Accounting Policies and Procedures Template for Tax Firms

Tax firms sit inside an unusual corner of federal law that most practitioners never fully register: the Gramm-Leach-Bliley Act treats them as financial institutions, and the FTC Safeguards Rule binds them on that basis. That classification carries weight. The Safeguards Rule requires any covered financial institution, tax practices included, to maintain a written information security program sized to its own operations, its activities, and the customer information it holds. Once that premise is in place, every section of a tax firm's policies and procedures manual, from workflow to internal controls to record retention to vendor oversight, is a piece of federal compliance law.

The IRS has made that obligation explicit ahead of the 2026 filing season, requiring every tax preparer to maintain a current, documented Written Information Security Plan. When renewing a PTIN, the W-12 form asks practitioners to confirm they are aware of the legal requirement to maintain a data security plan, and the WISP is the document that backs that attestation up. If a firm cannot produce a compliant plan, it faces PTIN suspension, FTC enforcement action, and an inability to prove to a cyber insurance carrier that coverage terms were met. None of what follows in this guide, then, should be read as operational nicety. It is the architecture that keeps a firm licensed, insured, and defensible.

The four structural domains every tax firm P&P manual must address

A complete accounting policies and procedures manual for a tax firm has to cover four distinct structural domains, and a manual built around only one or two of them leaves enforcement exposure sitting in the gaps. The first domain is workflow and transaction procedures, the operational core that spans client intake, the steps of return preparation, sign-off chains, and the calendars that govern deadlines. The second is internal controls: segregation of duties, approval hierarchies, review requirements, and the documentation that proves those controls actually function rather than merely exist on paper. The third domain is data security, embodied in the Written Information Security Plan. The WISP stands as a mandatory document in its own right, but it has to be woven into the broader P&P framework rather than kept as a separate binder nobody else in the firm reads. The fourth domain is record retention, a written policy that reconciles state board rules, IRS requirements, SEC obligations where applicable, and the firm's own professional liability carrier, then selects whichever retention period among them runs longest.

Each of these four domains gets its own treatment in the sections that follow, in the order presented here: workflow first, since it is the domain most firms already have some version of; controls next, since they depend on workflow being defined before they can be verified; data security after that, since the WISP both depends on and extends the control environment; and retention last, since it governs what happens to the records every other domain produces.

Workflow and transaction procedures as the operational spine of the manual

A general accounting P&P manual typically walks through an introduction, a statement of principles and objectives, organizational structure, a chart of accounts, transaction procedures, expense recognition, financial reporting, and closing periods. That framework is a reasonable starting point, but it was not written with a tax practice's specific exposure in mind, and a tax firm that stops there has only half a manual. The workflow section has to be extended to cover the full arc of a client engagement, because the gaps in that arc are exactly where errors and liability accumulate.

Client intake deserves the most attention of any addition. Intake means standardized checklists, document collection protocols, and engagement letter issuance, but it also marks the exact point at which non-public personal information first enters the firm's systems. That moment is a workflow step and a WISP trigger simultaneously. Intake cannot be documented as a purely administrative task. Documenting it is not bureaucratic overhead; it is the first checkpoint at which a firm's data security obligations become live.

From there, the manual needs to specify return preparation workflow in granular terms: who prepares each return, who reviews it, which sign-off chain applies for which return type, how exceptions get flagged, and what happens when a deadline comes under threat. Deadline calendars belong in writing too, covering extension procedures, quarterly estimated tax schedules, and the escalation path when deadlines collide. Delivery and e-filing need their own documented steps: how completed returns reach clients, how e-file authorizations are obtained and stored, and what proof of filing the firm keeps. Post-filing procedures close the loop, specifying how notices, amendments, and client inquiries are received, routed, and answered within a defined window.

Financial Cents' guide to accounting P&P templates describes procedures as the step-by-step instructions that turn broad principles into practical action, the "how" that pairs with the policy's "why". For a tax firm, that pairing only works if the "how" extends all the way through intake, preparation, delivery, and the aftermath of filing, since a manual that stops at generic transaction procedures leaves the firm's most sensitive moments undocumented.

Internal controls that tax firms need to document

A tax firm's internal controls section has to be specific enough that an outside examiner, whether a regulator, an insurer, or an expert witness in litigation, can confirm that what the firm says it does matches what it actually does. An undocumented control offers no protection in an audit or a lawsuit, because there is nothing for the firm to point to.

The manual needs clearly defined processes with a named owner at each step, and it needs management review controls and sign-off procedures that say who reviews at what threshold and what evidence of that review gets kept. Segregation of duties sits at the center of this section: who prepares a return, who reviews it, who approves it, and, just as important, who is barred from occupying two of those roles on the same engagement. Access controls follow naturally from that structure, covering which staff can reach which client files, at what permission level, and how access is granted, changed, or revoked. Any part of the workflow that still depends on spreadsheets or manual data handling needs to be named as a risk in the manual, along with the compensating controls the firm has put in place to offset it. The manual also needs to state how often staff, management, and partners should communicate when control exceptions occur.

Bloomberg Tax's audit-readiness guidance warns that manual, spreadsheet-based processes tend to generate inconsistencies, errors, and gaps that are hard to defend, while standardized, technology-enabled workflows improve data integrity in ways manual processes cannot match. That distinction matters most in litigation, where an expert witness reconstructing what a firm actually did will look first for documentation, not intention.

