Mortgage comfort letters test a CPA's ability to separate factual professional information from assurance. A lender may ask for a letter about a borrower's self-employment income, ownership, business viability, or ability to repay a loan. The exam point is not whether the CPA wants to help the client. The point is whether the requested language would make the CPA responsible for underwriting conclusions, future events, or assurance that was never obtained.
The safest analysis starts with the engagement already performed. Preparing a tax return from client-provided records does not express assurance on the return, the underlying books, the client's solvency, or the sustainability of income. If a third party wants assurance, the CPA needs a separate service with a defined subject matter, criteria, procedures, report, client authorization, and professional standards.
Why Comfort Letters Are Risky
A comfort-letter request often arrives in casual language: "Please confirm the borrower can afford the mortgage," "verify the business is active," or "state that income should continue." Those phrases may sound administrative, but they can create professional exposure because they ask the CPA to make a credit or going-concern-style conclusion for the lender.
For CPA exam purposes, identify three boundaries:
- Historical fact: what the CPA did or what a filed document contains.
- Assurance: whether the CPA has performed procedures sufficient to support a conclusion.
- Underwriting: whether the borrower is creditworthy or likely to repay debt.
Only the first category may be appropriate in a narrow letter connected to a tax engagement. The second category requires a separate professional service. The third category belongs to the lender, not the CPA.
Decision Map for Third-Party Verification Requests
A Narrow Letter Is Not a Shortcut to Assurance
Assume North Bridge Tax LLC prepared a 2025 Form 1040 for Dana Reed, who owns 60% of Reed Design Studio. A lender asks the CPA to "certify that Dana's business income is stable and sufficient for the proposed loan."
That request should be rejected or revised. A tax return engagement does not test the books, audit the entity, evaluate future cash flows, or assess the borrower's repayment ability. A narrow response, if authorized by the client and allowed by firm policy, might say only that the CPA prepared a specified tax return from information supplied by the client and that the return reports particular historical amounts or ownership information. It should also avoid any implication that the CPA verified, audited, reviewed, or guaranteed those amounts.
The difference is small in wording but large in responsibility:
- Acceptable factual lane: "The 2025 return prepared by the firm reports Schedule C gross receipts of $184,000."
- Improper assurance lane: "The borrower has reliable business income."
- Improper underwriting lane: "The borrower can support the mortgage payment."
When a Separate Engagement May Fit
If the lender needs more than a factual confirmation, the CPA should evaluate whether a formal engagement is possible. A review or compilation may be relevant for financial statements under SSARS. An examination, review, or agreed-upon procedures engagement may be relevant for subject matter under SSAE, depending on the facts.
Agreed-Upon Procedures Example
Suppose a lender wants evidence that a consulting business deposited revenue into a business account during the last six months. The CPA should not turn a tax-preparation relationship into an informal comfort letter. Instead, the parties could consider an agreed-upon procedures engagement in which:
- The responsible party and specified users agree to the procedures.
- The CPA performs only the listed procedures, such as comparing selected bank deposits to invoices.
- The report describes findings without giving an overall assurance conclusion.
- The users decide what the findings mean for the loan.
This preserves the lender's role as decision maker while allowing the CPA to perform a professional service with defined limits.
Client Consent and Confidentiality
Even a factual letter may disclose confidential client information. The CPA should obtain client authorization before sending information to a lender or other third party. The authorization should identify the recipient, the information permitted for disclosure, and the purpose of the disclosure.
Firm documentation should show:
- The original request.
- The client authorization.
- The final letter or response.
- The basis for any factual statements.
- The reason any requested assurance or future-looking language was removed or declined.
Exam Framing
On the CPA exam, a comfort-letter scenario is usually testing professional skepticism, engagement classification, and report language. Watch for verbs such as certify, assure, verify, guarantee, predict, or confirm future income. Those words often signal a service the CPA did not perform.
The best answer usually preserves three principles:
- Do not create assurance from a nonassurance engagement.
- Do not disclose client information without authorization.
- Do not accept the lender's underwriting responsibility.