The Practice Policies Every Tax and Accounting Firm Should Write Down

10/9/2026

Most small tax and accounting firms run on habits. The owner knows how a return moves from intake to e-file, which clients get extensions without asking, what happens when a preparer quits in February, and how the website gets updated. None of it is written down, and it works until the firm grows past the owner's line of sight, a key person leaves, or a regulator, insurer or buyer asks to see the policy.

A policies and procedures manual is the written version of those habits. It turns the checklists a firm already uses (client acceptance, engagement setup, workflow, billing, data security, staffing) into rules someone else can follow without asking. This post maps which policies belong in a tax or accounting firm's manual, which of them the law effectively requires you to document, and how to choose between building the manual from scratch and starting from a published one.

Why Write Policies Down at All

Four practical reasons, in rough order of how often they bite.

Consistency under pressure. During filing season, decisions are made by whoever is at the desk. A written rule on, say, when a return can be released without a signed e-file authorization means the answer does not depend on who is tired.

Delegation. A firm cannot scale past the owner's personal capacity if every exception goes back to the owner. Our post on how to scale a CPA firm makes the point that documented process is what makes delegation safe.

Compliance evidence. Several obligations require written programs or procedures: a written information security plan under the FTC Safeguards Rule, procedures to secure staff compliance with Circular 230 for those with principal authority over a tax practice, and record retention rules. If a policy exists only in someone's head, there is nothing to show an examiner or an insurer.

Value and continuity. A practice with documented operations is easier to sell, merge or hand to a successor. The CPA firm succession planning post covers why buyers discount firms whose processes live only with the departing owner.

The Four Areas a Firm Manual Should Cover

A useful way to organize a manual is by the four parts of running a practice: operations, personnel, marketing and expansion. That is also how the management manuals described below are divided.

1. Operations policies

Operations is the largest section and the one that carries most of the compliance risk.

Client acceptance and continuance.

• Who may accept a new client, and what checks happen first (identity, conflicts, the reason they left the prior preparer, ability to pay).
• When an existing client is re-evaluated, and who decides to release one.
• What the firm will not take on (service types, industries, fee floors).

Engagement letters.

• That an engagement letter is signed before work begins, every year.
• Which template is used for which service, and who may change a template.
• How scope exclusions are stated and how out-of-scope requests are handled.

Workflow and review.

• The stages a return or engagement moves through, and what must be complete before each handoff.
• Who reviews what, and the sign-off evidence required.
• Release rules: signed e-file authorization (Form 8879 or the applicable form) in hand before transmission, payment arrangements confirmed, and copies delivered.

Records and retention.

• A paid preparer must give the taxpayer a completed copy of the return no later than when it is presented for signature, and keep either a copy of each return or a list of taxpayers and identifying numbers for three years after the close of the return period (Internal Revenue Code section 6107).
• Electronic return originators keep signature authorization forms such as Form 8879 for three years from the return due date or the IRS received date, whichever is later, under IRS e-file rules.
• Beyond those minimums, state the firm's own retention period for workpapers and client documents, and the secure destruction method. The FTC Safeguards Rule expects customer information to be disposed of within two years after last use unless there is a business or legal reason to keep it, so the retention policy and the security plan must agree.

Confidentiality and disclosure of tax information.

• The Internal Revenue Code penalizes unauthorized use or disclosure of tax return information (sections 6713 and 7216), and the section 7216 regulations require specific written consent before return information is used or disclosed for purposes other than preparing the return. The policy should say who may approve any such use, and that the prescribed consent form is used.

Data security.

• The written information security plan, its Qualified Individual, multi-factor authentication, secure client file exchange, device rules and breach response. Put the WISP in the manual by reference rather than duplicating it.

Billing and collections.

• How fees are set, when estimates are given, when bills go out, and what happens when a client does not pay, including whether work is held. Our posts on value-based billing for CPA firms and how to price tax preparation services cover the pricing decisions that the policy should record.

Calendar and deadline control.

