Skip to main content

Updated 3 min read

Tax Season IT Checklist for Accounting and Tax Firms

The short answer

Do the IT work in the fall, not in February. Before January, update and test your tax software, put MFA on everything, set up seasonal staff with their own accounts, prove your backups restore, add a backup internet line if you can't afford a day offline, and bring your written security plan (WISP) up to date.

Between late January and mid-April, nobody in a tax practice has time for IT. A computer that takes ten minutes to start, a tax software update that breaks a printer, or a morning without internet costs far more in March than it would in November. Most of what goes wrong in season can be found and fixed in the fall.

This is the list we work through with tax and accounting firms before the rush.

Tax software and computers

  • Install the new year’s tax software early on one machine and test it with a sample return before rolling it out. Drake, Lacerte, UltraTax, ProSeries and CCH all publish system requirements, and they change from year to year.
  • Replace the slowest computer now. If someone already waits on their machine, season will make it worse.
  • Check printers and scanners with the new software, and keep spare toner and a spare scanner cable on hand.
  • Have one spare laptop ready, set up and updated, so a failed machine costs an hour rather than a day.

Sign-ins and staff

  • Multi-factor authentication (MFA) on everything: email, tax software, the client portal and any remote access. Many account takeovers start with a password that leaked somewhere else, and MFA stops them.
  • Every seasonal worker gets their own account, with access to only what they need. No shared logins.
  • Write down when each seasonal account ends, and switch it off on that date.
  • Remove anyone who has left since last season from every system they had.

Backups

The firm’s most important data piles up during season, which makes it the worst time to find out the backup doesn’t work.

  • Restore something real from backup before January: a client folder and the tax software’s data. If it doesn’t come back cleanly, fix that first.
  • Make sure one copy is off site and can’t be changed or deleted by someone who gets into your network.

Email and client documents

Tax season is when criminals pose as new clients, the IRS and software vendors.

  • Send returns and statements through a secure portal, not as email attachments.
  • Remind staff about the usual tricks: a “new client” sending an attachment or a link, an urgent message from the IRS, a request to change bank details. Confirm anything unusual by phone, using a number you already have.
  • Turn on your email system’s built-in protections for links and attachments if they aren’t on already.

If a fake “client” email does get someone to sign in or open something, here’s what to do straight away.

The internet line

If the office can’t work without the internet, a single line is a risk in season. A backup internet line from a different provider, often 5G, plugs into your firewall and takes over by itself when the main line drops. It’s quick to add in the fall and hard to arrange in March.

Your WISP

The IRS expects every paid preparer to keep a written information security plan, and the PTIN renewal form asks whether you’re aware of that requirement. The FTC Safeguards Rule requires one too. Fall is the time to bring it up to date: new staff, new software, anything that changed during the year. Our guide to the FTC Safeguards Rule explains what it needs to cover, our WISP guide walks through writing one, and the IRS’s Publication 4557 sets out the safeguards it expects. The IRS also keeps a short Taxes-Security-Together Checklist that’s worth running through alongside this one.

If you’d like a broader look at where firms usually come up short, see the seven IT gaps we find most in accounting firms.

We help tax and CPA firms across Orange County get ready for season, and we’re still there in April when something breaks, so it gets fixed while you keep working. See how we look after accounting and tax firms, or book a free IT check-in and we’ll talk through what your firm needs before January.

This checklist is general information, not legal advice. For questions about your firm’s specific obligations, talk to your attorney or compliance advisor.

Sources

  1. About Form W-12, IRS Paid Preparer Tax Identification Number (PTIN) Application and Renewal (IRS)
  2. Tax Security 2.0: The Taxes-Security-Together Checklist (IRS)
  3. IRS Publication 4557, Safeguarding Taxpayer Data
  4. FTC Safeguards Rule: What Your Business Needs to Know (FTC)

Frequently asked questions

When should we start getting our IT ready for tax season?
October or November is ideal. That leaves time to replace a slow computer, fix anything the backup test turns up and get seasonal staff set up, without taking anyone away from client work once returns start coming in.
Can seasonal staff share a login?
They shouldn't. Shared logins make it impossible to tell who did what, and the FTC Safeguards Rule expects access to customer information to be limited to the people who need it. Give each person their own account with MFA, then switch it off when the season ends.
What scams target tax firms during the season?
The most common are emails posing as a new client with a 'tax document' attachment or link, fake messages from the IRS or your tax software vendor, and requests to change where a refund or payment goes. Anything that asks you to sign in, open an unexpected attachment or change payment details deserves a phone call to confirm, using a number you already have.
Do we really need a WISP?
Yes. The IRS expects every paid preparer to have a written information security plan, and the FTC Safeguards Rule requires one for firms that handle customer financial information. A short, accurate plan that matches how your firm actually works is better than a long template nobody follows.

Related reading