A bookkeeping client onboarding checklist a 1 to 5 person firm can finish before the first close

Day 1 is the first day you have a signed letter, working access, and a questionnaire you can code from. It is not the day they said yes on a call. If you open the ledger before those three exist, you will recode the same bank feed twice and call it onboarding.

Collect this packet before anyone accepts an accountant invite. Put each item on the tracker with an owner and a due date. Blank rows are the job. A verbal "I sent it" is not.

• Signed bookkeeping or CAS letter that names the services, the close day, and what you will not do.
• Legal name, EIN or SSN as it appears on filings, entity type, year end, and who signs invoices.
• Owners, ownership percentages, and related entities that share a bank or payroll file.
• Chart of accounts notes: accounts they insist on keeping, accounts you will merge, and class or location tracking if they use it.
• Recurring tasks they already run (payroll, sales tax, bill pay, inventory counts) with the vendor and the day of the month.
• Prior accountant files, a written okay to contact that firm, and the last closed period they trust.

The letter and the first emails that get it signed live in the bookkeeping engagement letter templates. Do not start access collection from a marketing inbox. Start it after the letter is on file.

Publication 4557 tells tax professionals to limit access to taxpayer data to people who need to know, to implement multi factor authentication for anyone accessing customer information, and to encrypt sensitive files and email that carry personally identifiable information. The Taxes Security Together checklist from the IRS, state tax agencies, and the Security Summit puts two factor authentication on the Security Six when a product offers it. Turn MFA on for every login you will use to see this client's books, not only for your tax software. (Publication 4557, Taxes Security Together checklist)

The IRS newsroom reminder on multifactor authentication says tax pros should implement it across services and data access points, and should enable it in tax software and cloud storage that holds client data. Use that as the access rule for bookkeeping too. A shared "bookkeeper@" login with no second factor is not access. It is a shared secret. (Tax pros: multifactor authentication is key to protecting client data)

Publication 4557 also says each person with access should have a unique password, and not to share passwords among employees. Invite the firm, then named people. Revoke the invite when that person leaves. Do not paste a client password into a team chat.

The questionnaire is not a personality survey. It is the sheet a closer will still need in month 4. Fill it once, store it on the client, and stop asking the same bank question every close.

Recurring tasks belong on the same sheet as access. Payroll every other Friday, sales tax on the 20th, a bill run on Thursdays: write the day, the vendor, and whether you own it. If it is not in the letter, it is not in onboarding.

One row per item. Duplicate the sheet for each new client. The owner column is a person, not "team." Due is a calendar date. Done is a date, not a checkmark someone clicked in a hurry.

Copy that table into a sheet, or download the CSV tracker. The same columns work in Karbon, TaxDome, or a shared spreadsheet. The software does not matter. A blank Done cell does.

Work backward from the first close date, not forward from the sales call. If their month ends on the 31st and you close on working day 10, day 1 of coding has to land after access, not after a kickoff lunch.

If access is still incomplete on day 8, do not invent a close date anyway. Slide the first close, in writing, to the next period you can actually finish. A fake first close trains them that missing logins are fine.

Live means the first close has shipped (or a scoped cleanup is in writing), the next close is on the board, folders exist for the current month, and a named closer can open every in scope system without asking the owner for a password. Until then, keep the card in onboarding. Do not hide a stuck file inside "monthly work."

What you automate after they are live is a per client decision. That list is what a CAS firm can automate per client. Do not turn on bank rules during onboarding on a file you have not closed once.

The tax season operator can draft the named chase when the questionnaire or a login is still missing. Your staff approve what goes out. Your CPA reviews and signs every return. Bookkeeping close still belongs to the closer on the board.

Download the bookkeeping client onboarding tracker. One sheet with the checklist (item, owner, due, done) and a first 30 days calendar you can date for each new client.