Access controls for accounting firm staff, step by step

Access controls for accounting firm staff decide who can open which client files and systems. Write down each role, give every person their own login with only the access that role needs, review the list on a fixed schedule, and remove access on a staff member's last day. The FTC Safeguards Rule requires covered firms to have access controls.

Mapping firm roles to client folder access

Mapping roles to access means writing down, for each job in the firm, which systems and client folders that job needs, and granting access by role rather than by person. In a small firm the usual roles are owner, preparer, reviewer, administrator and seasonal staff. Each person gets the access of their role and nothing extra.

The rule behind this is specific. The FTC Safeguards Rule, at 16 CFR 314.4(c)(1) on eCFR (current as of October 2026), requires covered firms to implement and periodically review access controls that "Authenticate and permit access only to authorized users" and "Limit authorized users' access only to customer information that they need to perform their duties and functions." IRS Publication 4557, Safeguarding Taxpayer Data (Rev. 6-2024) says the same in shorter words: "Limit access to taxpayer data to individuals who need to know." The rule lists tax preparation firms among the financial institutions it covers, in 16 CFR 314.2.

Start with systems, not folders. List every place client data lives: the tax software, the file storage, the email system, the bookkeeping software, the document intake tool, the firm's IRS e-Services accounts and any client portal. Then decide, role by role, what each needs.

An example access matrix for a five-person firm

This matrix is for a fictional five-person firm, Example Ridge CPAs. The systems and roles are generic; replace them with the firm's own.

Three things make the matrix useful. Each cell names a level, not a yes or no. Assigned clients are listed somewhere the firm can check, so "assigned" means something. And only one person can add users, so access cannot grow quietly.

Folder structure has to support the matrix. If every client sits in one shared folder, "assigned clients only" is impossible to enforce. The organizing client files category covers folder layouts that make per-client permissions practical.

Least privilege for seasonal and remote accounting staff

Least privilege means each person gets the minimum access needed for their current work, for only as long as they need it. For seasonal and remote accounting staff it has two parts: narrower rights than year-round staff, and accounts that expire on a set date. Temporary help should never inherit a departed employee's account or a colleague's login.

Seasonal staff are the hardest case because they arrive in a rush. The easy path is to copy an existing user's permissions, which usually gives a data-entry hire access to every client the copied preparer ever touched. Build seasonal access from the matrix instead: a seasonal role, a list of assigned clients, and an end date.

Put the end date on the account itself where the system allows it, and on the firm's calendar where it does not. An account that expires on April 30 removes itself even if nobody remembers. One that relies on memory tends to stay active until someone notices in August.

Remote work adds devices to the picture. Publication 4557 (Rev. 6-2024) suggests firms "Develop policies for employees who telecommute," including "whether or how employees should be allowed to keep or access customer data at home," and requiring protection on personal computers used to store or access customer data. A practical version: remote staff work through the firm's systems, not from local copies, and personal devices hold no client files.

Multi-factor authentication is the other half. 16 CFR 314.4(c)(5) requires multi-factor authentication "for any individual accessing any information system," unless the Qualified Individual approves an equivalent control in writing. The post on multi-factor authentication for tax professionals covers which accounts to start with and how to roll it out.

Small firms sometimes assume the rule's lighter requirements cover all of this. 16 CFR 314.6 exempts firms that maintain customer information on fewer than five thousand consumers only from 314.4(b)(1), (d)(2), (h) and (i): the written risk assessment, penetration testing and vulnerability scans, the written incident response plan and the annual board report. Access controls, MFA and activity logging still apply.

How often should a firm review staff access?

A staff access review compares who actually has access to each system against the firm's access matrix and removes anything that does not match. The rule says "periodically" without naming an interval. A quarterly review works well for a small firm, plus an extra one right after tax season, when seasonal accounts and temporary changes pile up.

The FTC's guide, FTC Safeguards Rule: What Your Business Needs to Know (December 2024) puts it simply: "Determine who has access to customer information and reconsider on a regular basis." A quarterly date on the calendar turns that into a task with an owner.

