Accounting

Client information and the CPA firm: what the obligations look like day to day.

Every accounting practice knows that client information is confidential. Fewer have thought through how that principle shows up in the small decisions of an ordinary week: how a return reaches a client for review, how a bank statement arrives from a client, who in the firm can open which folder, and what happens to files when an engagement ends.

This article outlines the main sources of obligation that US CPA firms and tax preparers commonly discuss with their advisors, then turns to the practical habits that put them into effect. It is general information, not legal advice. Your attorney and your professional body can tell you what applies to your practice.

The sources of obligation

Several overlapping sources shape how a US tax and accounting practice handles client information. The ones most practices hear about are these:

Professional ethics. The AICPA Code of Professional Conduct includes a confidential client information rule for members, and state boards of accountancy have their own rules for licensees.
Tax return information. Federal law restricts how tax return preparers may use and disclose tax return information. The rules have specific consent requirements, which is a topic for your attorney.
The FTC Safeguards Rule. The rule applies to tax preparers and requires a written information security program with safeguards for customer information.
IRS guidance. The IRS publishes guidance for tax professionals on safeguarding taxpayer data, including practical security steps.
State law. Every state has data breach notification rules, and some states have broader privacy laws that may reach a firm depending on its size and clients.

The details of each, including which apply to you and what they require, are matters to confirm with your attorney. What they have in common is simple: know where client information is, control who can reach it, and be able to show what you did.

Habit 1: know where client documents live

It is hard to protect information you cannot locate. In many firms, a single client's documents are spread across the tax software, a shared drive, several inboxes, a few laptops' download folders and a phone or two. A written security program is much easier to write, and to follow, when the answer to "where are this client's files?" is one place.

A data room per client or per engagement gives that answer. Documents arrive there, are worked on from there, and are delivered from there.

Habit 2: collect documents without email

Email is the most common way client documents enter a firm, and the least controlled. Every attachment creates copies in places the firm does not manage.

ShareAndGo document request lists let the firm list what it needs, assign items to the client, and share a public request-a-file link so the client uploads straight against each item. Every upload is scanned for viruses before anyone can open it, and the list shows what is still outstanding.

Habit 3: deliver to a verified person

When a return or financial statement goes to a client, their attorney or their lender, the firm should be confident it reached the right person. In ShareAndGo, recipients verify their email address with a six-digit code before they see anything. Invitations have an end date, can be extended in one click, and can be revoked at any time.

If the recipient only needs to read, view-only access means PDFs, Word, Excel and PowerPoint files are rendered and watermarked on our side, and the original file is not sent to their browser. Watermarks carry the viewer's name, email address and the date.

Habit 4: limit access inside the firm

Not everyone at the firm needs every client. Groups let a room show different folders to different people, and team members sign in through MyAndGo with Google, Microsoft or email, with two-step verification and session timeouts the firm sets. When staff leave, removing them from the workspace ends their access to the firm's rooms.

Habit 5: keep a record

If a client, a regulator or your insurer ever asks what happened to a document, the answer should come from a record rather than memory. ShareAndGo's audit log records every view, upload, download, invitation and change. Entries are chained so alterations are detectable, and the log exports as CSV for the engagement file.

Habit 6: close engagements cleanly

When an engagement ends, revoke outside access, export what the firm needs to keep, and delete what it does not. A room exports as a ZIP with its folder structure and an index of every document, as PDF and CSV. Deleting a document from the recycle bin removes the stored file and its previews. Your retention schedule, set with your advisors, decides what to keep and for how long.

Putting it into the written program

If your practice already has a written information security program, the habits above are worth describing in it plainly: where client documents are kept, how they are collected and delivered, who can reach them, and how activity is recorded. If it does not yet have one, the IRS guidance for tax professionals and your advisor are the place to start. A tool can support the program. It cannot be the program.

Common questions

Does using a data room satisfy the Safeguards Rule?

No tool satisfies a rule by itself. A data room can support parts of your program, such as access control and activity records. Ask your attorney what your program needs.

Can clients upload without an account?

Yes. They use a request-a-file link, or verify their email with a six-digit code to enter a room.

Who decides what we may disclose to a client's lender?

Your firm's policies, the client's consent and your attorney's advice.