A CPA firm’s year has a shape: a long ramp, a violent peak, and a recovery. IT preparation should follow that shape. The goal of everything below is uptime during the peak, because a slow server in August is an annoyance and a dead server in the first week of April is lost billable hours, missed deadlines, and clients wondering whether their documents are safe. Two things prevent most of the season’s disasters before they start: a change freeze, so nothing gets broken by your own hand, and a backup you have actually restored from, so anything that does break can be undone.
Here is the checklist, organized by the calendar. We support firms like yours across Houston and DFW, and the compliance context behind several of these items lives on our CPA and financial advisor IT page.
What should be done 60 to 90 days before tax season?
This is the window for anything with a lead time. Decisions made here land calmly. The same decisions made in January land on top of your busiest weeks.
Make hardware refresh decisions now. Walk the office and identify the machines that struggled last season, the workstations that took minutes to open returns, the aging server, the scanner that jammed through February. Order replacements now so they arrive, get configured, and get broken in while stakes are low. A workstation that fails in March gets replaced under pressure, at whatever price and timeline the moment allows.
Coordinate tax software version upgrades with your vendor. Tax software vendors ship major annual releases, and those releases have system requirements, server components, and known early bugs. Schedule the upgrade for this window, confirm your server and workstations meet the new requirements, and let the first wave of patches settle before your volume ramps. This is also where an IT partner earns its keep on the phone: we coordinate directly with the software vendor on upgrades and compatibility so your staff isn’t relaying error messages between two support desks.
Check server and hosting capacity. Whatever hosts your tax applications and client files, an office server, a private cloud, or a hosting provider, ask whether it handled last season’s peak comfortably. Disk space, memory, and concurrent user counts all spike in season. If the answer involves the word “slow,” this is the window to add capacity, because capacity changes are exactly the kind of work the change freeze will soon prohibit.
Decide the support question. If the firm has been running on an informal IT arrangement, a part-time person, a break-fix shop, the partner who’s good with computers, this is the last comfortable moment to change it. Nobody should be interviewing IT providers in February. The tradeoffs are laid out in our comparison of internal IT versus an MSP for accounting firms.
What should be done 30 days out?
The month before the season is for people and proof. The infrastructure is settled; now make sure the humans can get in and the safety nets actually work.
Onboard seasonal staff with least privilege. Every seasonal preparer and admin gets a named account, not a shared login, with access scoped to what the role needs and nothing more. Client financial data is exactly what the FTC Safeguards Rule expects you to control access to, and shared credentials make it impossible to say who touched what. Put the end date on the calendar the same day you create the account.
Enroll everyone in MFA, including the seasonal hires. MFA on email, remote access, and anything holding client data is table stakes for a firm handling financial information, and it is the single control that most reliably stops a stolen password from becoming a breach. Enroll seasonal staff before their first day, because during their first day they’ll be too busy, and so will you.
Test remote access with real users. If partners review returns from home or staff work late from their kitchen tables, have several actual users sign in through the actual remote path, under MFA, and open the tax application. “Remote access works” is a claim; a partner signing in successfully on a Tuesday night is evidence. Find the expired certificate or the broken VPN client now, not on April 1st.
Run a backup restore test. Not “confirm the backup job succeeded.” Restore a real client file and a mailbox item, open them, and note how long it took. A backup that has never been restored is an assumption, and tax season is the wrong time to test assumptions. What to back up across tax software, QuickBooks, and Microsoft 365 is covered in our accounting firm backup guide, and the service behind it is backup and disaster recovery.
Brief the team on fraud. Thirty days out is the right moment for a short refresher: how wire fraud and fake-client emails actually look, and the rule that any payment instruction gets verified by phone. More on why below.
What should change during tax season itself?
During the season the posture flips from improvement to protection. The environment that exists at the start of filing season is the environment that finishes it.
Freeze changes. No server migrations, no software rollouts, no network rework, no “quick” upgrades. Security patches still get applied on a sane schedule, and true emergencies get fixed, but every optional change waits until after the deadline. This one policy prevents the most embarrassing category of outage: the self-inflicted one. Paired with the restore test you already ran, it means the systems are stable and anything that does fail is recoverable. That combination is the whole ballgame.
Know the after-hours path before you need it. Firms work nights and weekends in season, which means problems happen at night and on weekends. Whoever supports your IT, have the escalation procedure in writing: what number to call, what counts as urgent, who decides. Braintek’s help desk answers calls in about 60 seconds typically and emails in about two hours typically, with after-hours support available for urgent issues and staff in Houston, DFW, and the Philippines covering the desk. The specifics matter less than this: the person working late must know exactly what to do when the screen goes wrong, without waking a partner to ask.
Raise phishing vigilance. Fraud targeting accounting firms spikes during filing season, because attackers know your inboxes are flooded, your staff includes new seasonal faces, and everyone is moving fast. Fake client document emails, spoofed partner requests, and wire instruction changes all land better in March than in July. Keep the verify-by-phone rule for anything touching money, and remind the team that busy is exactly when the fake invoice works. The full defense picture is in our guide to wire fraud and BEC protection for accounting firms.
Watch, don’t wander. In-season IT attention should go to monitoring, disk space on the file server, backup completion, mail flow, sign-in anomalies, so small problems get caught while they’re still small.
What should happen after the deadline passes?
The season isn’t over when the returns are filed. Two cleanup items close the loop, and both are easy to skip in the post-deadline exhale.
Tear down seasonal access. Disable every seasonal account on the scheduled end date, recover any firm equipment, and remove seasonal staff from shared mailboxes and distribution lists. Orphaned accounts from two seasons ago are a standard finding in security reviews of accounting firms, and each one is a live credential to your clients’ financial data. This is also where least privilege pays off twice, because narrow access is fast to revoke.
Archive and check retention. Move the completed season’s files into whatever retention structure your firm follows, confirm the archive is included in backups, and reclaim server space while you’re there. Then spend one hour on a season retrospective: what was slow, what broke, what the team grumbled about. That list, written down in May, is the start of next year’s 90-day checklist, and it’s the difference between firms that repeat this cycle calmly and firms that relive it.
Who can run this checklist with you?
Most of the items above are ordinary IT work. What makes them a system is the calendar discipline, and that’s easier with a partner who has run the cycle before. Braintek has supported Texas businesses since 2002, with staff in Houston, DFW, and the Philippines. Fully managed support fits firms of roughly 10 to 50 employees; larger firms with internal IT staff typically fit co-managed support, which we run for organizations up to around 1,500 employees. Start with the CPA and financial advisor page for the compliance picture, or reach out below and we’ll walk the checklist against your firm before the season starts.