A review is quick when the matrix is current, because each system becomes a comparison against one row. Check these items:

• Every active account belongs to a current person. Look for departed staff, seasonal hires past their end date and test accounts.
• Every person's access matches their role. Look for extra client folders, admin rights granted "just for a day," and access left over from a role change.
• Assigned-client lists are current. A preparer who handed a client to a colleague should no longer see that client.
• Shared links are still needed. File storage often has links shared with outside parties; close the ones whose purpose has passed.
• Activity logs show nothing odd. 16 CFR 314.4(c)(8) requires controls to "monitor and log the activity of authorized users." Publication 4557 (Rev. 6-2024) also recommends audit trails showing "who performed the activity, when it was performed, and what changes were made."

Record the review: date, who did it, what was found and what was changed. The firm's written information security plan should say how often reviews happen and who does them; the post on the WISP for tax preparers covers what that plan contains. The tax season workflow category covers fitting reviews like this into the season's calendar.

Offboarding a staff member on their last day

Offboarding is the set of steps that removes a departing staff member's access to every system, device and shared link. Do it on the last day, ideally within an hour of the person leaving, in a fixed order so nothing is missed. Publication 4557 tells firms to deactivate a terminated employee's passwords and user names immediately.

The IRS wording, in Publication 4557 (Rev. 6-2024), is to "Prevent terminated employees from accessing customer information by immediately deactivating their passwords and user names and taking other appropriate measures." The checklist below puts that in order. Example names are fictional.

Offboarding checklist (example: Tess, seasonal preparer, last day April 30)

1. Disable the main sign-in first. If the firm uses one identity for email and storage, disabling it cuts off most systems at once.
2. Disable accounts in each other system on the matrix: tax software, bookkeeping software, document intake tool, firm bank or payroll.
3. Sign the person out of active sessions and revoke saved app passwords or tokens, so an open laptop or phone loses access.
4. Remove MFA devices registered to the account, so a personal phone cannot approve sign-ins later.
5. Collect firm devices: laptop, phone, security keys, USB drives, building keys or cards.
6. Check personal devices that held firm email or files, and confirm firm data is removed.
7. Transfer ownership of files and shared links the person created, then close links that are no longer needed.
8. Forward or convert the mailbox so client email reaches a current staff member, and set a reply telling clients who to contact.
9. Change any shared secrets the person knew, such as a door code or a Wi-Fi password.
10. Record the date, time and who completed each step.

Devices returned at offboarding eventually need wiping before reuse or disposal. The post on secure document destruction for accountants covers sanitizing laptops and drives.

Are shared logins ever acceptable in an accounting firm?

Shared logins, where two or more people use the same username and password, break the link between an action and a person. When something goes wrong, the activity log shows the account, not who used it. Publication 4557 tells firms to prevent password sharing and give each employee with access to taxpayer accounts a unique password.

The IRS position is plain. Publication 4557 (Rev. 6-2024) says to "Prevent password sharing; ensure each employee with access to taxpayer accounts uses a unique password," and in its password advice says "do not share password among employees." The Safeguards Rule's logging requirement in 314.4(c)(8) depends on it: a log of "authorized users" means little when three people are one user.

Shared logins also defeat offboarding. When a departing employee knew the shared password, every remaining user has to change their habits along with the password, and in a busy week that tends not to happen.

Some systems still push firms toward sharing, for example a tool licensed for one seat or an office device with a single admin account. When that happens:

• Check whether the system offers named users before assuming it does not; plans and settings change.
• Keep the shared credential in a password manager with access limited to the people who need it, rather than on a sticky note.
• Log who used it and when in a simple sheet, so there is still a record tied to a person.
• Change the password whenever someone with access leaves.
• Note the exception in the security plan, with the reason and the date to revisit it.

Schema CPA's plans are priced per firm, not per client, and each names the firm size it is meant for, from one preparer on Solo to up to 20 staff on Practice, which adds review queues by preparer; the pricing section of the homepage lists them. Whatever tools the firm uses, the access matrix should name every person who can open client documents in each one.