner Should Know
Robin Joseph
Senior Security Consultant
AICPA, the American Institute of Certified Public Accountants, is the professional body that sets the standards, ethics rules, and exams CPAs are held to in the United States. Founded in 1887, it now represents more than 597,000 members across 188 countries and territories.
If you’re a business owner, AICPA already shapes your financial world, whether you realize it or not. While the Financial Accounting Standards Board (FASB) now sets GAAP rules, AICPA still carries serious weight, crafting the ethics guidelines, business valuation frameworks, auditing procedures, attestation standards, and firm-level quality control rules your CPA works under.
AICPA and SOC 2: Why This Matters If You're Getting Audited
If you've been researching SOC 2 compliance, AICPA isn't just background trivia. It's the body that defines what a SOC 2 report actually is.
SOC 2 engagements are governed by AICPA's attestation standards (specifically AT-C sections 105 and 205), and the five categories every SOC 2 report is measured against, security, availability, processing integrity, confidentiality, and privacy, are AICPA's own Trust Services Criteria.
That has one practical consequence if you're shopping for an auditor: a SOC 2 report can only be issued by a CPA firm licensed by, and in good standing with, the AICPA. If a vendor offers a "SOC 2 audit" without a licensed CPA firm behind it, what you're getting isn't a valid SOC 2 report. See our guide to choosing a SOC 2 auditor for what to check before signing.
What Does AICPA Stand For, and What Does It Do?
AICPA started in 1887 as the American Association of Public Accountants and took its current name in 1957, after several rebrands as the profession matured. Today it represents more than 597,000 members across 188 countries, setting the ethics rules, auditing standards, and CPA exam every licensed accountant in the U.S. works under.
For small business owners specifically, that influence is practical, not abstract. AICPA's Private Companies Practice Section (PCPS) gives CPA firms management resources built for small and mid-sized businesses, and its Financial Reporting Framework for Small and Medium-sized Entities (FRF for SMEs) offers a lighter-weight alternative to full GAAP reporting for privately held, owner-managed companies. AICPA also runs the Uniform CPA Examination and sets Generally Accepted Auditing Standards (GAAS), the rulebook every CPA follows when auditing financial statements.
AICPA's Role in Standards and Ethics
Every AICPA member also signs onto a strict Code of Professional Conduct: principles like integrity, objectivity, and independence, backed by specific behavioral rules and interpretations. It's mandatory, not optional, and it's what keeps your CPA obligated to keep your information confidential and steer clear of conflicts of interest.
AICPA no longer sets GAAP itself, FASB does, but it still works closely with FASB and GASB (which covers public sector accounting) to flag rules that look fine on paper but don't hold up in practice. That collaboration is why standards built by regulators end up workable for actual businesses, not just compliant on paper.
What is AICPA Certification and Why It Matters
Think all CPAs are created equal? Not even close.
AICPA certifications separate the pros from the pretenders. These credentials don’t just decorate office walls, they signal real expertise, going beyond basic accounting knowledge into a specialized skill set.
The Four AICPA Credentials, Compared
AICPA offers four credentials that turn CPAs into niche specialists. Each requires AICPA membership in good standing, an active CPA license, a dedicated exam, and real hours logged in the specialty, not a weekend course.
| Credential | Built For | Core Turf |
|---|---|---|
| Personal Financial Specialist (PFS®) | Wealth & retirement planning | Tax, retirement, estate, risk, and investments, all under one roof. |
| Certified Information Technology Professional (CITP®) | Tech-finance crossover | Cybersecurity risk, data management, IT governance, SOC reporting. |
| Certified in Financial Forensics (CFF®) | Fraud & disputes | Fraud investigations, litigation support, forensic analysis. |
| Accredited in Business Valuation (ABV®) | Deal-making & disputes | Business and intangible-asset valuation for M&A, succession, litigation. |
-
Personal Financial Specialist (PFS®) – Wealth, retirement, estate, and tax planning under one roof.
-
Certified Information Technology Professional (CITP®) – Cybersecurity risk, data management, IT governance, and SOC reporting.
-
Certified in Financial Forensics (CFF®) – Fraud investigations, litigation support, and forensic analysis. More than 4,000 CPAs hold it today.
-
Accredited in Business Valuation (ABV®) – Business and intangible-asset valuation for M&A, succession, and disputes. Requires 1,500 hours of valuation experience just to apply.
Each credential requires its own exam, thousands of hours of specialized experience, and ongoing continuing education, at least 120 hours every three years to stay certified. These aren’t paper titles, they're earned and maintained.
Benefits of AICPA Membership for Business Owners
Smart business owners know the difference between a regular accountant and an AICPA member. Membership means:
- A CPA bound by a Code of Professional Conduct that actually has teeth, not just a license.
- Access to frameworks and internal control guidance built specifically for small and mid-sized businesses, through resources like PCPS.
- A CPA who keeps learning: 120 hours of continuing education every three years, so their knowledge doesn't go stale.
- Strategic support beyond bookkeeping, tax planning, cash flow forecasting, and benchmarking tools that help you make better decisions, not just stay compliant.
The payoff is straightforward: fewer surprise penalties, fewer overlooked regulations, and a CPA who is accountable to a real professional body, not just a license number.
Frequently Asked Questions
AICPA stands for the American Institute of Certified Public Accountants, the U.S. professional body that sets accounting standards, ethics rules, and the CPA exam.
AICPA created and maintains the standards a SOC 2 report is built on. Its Trust Services Criteria define what gets tested, and its attestation standards (AT-C sections 105 and 205) define how the audit itself must be performed.
Yes. A SOC 2 report can only be issued by a CPA firm licensed by the AICPA and in good standing. If a vendor offers a "SOC 2 audit" without a licensed CPA firm attached, it is not a valid SOC 2 report.
Five categories a SOC 2 report evaluates: security, availability, processing integrity, confidentiality, and privacy. Security is mandatory; the other four are included based on what your business actually commits to customers.
Not exactly. A SOC 2 report is an attestation engagement under AICPA standards, not a traditional financial statement audit. It's narrower in scope, focused on internal controls rather than financial accuracy, but it still must be performed by an AICPA-licensed CPA firm.
A CPA license is the baseline. AICPA credentials, PFS, CITP, CFF, and ABV, sit on top of it. Each requires passing its own exam plus real hours of specialized experience in that niche, not just holding the CPA license.
The Bottom Line on AICPA for Business Owners
AICPA has been the backbone of the accounting profession for over 137 years, and that backbone matters directly to SOC 2 compliance: it's the body whose standards your auditor is held to, and whose Trust Services Criteria your report is measured against.
Work with a licensed, AICPA-accountable CPA firm, and you're working with people bound by real standards, not just a sales pitch.
Take control of compliance, reduce risk, and build trust with UprootSecurity, where GRC becomes the bridge between checklists and real breach prevention.
→ Book a demo today
SOC 2
