A CPA firm client offboarding checklist for access, records and a clean handoff

Day 0 is the day an owner writes freeze. No new organizer, no new payroll run, no new notice response, no new month end, until the disengagement letter is out. Park open tasks on the board with a name. A verbal "we are done" is not freeze.

Send the notice the engagement requires. Use the outline on the disengagement letter guide. That page is informational, not legal advice. Have counsel and your carrier read the letter. This checklist assumes that letter names an effective date, what you will still finish, how records come back, and when portal access ends.

• Owner name on the freeze decision, the effective date, and the reason category (scope, unpaid invoices, capacity, risk).
• Letter sent the way the engagement requires, with proof of delivery.
• Board shows no new work after freeze, except items the letter still promises to finish.

Work the calendar from freeze, not from the last unpaid invoice. If records or access slip, keep the row open. Do not mark the client archived because the letter went out.

If the letter promises a filing you will still finish, that item stays on the board with an owner and a done date. It is not a reason to leave QuickBooks access open for the rest of the year.

Publication 4557 tells tax professionals to limit access to taxpayer data to people who need to know, to implement multi factor authentication for anyone accessing customer information, and that each person with access should have a unique password. When the client leaves, need to know becomes none. Revoke the named users. Do not share a last login in chat so someone can "just pull one report." (Publication 4557)

The Taxes Security Together checklist puts two factor authentication on the Security Six when a product offers it. The IRS newsroom reminder says tax pros should implement multifactor authentication across services and data access points. Turn MFA off for access you are killing only after the user is removed. Leaving a live user with MFA on is still live access. (Taxes Security Together checklist, Tax pros: multifactor authentication is key to protecting client data)

Return what the engagement and Circular 230 section 10.28 require. The rules, the letter outline, and what counts as client records versus workpapers are on the disengagement letter page. Export from the portal you already used. Publication 5293 is the shorter IRS data security resource list if you need the Security Summit links in one place. (Publication 5293)

IRS authorizations do not lapse because you sent a client letter. Note each one:

• Form 2848: withdraw or leave on file using the Form 2848 workflow. Publication 4557 tells tax professionals to withdraw from outstanding authorizations for taxpayers who are no longer clients.
• Form 8821: same CAF file. Use the Form 8821 workflow if a transcript authorization is still live.
• Form 8655: revoke or replace using the Form 8655 reporting agent checklist. A new agent on a new 8655 does not automatically wipe prior period disclosure authority.

Send the final invoice on the date the letter allows. Stop recurring close, payroll, and organizer work the same day you said you would. A silent December close after an October letter trains the next client that offboarding is optional.

Archive means a path a second person can find in two years: letter, delivery proof, records export log, access table with dates, authorization notes, final invoice. It does not mean a zip in one owner's downloads folder.

Remaining clients still need organizers, W-9s, and documents. The tax season operator drafts those chases. Your staff approve what goes out. Your CPA reviews and signs every return.

Download the day by day offboarding checklist and access revoke table. One sheet per departing client. Fill dates from freeze, not from memory.