Before tax season, CPA firms should verify: tax software is updated and licensed for the new filing year, all workstations meet minimum hardware requirements for current software, backup and recovery has been tested recently, MFA is enabled on all remote access, client portal is functional, printers and scanners are operational, and all staff have completed security awareness training. Address any gaps before January — not during peak season.
Why Tax Season Creates Unique IT Risk
CPA firms face an IT risk profile that's unlike other professional services: their work is intensely seasonal, deadline-driven, and high-stakes. An IT outage in October is frustrating. An IT outage during the first two weeks of April can cost tens of thousands of dollars in overtime, missed deadlines, and client penalties.
The firms that handle tax season without IT drama are the ones that audited and fixed their IT in October and November — not the ones scrambling to upgrade software while clients are calling.
Tax Software Readiness
- Year rollover: Confirm your tax software (Drake Tax, CCH Axcess/ProSystem fx, UltraTax CS, Lacerte, ProConnect) has released and you've installed the new-year version. Some platforms require a separate license activation for the new year.
- E-file activation: IRS e-file acceptance for the new year requires re-enrollment or reactivation on some platforms. Verify your EFIN is active and your e-file connection is working before the first returns are ready to transmit.
- State updates: State tax forms are released on varying schedules throughout January and February. Verify your software has state updates set to automatic or check for updates daily during peak season.
- License seat count: If you've added staff, verify your license covers the new user count. Running unlicensed software is a compliance issue — and some platforms enforce limits in ways that block access during peak periods.
Hardware Readiness
- Workstation performance: Tax software is increasingly resource-intensive, particularly PDF-heavy workflows (Drake PDF, GoFileRoom, Lacerte document management). Workstations with less than 8GB RAM or spinning hard drives create performance bottlenecks. Add RAM or SSD upgrades before season — they're cheap compared to lost time.
- Printer health: Print heads, fuser units, and toner levels should be checked before volume increases. A printer failure during April extension season creates immediate client service problems.
- Scanner condition: Document scanners used for client document intake (Fujitsu ScanSnap, Canon imageFORMULA) have maintenance intervals. Clean rollers, verify calibration, and have a backup scanner available.
- Second monitor availability: Tax preparers working with one monitor during peak season are noticeably less efficient. If your team doesn't have dual monitors, this is a low-cost investment with high return.
Remote Access and Client Portal Readiness
- VPN for remote preparers: Preparers working from home or satellite offices need reliable VPN access to office systems (tax software servers, file shares). Test this before January — not on the day a snowstorm keeps everyone home.
- Client portal: Verify your client portal (Sharefile, TaxDome, Canopy, SmartVault) is working correctly for client document upload. Send test invitations to verify the client experience. A client who can't upload their documents through your portal will default to email — which creates security and tracking problems.
- Organizer delivery: If you send digital tax organizers, verify the delivery mechanism and test the client-facing workflow in November, not February.
Security Readiness (FTC Safeguards Rule)
The FTC Safeguards Rule (updated 2023) requires tax preparers to implement a comprehensive information security program. Tax season is when the security vulnerabilities are most consequential — attackers know that tax preparer credentials are valuable during filing season for fraudulent return filing.
- MFA on IRS systems: The IRS requires MFA for all tax professional e-services accounts (e-file, Transcript Delivery, IRS e-Services portal). Verify all staff have MFA configured and can access these systems.
- EFIN protection: Your EFIN (Electronic Filing Identification Number) is a high-value credential for fraudsters. It should be protected by strong credentials, MFA, and limited to staff who actually need it.
- Phishing awareness: Tax season phishing emails targeting CPA firms spike in January–April. These include fake IRS communications, fake client document requests, and fake software vendor notifications. Brief staff on specific seasonal phishing patterns.
- Data at rest encryption: Client financial data on workstations and servers must be encrypted per the Safeguards Rule. BitLocker on Windows and FileVault on Mac should be enabled and recovery keys escrowed with IT.
Backup Verification
- Confirm your most recent backup completed successfully and contains current data
- Test restoration of a client file from backup — don't assume it works
- Verify offsite or cloud backup is current and accessible
- Confirm your IT provider's response time for an emergency during peak season — get a commitment in writing before January
Your accounting IT provider should proactively complete this checklist with you in Q4, not wait for problems to emerge during tax season.
Frequently Asked Questions
When should CPA firms start their pre-season IT prep?
October and November are ideal. This allows time to order hardware, get software updates installed and tested, and address any issues discovered without the pressure of live client work. Trying to fix IT problems in January or February means working around staff who are actively billing.
What do I do if my tax software server crashes during tax season?
Contact your IT provider immediately — this should be treated as an emergency. Your IT provider should have your tax software backup plan documented in advance. If your server cannot be restored quickly, options include temporary cloud access to your tax software (most major platforms have emergency cloud access provisions) or borrowing workstations with local installations. Document your continuity plan before season, not during it.
Does the IRS require two-factor authentication for tax professionals?
Yes. The IRS requires multi-factor authentication for all IRS e-services accounts including e-file, the Transcript Delivery System, and the IRS Online Account. IRS Identity Protection PINs (IP PINs) are also available for additional protection. This is a requirement, not optional.