Attorney Trust Account Controls for California Law Firms

An attorney trust account is only as reliable as the controls around it. This guide is about day-to-day trust account management: how money comes in, who approves money going out, how wire fraud is prevented, who can access the account, and how corrections are handled. It assumes the account is already open and focuses on the controls that keep individual ledgers, transaction records, and reconciliations accurate, which is also what CTAPP compliance depends on.

Throughout this guide:

1. Official requirement marks something drawn from the Rules of Professional Conduct, statute, or State Bar sources

2. Best practice marks bookkeeping guidance that is not a formal rule

3. Internal control marks a recommended safeguard for the firm's own procedures

What This Guide Covers?

A client trust account holds money that belongs to clients or third parties. The rules for what goes into one, and when, are covered in our summary of California client trust account requirements. Reconciliation itself is covered in How to Reconcile an IOLTA Account.

This guide covers the layer of trust account bookkeeping for law firms that sits in between: the controls that make sure each transaction is authorized, documented, recorded to the right client, and explainable months later.

The State Bar publishes an optional CTAPP Firm Self-Assessment for internal use. Several controls in this guide track questions it asks, and those are noted where they appear.

The Trust Account Transaction Lifecycle

Every trust transaction should leave a trail from the bank to the client. Each step below is a control point, and each one should leave evidence.

In law firm trust accounting, any step that leaves no evidence is where problems tend to hide. The goal is simple: anyone reviewing the account later should be able to follow a dollar from the bank statement to the journal, to the client's ledger, to the document that explains it.

How Should Client Trust Account Deposits Be Controlled?

Most trust account errors start at deposit: money arrives without a clear client, or it is recorded in the journal but never posted to a client's ledger.

Official requirement: Rule 1.15(d) requires attorneys to notify a client or other person within 14 days of receiving funds in which they have an interest, absent good cause. The State Bar's Handbook on Client Trust Accounting also states that attorneys must not pay out on a client's behalf before the client's deposited funds have cleared.

Internal controls for deposits:

• Identify the client and matter before the deposit is made, not after

• Hold and research any deposit that cannot be tied to a client; do not post it to a general bucket

• Record the deposit in the journal and the client ledger on the same day

• Attach the source document, such as the check copy, wire advice, or settlement statement

• Calendar the 14-day client notice from the deposit date

Card payments: The State Bar's Firm Self-Assessment asks whether payments received through third-party processors are deposited into the trust account, and whether the journal identifies the client for each deposit. If the firm accepts card payments for trust funds, confirm how the processor deposits funds and where processing fees and chargebacks are taken from, so they do not reduce client balances.

How Should Attorney Trust Account Withdrawals Be Approved?

Every withdrawal should be approved by someone with authority, matched to support, and posted to the right client. The approval method depends on the payment type.

Official requirements that shape approvals:

• Rule 1.15 requires the attorney's share of funds to be withdrawn at the earliest reasonable time after the attorney's interest becomes fixed, and any disputed portion to stay in trust until the dispute is resolved

• Rule 1.15(f) creates a rebuttable presumption of a violation if undisputed funds are not distributed within 45 days, with stated exceptions

• The State Bar's Handbook advises never paying out trust money in cash or by checks made out to "cash," and says a trust account should not have ATM access

The Firm Self-Assessment also asks whether the firm confirms disbursement amounts against supporting documentation and lets clients confirm or dispute fees before they are disbursed. Both are worth building into the approval step.

Wire and Payment Fraud Controls for Trust Accounts

Trust accounts are attractive targets for payment fraud because they often hold large balances for short periods, which makes fraud controls a core part of law firm trust accounting. The State Bar's Firm Self-Assessment asks whether staff training includes fraud prevention measures such as procedures to confirm wire transfers.

Internal controls worth adopting:

• Call back on a known number. Confirm any new or changed wire instructions by calling a phone number already on file, never one provided in the same email

• No payment changes by email alone. Treat any request to change payee bank details as unverified until confirmed by phone

• Two people on large payments. One person prepares, another approves and releases

• Bank alerts. Turn on alerts for outgoing wires, ACH debits, and large checks

• Check fraud tools. Ask the bank whether it offers positive pay or similar services that flag checks not issued by the firm

• Train every year. Staff who handle trust payments should know what common payment scams look like

These controls protect clients and the firm. They also create documentation that shows the firm took reasonable steps.

Yes, strong controls can be built even in a two-person firm. Our trust account bookkeeping for law firms includes clear approval and documentation steps. Book a trust account health check or call 949-482-2790.

Segregation of Duties in a Small Law Firm

Segregation of duties, a basic principle of law firm trust accounting, means no single person controls a transaction from start to finish. The State Bar's Firm Self-Assessment asks whether the firm has considered the risk of one person both handling funds and reporting on them.

Official requirement: California Rules of Professional Conduct 5.1 and 5.3, cited in the Firm Self-Assessment, address supervision of other lawyers and nonlawyer assistants. Under the CTAPP rules, the designated licensee for each trust account performs or supervises the monthly reconciliations. Delegating the bookkeeping does not shift the attorney's own obligations.

For solo attorneys: Full separation is not always possible. Compensating controls help: bank alerts on every outgoing payment, a monthly reconciliation prepared by an outside bookkeeper and reviewed by the attorney, and a written log of every approval.

Access and Signer Controls

For any California attorney trust account, who can move money matters as much as how it is recorded.

