Before filing season, inventory every account and system that can reach taxpayer data, then confirm with each owner who still needs access and why. Remove access for former staff and unnecessary vendors, test multifactor authentication and recovery, and document exceptions, owners, and fixes. Finish the review early enough to verify changes before peak workload.
Which accounts and systems belong in the review?
Start with a list of people and systems rather than clicking through settings at random. Include partners, employees, seasonal staff, contractors, and outside providers, along with the services each group can access.
Cover email and collaboration tools, tax and accounting applications, document management, client portals, file storage, remote access, backup systems, and administrative consoles. Applications may use separate identity directories, so do not assume one account list captures every login.
For each system, record a responsible owner, account types, how access is granted, and whether taxpayer data or other sensitive information is available there. Ask vendors to identify any accounts they manage or use to support the firm.
Include administrative, remote-access, and vendor accounts, not just everyday user logins.
Use a simple inventory to keep the review consistent:
- System and business owner
- People, groups, vendors, and service accounts with access
- Data and functions each account can reach
- Administrative or remote-access privileges
- Review decision, exception reason, and follow-up owner
Takeaway: The inventory is complete only when it accounts for every person and system that can reach the firm's work.
How can partners confirm that permissions fit current roles?
Have each partner or department lead confirm who needs access to client files, shared folders, tax applications, and approval workflows. Compare permissions with current responsibilities, not old job titles or last year's staffing plan.
Look for broad access that may have accumulated over time, including firm-wide folders, shared mailboxes, administrator rights, and inherited group permissions. For sensitive client work, check that access is limited to the people assigned to it and that review and approval paths still work.
Shared accounts make it harder to identify who took an action and can complicate offboarding. If a shared credential cannot yet be retired, document the business reason, accountable owner, and date for reassessment.
When reviewing a permission, ask whether the person still performs the related work, whether the access level is necessary, and whether an owner can approve the decision. Review both direct assignments and group-based access so removing one visible permission does not leave the same access in place through another route.
GDS Technology's cybersecurity services can include an account inventory, access and permission review, authentication configuration, lifecycle procedures, and change documentation within an agreed scope. This is technical work, not a legal compliance certification.
Takeaway: Partners should approve access according to current work and explicitly own any exceptions.
What should the firm do about former staff and vendor accounts?
Compare active accounts with current personnel and vendor relationships. Check former employees, departing seasonal staff, and contractors across direct accounts, group memberships, remote tools, application logins, and account-recovery methods.
For each vendor, identify the firm-side owner, the systems the vendor can reach, whether that access remains necessary, and who can disable it. Confirm how access changes are requested and recorded. An account kept "just in case" still needs a reason and an owner.
Make offboarding cover all relevant systems, not only the primary email account. If no one can identify who owns a login, assign someone to resolve it before filing work intensifies. Ask vendors to confirm when their staff no longer need access and include that confirmation in the review record.
Takeaway: Every external or legacy account needs a current purpose, an accountable owner, and a clear removal process.
How should the firm test MFA and account recovery?
Verify multifactor authentication (MFA) for accounts that can reach taxpayer information, especially email, remote access, administrative accounts, and systems used for filing work. Have staff test the actual sign-in flow instead of relying only on a policy or configuration screen.
Check recovery methods, backup authentication options, and who can authorize an account reset. Confirm that recovery contacts are current and that staff know how to get help if a phone is replaced or a sign-in method fails during a deadline week.
Limit who can change authentication settings for privileged accounts. If an application cannot use the standard method, document the affected account, reason, alternative safeguards, approver, and review date. Confirm that the exception does not expose more systems or data than necessary.
A professional services customer described the value of follow-through this way: "GDS followed up the next day to make sure the door sensor issue is resolved. That kind of attention shows real customer service." The example is about a door sensor, not account access; the relevant point is to confirm that a fix held and close the loop.
Takeaway: Authentication is ready when staff have tested both normal sign-in and recovery.
How should the firm record findings and close access gaps?
Keep a concise record of the review date, systems covered, reviewers, decisions, exceptions, and corrective actions. Assign an owner and due date to each issue. Separate urgent access removal from improvements that can safely wait until after the filing period.
Compare the review with the firm's written information security plan (WISP). IRS Publication 4557 and FTC Safeguards Rule considerations may be relevant, but applicability depends on the firm's activities, data, and relationships. An access review supports operational security; it does not prove compliance by itself. GDS's IT compliance services can help firms organize technical review and documentation within an agreed scope.
Before changing permissions, check for workflow dependencies and coordinate with application owners and vendors. A rushed change can interrupt legitimate work, while an untested exception can leave access broader than intended. Make changes early enough to test them before peak workload.
For Atlanta firms, local context does not replace a careful scope review. Georgia data-breach notification requirements may affect response planning, but obligations depend on the circumstances. Ask qualified legal or compliance counsel to interpret the firm's duties, and keep technology decisions aligned with the work staff need to complete.
Takeaway: Close the review with documented decisions, assigned fixes, and a tested support and recovery path.
More on this from Riser Management: No Tenant, No Access: The Anatomy of a Complete Carrier Access Request | Riser.Management by GDS.
Frequently Asked Questions
What access review should a CPA firm complete before filing season begins?
Inventory accounts and systems that can reach taxpayer data, confirm permissions with partners or system owners, remove access for former staff and unneeded vendors, test MFA and recovery, and document exceptions and corrective actions. Include administrative and remote access, not only daily user accounts. Assign owners and verify fixes before workload peaks.
How often should a CPA firm review user access?
Set a recurring review schedule that fits the firm's risk, staffing changes, and operating calendar, and review access when someone joins, changes roles, or leaves. Before filing season, perform a focused check of sensitive systems and exceptions. The right cadence depends on the firm's processes and applicable obligations, so document the rationale.
Should former employees' accounts be deleted or disabled?
Remove former employees' access promptly through the firm's established offboarding process, including application accounts, groups, remote access, and recovery methods. Whether an account is disabled, retained for records, or deleted depends on system and retention needs. Preserve necessary business records under the firm's policies while preventing the former user from signing in.
Does an access review make a CPA firm compliant with the FTC Safeguards Rule?
No. An access review can support security governance and help document how the firm manages permissions, but it does not establish compliance by itself. The FTC Safeguards Rule's applicability and requirements depend on the firm's activities and circumstances. Review the firm's WISP and consult qualified compliance or legal counsel about its obligations.
What should a firm do if it cannot confirm who owns an account?
Record the account, the systems or data it can reach, and the uncertainty. Restrict or remove access only after checking operational dependencies and authorization, then assign a firm owner to resolve the question with the relevant application provider. Do not leave an unidentified account as an informal exception through filing season.
Follow GDS Technology on Facebook, and subscribe on YouTube for new videos.
