Key takeaways
- Tax preparers are financial institutions under the FTC Safeguards Rule, so access controls and MFA apply to seasonal staff from day one.
- Anyone who prepares or assists in preparing returns for compensation needs a valid PTIN before preparing returns.
- IRS Publication 5708's sample WISP says terminated employees' logins will be disabled at the time of termination.
- Shared logins to tax software conflict with IRS guidance in Publications 4557 and 5708.
- A next-day check by a second person, using sign-in logs and app user lists, is the proof that offboarding worked.
Why do seasonal staff leave access behind?
Seasonal staff leave access behind because they touch more systems than the email account IT remembers to disable, and most firms' employee offboarding checklist stops there. A seasonal preparer may need Microsoft 365, the tax software, the client portal, the document management system, e-signature, a scanner profile and remote access. When the season ends after April 15 or the October 15 extension deadline, email gets turned off and the rest often stays on.
Each leftover login is a door into client tax data with nobody watching it. It is also a gap you would have to explain after an incident, to clients and to the IRS.
What do the rules require for temporary staff access?
Temporary staff fall under the same access rules as permanent staff, with no seasonal exception. Tax preparation firms are financial institutions under the FTC Safeguards Rule, 16 CFR 314.2(h)(2)(viii). Section 314.4(c)(1) requires access controls that permit access only to authorized users and limit each user to the customer information they need for their duties, and section 314.4(c)(5) requires multi-factor authentication for anyone accessing any information system. Our FTC Safeguards Rule checklist for tax preparers covers the rest of the program.
The IRS guidance is more specific. The sample written information security plan in Publication 5708 says new employees will be trained before access to personal information is granted, the firm "will not have any shared passwords or accounts," and "terminated employees' computer access logins and passwords will be disabled at the time of termination." Publication 4557 tells firms to prevent terminated employees from reaching customer information "by immediately deactivating their passwords and user names." If your WISP follows the IRS template, those sentences are now commitments you have made in writing.
What has to be done before a seasonal hire's first day?
Before a seasonal hire's first day, finish everything that gates access to client data: PTIN, background check, named accounts, MFA, device and training. Doing it in the 24 hours before the start date means the person is productive on day one without anyone handing over a shared login to get them started.
- Confirm the PTIN. The IRS says anyone who prepares or assists in preparing federal returns for compensation must hold a valid PTIN for the current year before preparing returns. Line 11 of Form W-12 also asks applicants to acknowledge the WISP requirement.
- Complete the background check. The Publication 5708 template calls for background checks on new employees who will have access to retained personal information.
- Create named accounts in every system. One login per person in Microsoft 365, the tax software, the portal and document management. Add the person to a seasonal group that grants only what the role needs, and record the planned end date on the account.
- Require MFA at first sign-in. The Security Summit's September 2026 release (IR-2026-106) says the MFA requirement applies to tax preparation firms regardless of size. Turn it on in the tax software and portal as well as Microsoft 365.
- Prepare the device. A firm laptop, or a personal device enrolled in management, recorded by asset tag against the person's name.
- Train before access. Deliver the WISP, the AI policy and phishing basics, and collect a signed acknowledgment before client files open.
On day one, confirm the person can sign in with MFA and sees only what the role allows. File the checklist with the date. That record is your evidence the access was granted on purpose.
What belongs on an employee offboarding checklist for seasonal staff?
An employee offboarding checklist for seasonal staff should remove every account the person had at the time employment ends, working from the same system list used to onboard them:
- Disable the Microsoft 365 account and sign the person out of active sessions, so a phone that is already signed in loses access too.
- Remove the person from the tax software, client portal, document management, e-signature and any remote access tool.
- Collect keys, badges and access codes, as the Publication 5708 template requires, and collect the laptop so it can be wiped or reissued.
- Change any shared credential the person knew, such as a door code or scanner PIN.
- Convert the mailbox to a shared mailbox owned by the supervising manager, so client emails are not lost.
If the end date was recorded at onboarding, much of this can be scheduled. Microsoft Entra can expire access on a set date with an Entra ID P2 or ID Governance license; on Business Premium alone, a named person has to do it by hand on schedule.
How do you prove nothing was left behind?
You prove it with a second-person check within 24 hours. That person pulls the current user list from each system on the checklist, confirms the departed name is gone, and looks at sign-in logs for any activity after the last day. Section 314.4(c)(8) already requires the firm to monitor and log authorized users' activity, so the logs should exist. File the result with the offboarding checklist.
Then run one sweep after each deadline. Compare every system's user list against the HR roster and disable anything that does not match. The sweep catches the person who left early, the intern nobody told IT about, and accounts created outside the checklist.
What should you do before the 2027 filing season?
Build the employee onboarding checklist and the offboarding checklist now, while there is time to test them. Six steps:
- List every system a seasonal preparer, reviewer and admin assistant needs, by role.
- Create a seasonal group or template for each role, so access is granted in one step.
- Write the onboarding and offboarding checklists from that list, with a named owner for each step.
- Decide who performs the next-day verification, and make sure it is someone other than the person who removed the access.
- Confirm returning seasonal staff have renewed their PTINs before their start date.
- Put the post-deadline sweeps on the calendar now, and update the WISP so it describes what you actually do.
How does s90 help?
s90 sets up role templates for seasonal staff, records end dates when accounts are created, and runs the offboarding checklist across Microsoft 365 and the applications connected to it. Our Identity Posture reports flag stale and leftover accounts each month, and the dated records go straight into your WISP evidence. If you are planning for busy season, we are happy to walk through your current onboarding list with you.
