Map the information flow
Tax engagements involve sensitive financial and personal information. Before sending records, ask how the firm wants to receive them, who can access them, and where the files will be stored. A portal link alone does not explain the entire process. Ask about access controls and the method for confirming unusual requests.
Describe your own systems and constraints. If your business has a controller and several owners, the provider should explain how permissions can be assigned without unnecessarily exposing everyone’s information. Keep personal owner documents separate where the workflow requires it.
Ask practical questions
The IRS maintains security resources for tax professionals, including guidance on protecting client information. Use that resource as a basis for questions about the firm’s practices. Ask whether it maintains a written security plan, uses multifactor authentication, and trains staff to recognize suspicious messages.
You do not need to conduct a technical audit to ask how the firm verifies payment instructions or requests for confidential documents. Agree on a known telephone number or another independent verification method for material changes. Avoid relying entirely on instructions inside an unexpected email.
- Which staff and contractors may access records?
- How are permissions removed when personnel leave?
- What is the process for reporting a suspected incident?
Discuss outside providers and AI tools
Ask whether the firm uses outside service providers, subcontractors, or AI tools in its workflow. Request an explanation of what information those tools receive, how access is controlled, and how professional review happens. General claims that a tool is secure do not answer questions about the firm’s actual configuration and process.
If the business has special confidentiality requirements, raise them before signing. The firm may need to adjust its workflow or may not be a suitable provider. Treat this as a scope and operating-model discussion rather than an afterthought after data have been uploaded.
Agree on retention and exit
Ask how long the firm retains documents, how you can retrieve them, and what happens to portal access when the engagement ends. Maintain your own organized copies of filed returns and important deliverables through an appropriate business recordkeeping process.
Document the agreed channel and tell your staff how to use it. Security depends partly on consistent behavior by both sides. A good onboarding process makes secure handling easier than improvised email exchanges.
- Next step: confirm the secure transfer process before uploading returns or identification documents.