The One Rule Above Any Audit Tool: Never Touch Client Funds

Preparers are prohibited from endorsing or depositing a client's refund check, and refund advance or bank product arrangements, where they exist, run through a separate, regulated banking relationship, not the firm's own operating account. If a firm's own bank account ever touches client refund money directly, that's a Circular 230 and, depending on the state, a licensing issue to resolve with a compliance attorney immediately, not a control to document and monitor going forward.

Once that boundary is confirmed clean, the firm's own financial reconciliations, revenue, WIP, security spend, are what FloQast or AuditBoard actually apply to.

Tax preparation revenue swings hard around filing deadlines, and firms that bill flat fees per return versus firms billing hourly for complex multi-state or advisory work need different recognition treatment. A flat-fee return is typically recognized when the work is substantially complete, while advisory hours recognize as worked, and mixing the two into one undifferentiated revenue number makes it hard to tell which service line is actually profitable.

Reconciling WIP and unbilled fees against actual hours or returns completed, every month, not just at the two annual filing deadlines, is close-process work, and it's exactly the kind of repeatable check close management software handles well during a season when staff bandwidth for anything beyond client work is thin.

The IRS's Security Six is a set of recommended baseline controls, and the FTC Safeguards Rule, which covers tax preparers, requires a Written Information Security Plan that documents controls protecting client tax data, such as access controls, encryption, multi-factor authentication, and an incident response plan. That's a data security control framework, separate from financial statement controls, and it's a real, enforceable requirement for any firm that e-files returns.

While neither FloQast nor AuditBoard is built specifically for WISP compliance, a GRC platform can be a reasonable place to document and test the plan's required controls on a schedule once a firm is large enough that an IT consultant alone can't track it, since the underlying discipline, mapped requirements, tested and evidenced, is the same pattern either way.

Picture a corporate client's multi-state nexus study that gets invoiced in full at project kickoff, before the state-by-state analysis work is actually complete, because cash flow during a slow month made the early invoice appealing. If the engagement stalls or scope changes partway through, the firm has recognized revenue for work it hasn't delivered, and unwinding that at year end is far messier than recognizing it correctly as the work progressed.

A reconciliation that ties recognized revenue to actual work completed, not invoice timing, catches this the same month it happens, protecting both the firm's own numbers and its standing if a client or reviewer ever questions the billing.

Confirm refund-handling and WISP compliance are airtight first, since those carry professional and regulatory risk no accounting software addresses. From there, if busy-season WIP and revenue recognition are the source of the most internal confusion, close management software is the higher-value fix, since it's the discipline protecting the firm's own numbers through the most volatile months of the year.

A formal GRC platform becomes worth it mainly once the firm is large enough to need documented, tested evidence across multiple compliance obligations at once, WISP, engagement quality, and financial controls, rather than tracking each informally.

Work through the priorities in this order:

1. Confirm the firm never endorses, deposits or otherwise handles a client's refund, and resolve any exception with a compliance attorney immediately.
2. Verify the Written Information Security Plan is current and covers access controls, encryption, multi-factor authentication and incident response.
3. Monitor the firm's EFIN for unauthorized use, and require multi-factor authentication on tax preparation software before filing season starts.
4. Separate flat-fee return revenue from hourly advisory revenue so each service line is recognized under its own timing.
5. Move to close management software once busy-season WIP and revenue recognition cause the most internal confusion.

The IRS's e-file requirements go beyond having a written plan on file: firms are expected to monitor their EFIN for unauthorized use, since a compromised EFIN can be used to file fraudulent returns under the firm's own credentials, and to require multi-factor authentication on tax preparation software, since phishing attempts targeting preparers spike predictably every filing season.

Build a short recurring checklist, EFIN activity review, multi-factor authentication enforcement, staff phishing awareness, into the same cadence as the firm's other close and compliance tasks, rather than treating data security as a one-time setup task completed once and never revisited.