How to Handle Busy-Season Security Exceptions and Close Them Afterward

Every filing season, CPA firms and tax practices bend a few security rules to get returns out the door. A written security exception process keeps those shortcuts approved, time-limited and visible, so each one closes after the deadline instead of drifting into next season.

What counts as a busy-season security exception?

Any time the firm knowingly runs a control below its written policy to get returns out the door. Common examples at CPA firms: a seasonal preparer working before their MFA enrollment is finished, a shared login on a scanning station, a partner allowed to sync client files to a personal laptop, local admin rights granted so someone can install a tax software update, or a firewall rule opened for a remote worker's home office.

None of these is unusual, and a firm may have good reasons for each one. The problem is the undocumented version: a shortcut nobody wrote down, nobody approved and nobody remembers to undo after April 15. By the next filing season, a two-week workaround has become a permanent hole that the WISP says does not exist.

Does the FTC Safeguards Rule allow exceptions?

For some controls, yes, and it says who approves them. Tax preparers are financial institutions under the rule, as 16 CFR 314.2(h)(2)(viii) makes explicit, so the rule's exception language applies to them directly.

• Multi-factor authentication: 16 CFR 314.4(c)(5) requires MFA for any individual accessing any information system "unless your Qualified Individual has approved in writing the use of reasonably equivalent or more secure access controls."
• Encryption: 314.4(c)(3) allows "effective alternative compensating controls reviewed and approved by your Qualified Individual" where encrypting customer information is infeasible.

Both exceptions run through the Qualified Individual, the person the firm designates to oversee its information security program. Neither lets a firm simply switch a control off. The MFA exception requires an alternative that is reasonably equivalent or stronger, and it must be in writing.

The IRS has been just as direct about MFA. In IR-2026-106 (September 4, 2026), the IRS and Security Summit reminded tax professionals that the Safeguards Rule MFA requirement applies to tax preparation firms regardless of size. An undocumented MFA gap during filing season is exactly the exposure that guidance targets. Our FTC Safeguards Rule checklist for tax preparers covers the other controls the rule expects.

How should a security exception process work during busy season?

Every exception gets written approval before it starts, plus a fixed end date. A short form is enough if it captures:

• The policy section and control being waived, and the specific person, device or system covered.
• The business reason, in one or two sentences.
• The compensating controls in place while the exception runs, such as restricting the account to one workstation, extra logging or daily review of sign-ins.
• The approver's name, title and date. For MFA, that approver should be the Qualified Individual.
• A fixed expiry date. For filing-season exceptions, tie it to a date such as April 30 or the extension deadline, never "after tax season."
• The person responsible for closing it.

Keep every exception in one register, whether a spreadsheet or a ticket queue. The NIST Cybersecurity Framework 2.0 describes the target in subcategory ID.RA-07: changes and exceptions are managed, assessed for risk impact, recorded and tracked. A register is how a small firm meets that without new software.

Treat each entry as a formal exception to policy with its own risk note. If a shortcut has no end date and no plan to remove it, record it as a risk acceptance decision for firm leadership in the same register.

How do you close exceptions after the deadline?

Work the register line by line in the two weeks after April 15, and again after the October extension deadline. For each entry, the owner either closes it or brings it back to the approver for a fresh, dated renewal. Nothing rolls over silently.

A practical close-out sequence:

• Remove access for departed seasonal staff first. CIS Controls v8.1 Safeguards 5.3 and 6.2 call for disabling dormant accounts after 45 days of inactivity and for a defined access revoking process. Do not wait 45 days for staff you know have left.
• Finish MFA enrollment for anyone still on an approved alternative, then delete the exception.
• Retire shared logins and replace them with named accounts.
• Revoke temporary local admin rights and confirm in your endpoint tool that they are gone.
• Close firewall and remote access rules opened for the season, and confirm the change in the device configuration.
• Have files synced to personal devices removed, and record who confirmed it.
• Mark each entry closed with the date and the evidence: a screenshot, a report or a ticket number.

16 CFR 314.4(g) requires the firm to evaluate and adjust its information security program in light of testing, monitoring and material changes in operations. A post-season review of every exception is a direct way to show that evaluation happened.

Do exceptions belong in the annual report to leadership?

Yes. Under 314.4(i), the Qualified Individual must report in writing, at least annually, to the board or equivalent governing body, or to a senior officer if there is none. The report must cover material matters such as risk assessment, risk management and control decisions. A season's worth of approved exceptions, how many were closed on time and which were renewed, is exactly that kind of control decision. Our guide to the Qualified Individual's annual board report covers what else the report should include.

Firms that maintain information on fewer than 5,000 consumers are exempt from the written report under 16 CFR 314.6. The approval requirements for MFA and encryption exceptions still apply at every size.

What should a CPA firm do before the next filing season?

Set up the process now, while there is time to think. Before January:

• Add an exceptions section to your WISP. IRS Publication 5708 gives the WISP structure, and the exception process fits alongside access control and risk assessment. Our guide to updating your WISP before the 2027 filing season walks through the rest.
• Create a one-page exception request form and a register with the fields above.
• Confirm in writing who your Qualified Individual is and who approves exceptions when that person is unavailable.
• Decide in advance which exceptions the firm will never grant, such as waiving MFA on email or on remote access to the tax software.
• Pre-stage seasonal staff accounts with MFA enrolled before their first day, which removes the need for a delayed-enrollment exception.
• Put two close-out dates on the calendar: the first business day after April 30 and the first after the extension deadline.

Who can help a CPA firm run its security exception process?

An IT partner that runs seasonal onboarding, MFA enrollment and access removal can keep most exceptions from being needed at all. s90 does this for CPA firms across Los Angeles and Orange County. Exceptions that remain go into a risk register, and the evidence of each close-out appears in the Technology Posture Report our clients use for their WISP and their Qualified Individual's annual review. If last season left loose ends, we can help you find and close them before the next one.