A seasonal preparer finishes their last return. Their tax-software account still works, and client files remain on a downloaded-files folder. The busy season ended. The access did not.
Small firms can address this with a short process tied to the actual assignment. You do not need a complicated tracker. You do need someone to own the start and finish.
Which requirements apply?
The FTC lists tax-preparation firms among the businesses covered by its Safeguards Rule. Coverage depends on activities and regulatory jurisdiction, not simply the firm’s label.
Maintaining information about fewer than 5,000 consumers provides exceptions from certain provisions. It is not a blanket exemption. Access safeguards still matter. Confirm your obligations with the person responsible for the firm’s information security program.
1. Approve the assignment and access
Example control wording: The engagement manager approves each seasonal worker’s systems and client access before activation. The approval includes an expected end date.
- Evidence to keep: The approval and account details showing the access granted.
- Check: A returning worker should not automatically inherit last season’s full client list.
2. Check the sign-in protection
Example control wording: The firm verifies the required sign-in protections before a seasonal account receives access to customer information.
- Evidence to keep: The account or policy setting showing enforcement. Keep the check result without storing authentication secrets.
- Check: Enrolling someone in multifactor authentication is not enough if they can still use an unprotected sign-in route.
The FTC requires multifactor authentication for access to customer information on the firm’s systems, unless the Qualified Individual approves an equivalent secure-access alternative in writing. A small team should not treat convenience as that approval.
3. Remove access when the work ends
Example control wording: The manager confirms the access end time. The assigned administrator disables the accounts and checks that access is no longer usable.
- Evidence to keep: The instruction and completion records for the relevant systems. Record any approved extension.
- Check: Include the client portal and remote-access tool, not just tax software. Address active sessions where needed.
If payroll status and engagement dates differ, the manager must resolve which date controls access. Do not wait for an unrelated payroll update to make that decision.
4. Account for working copies
Example control wording: At assignment closure, staff return work to approved storage and handle local working copies under the firm’s retention process.
- Evidence to keep: The closeout confirmation and any unresolved items assigned for follow-up.
- Check: Do not delete the firm’s required tax records merely because a worker has left. Separate official records from unnecessary duplicate downloads.
Keep it manageable
One offboarding ticket can list the systems and who checked each one. Link to completion records instead of copying client information into the ticket.
These examples address seasonal access. They do not replace the firm’s wider security program or its tax-record obligations.
Sources
- FTC Safeguards Rule small-entity guide: coverage, access controls and multifactor authentication.
- 16 CFR 314.6: the limited exception for institutions maintaining information concerning fewer than 5,000 consumers.