• Official requirement: The State Bar's IOLTA guidance states that designated licensee information must be updated with the bank within 30 days of a change, such as an attorney leaving the firm

• Best practice: The Firm Self-Assessment asks whether bank signature cards are on file for all trust accounts

• Internal control: Limit online banking roles so staff who record transactions cannot also release payments

• Internal control: Remove a departing employee's bank access on their last day, not at the next review

• Internal control: Review the signer list and online banking users every quarter

How to Review Old Outstanding Checks and Inactive Balances?

Uncashed checks and small balances left on closed matters are easy to ignore and hard to explain later. The Firm Self-Assessment asks whether the firm monitors uncleared checks and inactive client funds and reaches out to payees or clients about them.

A practical review process:

• Each month, list every check outstanding more than 90 days (an internal threshold, not a rule)

• Contact the payee to confirm whether the check was received

• If not, document the contact attempt and decide whether to void and reissue

• List client balances with no activity for an extended period

• Contact the client about the status of the funds

• Record every step in the client trust account records

The State Bar's Handbook states that attorneys are responsible for funds left in the trust account, advises resolving inactive balances promptly, and notes that funds that still cannot be paid out may need to be considered under California's unclaimed property law. Consult current official guidance or counsel before taking that step.

Correction and Change Controls

Corrections to client trust account records are normal. Undocumented corrections are the problem.

Official requirement: The State Bar's Firm Self-Assessment, citing Rule 1.15 and the Rules of the State Bar, asks firms to ensure corrections and adjustments are documented in the trust accounting records and not deleted or removed.

Internal controls:

• Never delete or overwrite a posted trust entry; reverse it and record the correct entry

• Never backdate an entry to make a month balance

• Keep a correction log: date, what was wrong, what changed, who approved it

• Have the responsible attorney approve any adjustment above a set amount

Use accounting software with an audit trail, and keep it turned on

How Controls Show Up in a Three-Way Reconciliation?

The monthly three-way reconciliation is the detective control. It checks whether everything above actually worked. It compares the adjusted bank balance, the trust journal balance, and the total of all individual ledgers. California's trust accounting standards require it monthly, according to the State Bar's Handbook.

A hypothetical, for education only. The trust account shows:

• Adjusted bank balance: $150,000

• Journal balance: $150,000

• Client A ledger: $50,000

• Client B ledger: $35,000

• Client C ledger: $62,500

• Total client ledgers: $147,500

• Difference: $2,500

The bank and journal agree, so a standard bank reconciliation would pass. The individual ledgers do not. The $2,500 may be a deposit recorded in the journal but never posted to a client, which is exactly what the deposit control above is designed to prevent. Until the difference is traced and corrected, the trust account reconciliation is incomplete. Treat it as a discrepancy to investigate, not a conclusion about misconduct.

For the full walkthrough, see 3-Way IOLTA Reconciliation: What Law Firms Need to Know

A Monthly Controls Review

Separate from the monthly bookkeeping, a short controls review checks whether the safeguards on each California attorney trust account are working. These are internal controls, not formal requirements, except where noted.

• Approvals: Pick a few disbursements and confirm each has an approval and supporting document

• Deposits: Confirm no deposit is sitting unassigned to a client

• Wires: Confirm every wire has a callback note

• Access: Confirm the online banking user list is current

• Outstanding items: Review checks older than your internal threshold

• Corrections: Review the correction log for anything unapproved

• Reconciliation: Confirm the three-way trust account reconciliation is complete and signed (official requirement)

For the bookkeeping side of the month, our IOLTA Bookkeeping Checklist for California Law Firms covers the routine tasks.

How Trust Account Controls Support CTAPP Readiness?

Each year, attorneys responsible for client funds register their trust accounts, complete a self-assessment, and certify that they follow Rule 1.15. Strong controls make that certification easier to support, because every California attorney trust account has documented approvals, clean individual ledgers, and signed reconciliations behind it.

CTAPP compliance is the annual reporting layer. Controls are the daily discipline underneath it. If the State Bar selects an attorney for a compliance review, organized client trust account records and a documented control process make the response far more manageable. For the annual steps, see CTAPP requirements for California attorneys, and use our CTAPP compliance checklist to test readiness.

Trust Accounting Works Best When Every Transaction Can Be Explained

The strongest attorney trust account records let anyone trace a dollar from the bank transaction, to the trust journal, to the client's ledger, to the document that explains it. Controls are what make that trail reliable.

Signs your trust account controls need professional attention:

• Several months are unreconciled

• Ledgers do not agree with the account

• Deposits or transfers lack supporting documents

• One person handles every step with no review

• Old balances or outstanding checks remain unexplained

• A staff change left gaps in the records

• The firm is preparing for CTAPP reporting or a review

CTAPP Compliance provides trust account bookkeeping for law firms only. Our IOLTA bookkeeping services include monthly three-way reconciliation, ledger maintenance, shortage and discrepancy alerts, and cleanup of months that have fallen behind. We can serve as the outside reviewer that a small firm's controls often lack. When a firm is selected for a compliance review, we work alongside the attorney to organize records and respond to the CPA firm's requests. Tammy Hoang teaches IOLTA bookkeeping to attorneys and speaks at bar association events on trust account practices. We support your firm's CTAPP compliance work; we do not provide legal advice or guarantee any outcome.

Picture every trust transaction approved, documented, and traceable from the bank to the client file. Let us help your firm put those controls in place. Book a trust account health check, request a quote, or call 949-482-2790.

CTAPP Compliance is not affiliated with or endorsed by the State Bar of California. This article is for general informational purposes and does not constitute legal advice. Consult current State Bar guidance and qualified legal counsel about your specific obligations.