Client intake for an accounting firm

Good client intake for an accounting firm separates the inquiry from the tax data: a simple form to qualify and book, then a secure route for documents once the client has signed on. Mixing the two is how Social Security numbers end up sitting in a general inbox.

This guide covers the steps from first inquiry to signed engagement, and the federal rules that shape how a tax practice handles client data. It is general information, not legal advice. Your professional body, your insurer, and a lawyer who knows your state can tell you what applies to your firm.

The rules that shape intake

Three sets of rules matter most for a firm that prepares returns. They do not tell you which form fields to use, but they decide where sensitive data can go and who can see it.

The FTC Safeguards Rule. The FTC lists tax preparation firms among the businesses the rule treats as financial institutions.^[1] Covered firms need an information security program with a qualified individual in charge, a risk assessment, encryption of customer information on your systems and in transit, and multi-factor authentication for anyone who accesses it.^[1]

The rule also asks firms to dispose of customer information securely no later than 2 years after it was last used to serve the customer, unless you have a legitimate business need or legal requirement to keep it.^[1] Since May 2024, a security event affecting the unencrypted information of at least 500 consumers must be reported to the FTC within 30 days of discovery.^[1] Firms with customer information on fewer than 5,000 consumers are exempt from some, but not all, of the requirements.^[2]

IRS Publication 4557. The IRS guide for tax professionals, last revised in June 2024, says tax return preparers must create and enact security plans to protect client data under the Safeguards Rule.^[3] It recommends encrypting sensitive files and emails, and suggests using password-protected, encrypted documents or secure file transfer instead of plain email when sharing files with clients.^[3]

Section 7216. Federal law makes it a misdemeanor for a tax preparer to knowingly or recklessly disclose return information, or use it for anything other than preparing the return, without an exception that applies. The penalty can be a fine of up to $1,000, up to 1 year in prison, or both.^[4] Consent is one of the exceptions, and it comes with its own rules, covered below.

Step 1: a short inquiry form

The first form should help you decide whether the person is a fit, not prepare their return. Ask for name, email, phone, the kind of help they want (individual return, business return, bookkeeping, payroll, advisory), entity type if it is a business, and how they heard about you.

Leave out Social Security numbers, bank details, prior-year returns, and income figures. Publication 4557 warns preparers not to open attachments from unknown senders, including potential clients, and to make contact first by phone.^[3] A short form with no upload field avoids that problem for new inquiries.

With our forms, every inquiry creates a contact record with the answers already on it, so nobody retypes an email. Questions can skip what does not apply, so a sole trader never sees the questions meant for a partnership.

Step 2: reply fast and book a call

A reply within minutes, with a link to book a short intro call, catches the person while they are still deciding. Our guide to lead response time covers the research on why the first hour counts.

An automation can send that reply the moment the form arrives, wait a day, and create a call task if the person has not booked. A booking calendar offers only the slots you choose, syncs with your Google or Outlook calendar, and can include a built-in video meeting link for remote clients.

Step 3: the engagement letter and consents

Once you agree to take the client on, send the engagement letter and collect a signature before any return work starts. Proposals and contracts in our CRM can be signed online, with several signers when a couple or business partners both need to sign.

If you want to use a client's tax information for anything beyond the return, such as offering other services, or share it with someone else, Section 7216 consent rules apply. The regulation requires the consent to name the preparer and the taxpayer, say what information is covered, and be signed and dated by the taxpayer.^[5]

• Uses and disclosures need separate documents. One signed document cannot authorize both.^[5]
• Consents expire. If the consent does not state a duration, it lasts 1 year from the date it was signed.^[5]
• Timing matters. A preparer may not ask for consent after handing the client the completed return to sign.^[5]
• The client keeps a copy. The preparer must give a copy at signing, or the chance to print or save it electronically.^[5]

For individual returns, the regulation lets the IRS set extra format and content rules through published guidance.^[5] Check the current IRS guidance or ask your lawyer before you write consent wording, and do not bury it inside the engagement letter for an individual client.

Step 4: documents through a secure route

Tax documents are the part of intake where the rules bite hardest. Many firms use the secure client portal that comes with their tax or practice software, which is a reasonable place for returns, statements, and identity documents to live.

Whatever you use, Publication 4557 points the same way: encrypt sensitive files, avoid sending them as plain email attachments, and use multi-factor authentication on every account that touches client data.^[3] Ask clients not to email their documents, and tell them where to upload instead.

A CRM still has a job here. It holds the relationship: contact details, the engagement status, the tasks, and the reminders. It does not need to hold the return itself, and keeping sensitive tax data out of general tools makes your security plan simpler.

Step 5: a checklist that chases itself

The slowest part of onboarding is waiting for documents. A plain list helps, sent once and then followed up automatically.

1. Send a welcome message with the document list and the secure upload link.
2. Remind the client after 3 days, then after a week, until a team member marks the documents received.
3. Create a task for the preparer when the documents are in.
4. Book a review meeting once the draft is ready.
5. Set a date-based reminder to start next year's intake.

Our automations can run each of these steps from dates and fields on the client record, and stop when someone ticks the box. The reminder timings above are a suggestion, not a researched standard, so adjust them to your season.

What to fix this week

• Remove any upload field or Social Security number field from your website contact form.
• Turn on multi-factor authentication for every tool your team uses with client data.
• Check that you have a written security plan and someone named to own it.^[1]
• Read your consent forms against the Section 7216 regulation.^[5]
• Write down where client documents should go, and tell new clients in your first reply.

See how an accounting or professional services firm runs inquiries, bookings, and reminders from one place.

Want your intake forms and follow-up built for you? On Grow and Scale our team sets them up and runs them. Book a walkthrough or compare plans.