CPA document access: five checks when a reviewer changes

A seasonal reviewer finishes an assignment. Another person takes over. The documents are still in the folder, the exceptions still need answers, and a prior reviewer may still have a link open in a browser.

Who can act on the evidence now? Who should no longer be able to see it? Can the new reviewer understand the outstanding decision without giving the old reviewer continuing access?

Those questions belong in the same workflow as preparation readiness. A file can be ready for a particular stage while the access surrounding it needs attention.

Our preceding article on who owns the tax file readiness decision proposed an evidence set, open exceptions, a responsible owner, an accepted next stage and a change rule. This installment adds a practical test: change the person responsible for the work and inspect what happens to access and ownership together.

Security controls need a workflow test

IRS Publication 4557 recommends limiting taxpayer-data access to people who need it and keeping records of who acted, when and what changed. The FTC's business guide describes periodic access review, an inventory of the information environment and monitoring of authorized activity. These primary sources support testing access as responsibilities change. They do not prescribe the five checks below or certify a particular product.

This exercise complements a firm's written security program and professional review. It does not determine the firm's legal obligations, retention period or incident-reporting decision.

Start with a fictional assignment

Use a synthetic organizer, two fictional supporting documents and one unresolved question. Create the test only in an authorized demonstration environment, with fictitious users or accounts approved for the exercise. Never experiment by changing a live client's access or removing a colleague's production permissions.

Before changing anything, record which user can open each source, which work is assigned to that person and which decision remains open. Then have the authorized administrator perform the reassignment and access change through the normal controls.

Do not assume that removing an assignment removes access. Do not assume that removing a folder link removes every other route. Observe the result separately.

Five checks to run

1. Source access. Can the former reviewer still retrieve the fictional source through the ordinary document view or a previously saved link? The expected result should follow the firm's authorized policy. Record the user, route, time and observed result; a hidden button is not proof that access is denied.

2. Work ownership. Does the unresolved question have a new named owner? Can that person see why it is open and which source version it concerns? Removing access must not silently orphan the work or turn an unanswered question into a resolved one.

3. Derived context. If the workflow includes search, extracted fields, summaries or AI-assisted answers, test the former user's ordinary access to those views as well. A source can be restricted while a derived summary remains visible. This is a test requirement, not a claim that a particular system has that defect or already enforces every check.

4. Prior exports. List the copies intentionally downloaded during the synthetic exercise. Revoking future server access does not, by itself, erase an ordinary downloaded copy. Distinguish access controls from endpoint handling, retention and disposal procedures. Do not promise that a vault can retrieve every copy once shared.

5. Inspectable history. Can an authorized reviewer explain the old assignment, the access change, the new owner and the remaining exception? Preserve the permitted history needed to understand the handoff while applying the firm's access and retention policy. Do not confuse an audit entry with proof that all access paths were tested.

Use results to make one decision

Finish with a short record: expected access, observed access, open work, new owner and next verification step. A failed or uncertain check should stay visible until the responsible person reviews it.

Suggested measures include unowned exceptions after reassignment, unexpected accessible views, time to establish the new owner and incomplete test evidence. Agree on a baseline and success criterion before a tool evaluation. These are proposed measures, not measured improvements from TaxFlo.

Where TaxFlo and SafeVault fit

TaxFlo supports guided intake, classification and extraction, discrepancy detection, missing-evidence visibility and authorized prior-year context. SafeVault provides its governed document foundation. Our aim is to make the evidence and remaining question clearer as work moves between people.

Use the five checks to evaluate the workflow your firm needs, including capabilities beyond intake and extraction. In a TaxFlo demonstration, we separate current, demonstrable behavior from requirements that still need implementation or validation. The framework itself does not certify a product or a firm's compliance.

Tax treatment, eligibility, advice and final approval remain with the practitioner. Account administration, access policy and incident decisions remain with the firm's authorized people. Document readiness does not replace either responsibility.

Test one handoff in twenty minutes

Bring a handoff your team needs to explain. In a 20-minute synthetic-workflow review, we can map the evidence and unresolved question, examine the relevant demonstrated capabilities and agree on one handoff test and success measure. No taxpayer documents are needed. If the fit is useful, define a controlled pilot covering 10 to 25 engagements with agreed safeguards and scope before any broader change.

Common question

What should a CPA firm check when a reviewer leaves an engagement?

Check source access, the owner of unresolved work, derived views such as search or AI summaries, prior exports, and the history needed to explain the handoff. Test the expected result against the firm's approved policy using fictional evidence.

Continue the workflow series

Sources

• IRS Publication 4557, Safeguarding Taxpayer Data, May 2024, printed page 4
• FTC Safeguards Rule business guide, access controls and activity monitoring