Small firms often raise a fair objection here: true segregation of duties is impractical when there are only two or three people on staff. The firm should document the limitation rather than pretend it doesn't exist. The manual should name the compensating controls actually in place, such as owner review of every transaction, and explain why that workaround is reasonable given the firm's size. A manual that is honest about its scale holds up far better under scrutiny than a generic one claiming controls the firm cannot actually back up.

What a compliant Written Information Security Plan must contain

A compliant WISP is a structured document built from components mandated by federal law, and each of those components has to be tailored to the firm's actual systems, staff, and risk profile before it carries any enforceable weight. Practitioners can use the mandatory elements as a checklist to self-assess their current plan.

A compliant WISP designates an Information Security Coordinator, a role that in a solo or very small practice is typically filled by the owner directly. It contains a complete inventory of every system and storage location holding taxpayer or client data, covering cloud services, local drives, portable media, and any third-party platform with access to that data. It includes a documented risk assessment identifying the threats facing each category of data and evaluating how likely and how damaging each threat would be. Administrative safeguards belong in the plan as well: employee security training, background check policies, and procedures for cutting off access when staff depart. Technical safeguards cover multi-factor authentication, encryption standards, endpoint protection, network security configuration, and patch management. Physical safeguards address office access controls, clean desk policies, and the secure disposal of physical records and hardware. For vendor oversight, you need a list of every service provider with access to client data, the security representations each one has made, and how the firm checks those representations every year. An incident response plan lays out specific, numbered steps for detecting, containing, and recovering from a breach, including the notification steps the IRS requires and the breach notification deadlines set by state law, which vary materially: California's Civil Code section 1798.82, as amended effective January 1, 2026, generally requires notice within 30 calendar days, subject to exceptions, and no single deadline applies universally across states. Finally, the WISP needs documented evidence that it was reviewed and updated within the prior 12 months.

The most common failure in this domain is not a missing control but a missing record of a control that already exists. A firm can install antivirus software, configure its firewalls correctly, and enable multi-factor authentication across every account, and none of it carries weight with a regulator or an insurer if those measures are never written into the WISP. So in enforcement terms, strong security without documentation reads identically to no security at all. The size of the plan should track the size of the firm: a solo practitioner needs a focused document that satisfies IRS requirements without unnecessary complexity, while a firm running 30 to 50 people across multiple offices needs a more elaborate plan with role-specific controls and clearly documented escalation paths.

Record retention rules a tax firm must translate into written policy

A retention policy cannot just state a number of years and call itself complete. It has to identify every applicable standard, determine which one requires the longest retention period, and document the reasoning behind that choice, because a tax firm answers to several retention authorities at once. Those authorities include IRS requirements governing both client and preparer records, state CPA board or licensing rules that vary by jurisdiction, SEC rules where the firm serves publicly traded clients, whatever minimum the firm's professional liability carrier imposes as a condition of coverage, and the GLBA and FTC Safeguards Rule obligations that require retaining records documenting the WISP's implementation and risk assessments.

The written policy itself needs to specify several things clearly: the categories of records it covers, including engagement files, signed returns, e-file authorizations, client correspondence, training records, and WISP reviews; the retention period attached to each category and which authority drives that period; the format in which records are kept, whether paper, electronic, or both, and where they are stored; who in the firm is responsible for making sure the schedule is actually followed; and the secure disposal procedure that applies once a retention period expires. If the records in question contain non-public personal information, that disposal step is itself a WISP obligation.

Retention policy also carries weight well beyond the filing season. In litigation, a firm's documented procedures can be subpoenaed to show whether records that no longer exist were destroyed on schedule under a written policy or destroyed to conceal them. A documented policy that the firm actually follows is what separates routine records management from spoliation. Jurisdiction-specific retention periods vary enough, across state boards and professional liability carriers alike, that firms should confirm their own standard with counsel or their state board instead of relying on a generic timeline.

AI governance as a required section in a tax firm's P&P manual

Tax practice has changed in a way that most existing P&P templates have not caught up to. Early automation in accounting handled narrow assistance tasks: drafting routine emails, summarizing research, interpreting standards someone else would still apply by hand. The systems now in use in tax practices go further than that, initiating actions, monitoring conditions, and advancing work automatically within rules the firm has defined in advance. A manual written before that shift took hold describes a workflow that no longer matches what actually happens inside the firm, and an inaccurate manual is itself a liability, because it cannot show that the firm's stated procedures match its real ones.

That gap is why AI governance now belongs in the manual as its own section, standing alongside the WISP rather than folded into a general technology policy. The same logic that makes a WISP mandatory, a documented program appropriate to the firm's size, activities, and data, applies just as directly to any automated system that touches client data or return preparation. A firm that lets software initiate or advance tax work without documenting how that software is supervised, reviewed, and corrected has created exactly the kind of undocumented control that examiners and expert witnesses already treat as indefensible in the context of internal controls and the WISP alike. A tax firm's manual earns the word "complete" only when it treats AI governance with the same legal seriousness as data security, because the regulatory logic binding one binds the other.