• Who maintains the firm's deadline calendar, how extensions are decided and tracked, and the rule for confirming e-file acceptance rather than assuming it.

2. Personnel policies

Personnel policies are where small firms are most exposed legally, because employment law applies to a three-person office as much as to a large one, and seasonal staffing creates its own issues.

• Hiring and onboarding: job descriptions, background and credential checks, PTIN confirmation for preparers, and onboarding that covers systems and security, not just the work.
• Seasonal staff: start and end dates, access granted and removed on those dates, and the training required before a seasonal preparer touches client data. Our post on hiring seasonal tax preparers covers the recruiting side.
• Classification: whether workers are employees or independent contractors, decided under the applicable tests rather than by preference.
• Compensation and hours: pay structure, overtime rules for non-exempt staff during the busy season, and bonus criteria.
• Time off and busy-season rules: blackout periods, how requests are approved, and remote-work rules.
• Conduct and confidentiality: a code of conduct, confidentiality acknowledgment, acceptable use of firm systems and of AI tools with client data.
• Performance and development: review cadence, the role of review notes in development, and credential support.
• Separation: exit procedures, return of equipment, and same-day removal of system access.

Because employment rules vary by state and change, personnel policies should be reviewed by someone who knows the employment law of each state where you have staff, and dated so you know when they were last checked.

3. Marketing policies

Marketing seems the least policy-shaped area, but there are rules here too.

• Advertising standards. Circular 230 restricts false, fraudulent or misleading advertising and solicitation by practitioners, and state boards of accountancy have their own advertising rules for CPA firms. The policy should say who approves marketing copy and claims.
• Use of titles and credentials in marketing and signatures.
• Client testimonials and reviews, including whether and how they may be solicited.
• Referral arrangements and any fees paid or received.
• Website and social media: who posts, what may not be posted (client information, case specifics), and how the site is kept current.
• Client communications: newsletters, filing-season reminders and how opt-outs are handled.

For the growth side of marketing, our posts on client acquisition for accounting firms and marketing a CPA firm without a budget are good companions.

4. Expansion policies

Expansion policies matter when a firm opens a second office, adds a service line, acquires a book of clients or brings in a partner.

• Criteria for new services: competence, licensing and insurance checks before the firm offers, for example, bookkeeping, payroll or representation work.
• New locations: staffing, security setup, supervision and how the new office follows the same procedures.
• Acquisitions of client lists: due diligence, client consent and transition communications, and how acquired client data is brought under the WISP.
• Partners and ownership: decision rights, admission criteria and the documents that govern them.
• Capacity: the rule that new commitments are checked against staff capacity before they are accepted.

How to Build the Manual

Step 1: Inventory what you already do

Walk through a year of practice: intake, engagement letters, preparation, review, release, billing, extensions, off-season work. Write down the current practice for each step, even if it is inconsistent. The checklists on your practice-management list are the raw material.

Step 2: Decide, then write

Where practice is inconsistent, pick the rule. A manual that records three different ways of doing something is not a policy.

Step 3: Separate policy from procedure

A policy is the rule ("Every engagement has a signed letter before work begins"). A procedure is how it is done ("Letters are issued from the practice management system in December; unsigned letters are chased weekly; work does not start until the signed letter is filed"). Keep them in separate sections so procedures can change without reopening the policy.

Step 4: Assign owners and review dates

Each section needs an owner and a date by which it will be reviewed. Legal and regulatory items (retention, confidentiality, data security, employment rules) need review at least annually.

Step 5: Train and acknowledge

Staff should read the relevant sections at onboarding and acknowledge them in writing. A manual nobody has read does not protect the firm.

Step 6: Use it

Refer to it when exceptions come up, and change it when the firm decides something new. The annual practice review is the natural point to update it.

Build from Scratch or Start from a Published Manual?

Building from a blank page is possible, and some firms prefer it. It is also slow: a complete manual covering operations, personnel, marketing and expansion is a substantial writing project, and small practices rarely have the off-season hours to finish it. The more common route is to start from a published manual and adapt it to the firm.

