Busy filing weeks are a poor time to discover a former seasonal worker still has access to a client portal, or that nobody knows who can act under the firm’s business CAF. A short November review gives a small tax or accounting office time to verify people, systems, and responsibilities before the workload builds.

On October 20, 2026, the IRS reminded tax professionals to keep account information current and review client authorizations. It also notes that firms can manage business CAF access, including specifying which employees are authorized to act under it. This practical first pass is aimed at CPA and tax offices in Goshen and the Hudson Valley. It is not evidence of a local incident or a substitute for legal or compliance advice.

Start with a simple access register

Ask the person who administers your systems to produce a current user list for each important service. A roster from the admin console is more reliable than relying on memory. Keep the register short: system, user, role, business owner, and whether the access is still needed. Do not copy taxpayer or client records into it.

Include the services that can expose or move client data, not just the tax software:

  • Tax-preparation and e-file platforms, plus any business IRS Tax Pro Account or business CAF access the firm uses.
  • Business email, cloud file storage, client portals, e-signature, and document-transfer tools.
  • Remote access or VPN, payroll and bookkeeping systems, backup administration, and password-manager accounts.
  • Employees, seasonal staff, contractors, former staff, and vendor accounts with ongoing access.

Sources: IRS: Security reminders and tools for tax pros (Tax Tip 2026-75, October 20, 2026); IRS Publication 4557: Safeguarding Taxpayer Data

Reconcile IRS authority separately from software logins

In the IRS Tax Pro Account, a tax professional business can manage business CAF access and specify which employees are authorized to act under that CAF. If your firm uses this feature, compare the authorized-employee list with the people currently assigned those responsibilities. Review client authorizations as well; an IRS authorization and a login to tax software are separate things.

Do not remove access just because a name is unfamiliar. Have the firm owner or designated tax professional confirm who is handling current client work, then route any needed changes through the authorized account administrator. This avoids both stale access and a last-minute interruption for an active return.

Sources: IRS: Security reminders and tools for tax pros (Tax Tip 2026-75, October 20, 2026)

Prioritize email, files, remote access, and administrators

CISA’s small-business guidance recommends enterprise-wide multifactor authentication and calls out email, file storage, remote access, privileged accounts, and people handling sensitive data as useful priorities. Start by checking whether MFA is actually required on these services, and whether any exception has an owner and a reason.

Use the strongest MFA option the service supports, ideally a phishing-resistant method when available. CISA ranks security keys among the strongest options and describes text or email codes as weaker. For firms covered by the FTC Safeguards Rule, MFA is required for people accessing customer information unless the Qualified Individual approves an equivalent form of secure access controls in writing. Confirm the rule’s application and any exceptions with your compliance adviser.

Sources: CISA: Require Multifactor Authentication; FTC: Safeguards Rule: What Your Business Needs to Know

Close gaps with an owner and a date

For any account that is no longer needed, assign the change to the system administrator or provider. The closeout should cover the login, group memberships, active sessions, and any connected application or recovery method tied to that person. For a current employee who only needs a narrower role, document the new scope rather than sharing another person’s credentials.

Before a seasonal worker or contractor leaves, use the same process while their manager is available to confirm work handoff. Record the decision, owner, and completion date. Keep sensitive access details in the firm’s approved system, not an open spreadsheet or an email attachment.

Finish with a short list of unresolved items and a review date. The FTC Safeguards Rule also calls for controls to monitor authorized users’ activity and detect unauthorized access for covered institutions. A once-a-year roster is a start, not a replacement for the firm’s ongoing security program.

Sources: FTC: Safeguards Rule: What Your Business Needs to Know; IRS Publication 4557: Safeguarding Taxpayer Data

A template can help document the work

If your tax or accounting office needs a place to document its safeguards, FIX256 currently lists its CPA & Tax Firm WISP Kit at $59 as a one-time purchase, with an editable DOCX, matching PDF, and README. It is a fill-in starting point that requires customization, not a compliance guarantee; FIX256 says it is not affiliated with or endorsed by the IRS or FTC. Offer details checked November 6, 2026.

Other professional offices can use the account-review steps as an operational starting point, but legal and regulatory duties vary by industry and type of information handled. Confirm your firm’s specific obligations with a qualified adviser.

Sources: FIX256: CPA & Tax Firm WISP Kit (current offer); IRS: Security reminders and tools for tax pros (Tax Tip 2026-75, October 20, 2026); FTC: Safeguards Rule: What Your Business Needs to Know