Key takeaways
- Test the audit trail in a trial with five actions: view, download, share, approve and export.
- Block the transmit step until a signed Form 8879 with its Part III date is attached.
- Mark items Not applicable or Will send later instead of deleting them.
- Roll out one service first, and keep one documented exception path.
What a generic portal leaves out
A generic file portal stores uploads and sends links. A CPA portal also needs to know what each client owes for each engagement and tax year, which items are finished, who on the staff touched each file and what the client signed.
Run the trial with three real clients: an individual with a 2026 return, an S corporation that files Form 1120-S and a monthly bookkeeping client. If the vendor cannot copy the 2026 request from the 2025 one without copying the answers, expect that extra work every season.
Per-client requests with item-level status
Each request should list named items, and each item should carry its own status. An item such as “2026 brokerage statements from every account” moves through To do, Submitted, Redo and Approved. A CPA portal also needs Not applicable, with a reason, and Will send later, with a date.
Decision rule: if the client says an item does not exist, mark it Not applicable and keep the client’s words in the reason field, such as “Closed the account in March.” Do not delete the line. A deleted line disappears from next year’s copy, and no one can show later that the client was asked.
Copy each year’s request with its questions and not its answers. Sensitive answers, such as a full Social Security number typed into a field, should not carry forward.
Set reminders inside the request: one three days before the due date, one on the due date, and a note to the owner once the client has ignored three reminders.
E-signature for engagement letters and Form 8879
An engagement letter needs a signed copy in the client file, with the signer’s name, the signing date and the exact version that was signed. Ask whether the signed PDF is saved to the client folder with its audit record.
Form 8879 is a different case. The IRS describes Form 8879 as the declaration document and signature authorization for an e-filed return filed by an electronic return originator. Under the Practitioner PIN method, the taxpayer authorizes the ERO to enter or generate the taxpayer’s PIN, and the IRS’s manual says a separate Form 8879 must be completed for each individual income tax return that uses that method.
The order matters. The IRS’s manual says the ERO must receive the signed Form 8879 before the ERO signs Part III. Build the workflow so the status “Ready to transmit” needs an attached signed PDF and a date, and the transmit step stays blocked until both exist.
Form 8879-S is the version for Form 1120-S, the S corporation income tax return, and a corporate officer signs it with the ERO. Give it its own item so a missing officer signature shows on the client’s card.
Retention: the IRS’s manual says the ERO must retain Form 8879 for three years from the due date of the return or the IRS received date, whichever is later. The same manual says Form 8879 must not be mailed to the IRS unless requested. A retention setting that applies one period to the whole account is too blunt, so set it by document type.
Audit trail: the five-action test
The audit trail is the evidence that a file went where the firm says it went. Test it in the trial: open one client’s file, view it, download it, create a share link, mark one item Approved, then export that client’s log. A log that is missing any of those five actions fails the test.
Each log line needs the user’s name, the time with a time zone, the action, the item or file name and the IP address. Check that a client upload is labeled as a client upload, so staff can tell it apart from a file the firm placed in the folder.
Keep a dated export at each season close with the Form 8879 PDFs and the engagement letters, for at least the three-year Form 8879 retention period.
Staff roles and folder permissions
A CPA portal needs roles per client, not only per firm. A bookkeeper should see only the clients assigned to them. A reviewer should be able to comment and approve, but not change a client’s answer.
Multi-factor authentication for staff is a rule, not a preference. The FTC Safeguards Rule requires multi-factor authentication for any individual accessing any information system, unless the Qualified Individual has approved in writing the use of reasonably equivalent or more secure access controls, 16 CFR 314.4(c)(5). Ask the vendor to show the staff MFA step in the trial, and to name the factors it enforces for staff logins.
Test removal during the trial. Remove one staff user and check two things: the user’s open sessions end, and the removal appears in the log. Then compare the active staff accounts with the staff roster at each month end.
Decision rule: if a staff member leaves mid-season, reassign that person’s clients the same day and close the old account.
Branded client login and workflow status
The client should see the firm’s name, logo and colors on the sign-in page and in every email. Ask whether email can go out from the firm’s own domain, with SPF and DKIM records the firm publishes.
Failure mode: clients receive a sign-in email from an unfamiliar vendor name, and many call the firm to ask whether it is real. Decision rule: if a client who has never used a portal does not recognize the first email, change the sender name and the subject line before the next wave, then send a test to the same client.
Workflow status should use the same few states the firm already uses: To do, Submitted, Redo with a comment and Approved. Staff need one board showing open items, items waiting for review and overdue items per client, so the owner can see which returns are blocked.
Test the client view on a phone. The client should finish one item without scrolling sideways, and an upload from a phone camera should land in the right item.
Rolling out to clients who resist logging in
Start with one service and the clients who already reply quickly. Send the first portal request for the 2026 year-end bookkeeping items in November or December 2026, before the individual filing season. The IRS lists April 15 as the due date for calendar-year individual filers.
Give the client the reason in their own terms, in a message sent before the first link. For example: “From now on, your bank statements and receipts go through one secure link. You get one reminder before each due date, and the reminders stop when you finish.” Reuse those words for every client.
When a client resists, ask one question: “Which step stops you, the link, the code or the upload?” The answer decides the fix. A link that opens the wrong page needs a corrected link. A code that goes to an inbox the client does not read needs the contact details changed on the client record.
Keep one exception path, and make it a dated record. Staff move an emailed attachment to the client folder the same day and note the reason in the file. Review the exception list at each month end.
Failure modes and fixes
Failure: the portal holds Form 8879 PDFs with no signing date. Fix: make the Part III date a required field, so the status cannot move to Ready to transmit without it.
Failure: last year’s answers are copied into the 2026 request, and the client confirms a bank account that closed in 2025 without reading it. Fix: copy the questions only, and mark each prior answer as to confirm, not as done.
Failure: a client sends a photo of a tax ID form into a general item. Fix: a restricted item for tax IDs and bank details, so only the named preparer can open it, and every open is logged.
Failure: the trial passed under the owner’s login, so no staff account was ever tested. Fix: rerun the five-action test with a real staff login after the rollout, and after every change to roles.