The Tax Business Management Manuals

The Tax Business Management Manuals bundle is built around exactly the four areas above, with one manual for each. The component manuals are also available separately:

If your gap is...	Start with
Intake, workflow, office procedures	Tax Office Operations Manual
Hiring, seasonal staff, employee rules	Tax Business Personnel Manual
Marketing approach and client growth	Tax Business Marketing Manual
Adding offices, services or clients	Tax Business Expansion Manual
All four, or building a manual from nothing	The bundle

 

How to choose:

• A solo or small office documenting its first manual will usually get most value from the full bundle, because every section is missing at once.
• A firm whose immediate problem is operational (inconsistent intake, review and release, or a new office manager to train) can start with the Tax Office Operations Manual.
• A firm adding staff, especially seasonal preparers, will find the Tax Business Personnel Manual the most direct fit.
• A firm focused on growing its client base can start with the Tax Business Marketing Manual.
• A firm planning a second location, a new service line or an acquisition should look at the Tax Business Expansion Manual.

Whichever you start from, adapt it. A published manual supplies structure and coverage; your firm still has to decide its own rules, and state-specific employment and board rules have to be checked locally.

Pair the manual with practitioner rules

The operations and confidentiality sections depend on the regulations governing tax practice. The Tax Practitioner Regulations, Penalties and Security course covers that regulatory side and is a useful companion for whoever owns the manual.

Get the Manuals

If your firm's policies still live in the owner's head, the Tax Business Management Manuals bundle gives you the four-part structure (operations, personnel, marketing and expansion) to start writing them down this off-season.

Frequently Asked Questions

What should an accounting firm policies and procedures manual include?

At minimum: client acceptance and continuance rules, engagement letter requirements, workflow and review standards, return release rules, record retention and destruction, confidentiality and consent for use of tax information, the written information security plan, billing and collections, deadline control, and personnel policies covering hiring, seasonal staff, conduct, time off and separation. Firms that market actively or plan to grow should add marketing approval rules and expansion policies for new services, offices and acquisitions.

Is a small tax practice required to have written policies?

Some written programs are required regardless of size. Tax return preparers must maintain a written information security plan under the FTC Safeguards Rule, preparers must retain copies or lists of returns under section 6107, and e-file providers must keep signature authorizations. Practitioners with principal authority over a firm's tax practice are expected under Circular 230 to have adequate procedures for staff compliance. Beyond those, a full manual is not legally mandated, but it is the evidence that the required procedures exist.

What is the difference between a policy and a procedure?

A policy states the rule and why it exists, for example that no return is transmitted without a signed e-file authorization. A procedure describes how the rule is carried out: who requests the signature, where it is stored and how the preparer confirms it before transmission. Keeping policies and procedures in separate sections lets a firm change its software or workflow without rewriting the underlying rule.

How often should a firm update its manual?

Review it at least once a year, ideally during the annual practice review in the off-season, and update it whenever the firm makes a decision that changes a rule. Sections tied to law, such as record retention, confidentiality, data security and employment, need annual checks because the underlying rules change. Date each section and name its owner so it is clear when it was last confirmed.

Which Tax Business Management Manual should I buy first?

It depends on the gap. The Tax Office Operations Manual fits a firm whose immediate need is intake, workflow and office procedures. The Personnel Manual fits a firm adding employees or seasonal preparers. The Marketing Manual fits a firm focused on client growth, and the Expansion Manual fits a firm adding offices, services or clients. A firm with no written manual at all usually gets the most from the bundle, which includes all four.

Can I use a published manual as-is?

Use it as a starting structure, not a finished document. A published manual gives coverage and wording, but each firm must decide its own rules, remove what does not apply and add what is specific to its services, software and locations. Employment rules and state board requirements vary by state, so personnel and advertising sections in particular should be checked against the law where the firm operates before staff are asked to follow them.