Running a remote CPA firm in 2026 comes down to four things: a written information security plan with multi-factor authentication on every system, payroll registered in every state where staff actually work, a client portal in place of email attachments, and a check that each CPA's license covers the states where clients sit. Process documentation and async communication make the rest workable.
The security piece is a legal duty for any remote CPA firm. The IRS repeated it in August 2026, and the FTC Safeguards Rule spells out the controls. This guide walks through each layer in the order most firms build it, starting with the rules that carry penalties and ending with the operating habits that keep a distributed team productive.
A firm whose staff work from home offices has no office network to hide behind. The controls have to sit on the accounts, devices and data themselves.
In IR-2026-92, issued on 18 August 2026, the IRS and its Security Summit partners stated that "Federal law requires tax and accounting professionals to create and maintain a Written Information Security Plan." The same release notes that tax and accounting professionals count as financial institutions under the Gramm-Leach-Bliley Act, and it points smaller practices to IRS Publication 5708, which provides a WISP template. The IRS also expects the plan to be reviewed, tested and updated as operations change, and recommends contacting the firm's IRS Stakeholder Liaison when a security incident happens.
Going remote is exactly the kind of operational change that should trigger a WISP review. A plan written for a single office with a locked server room says little about home Wi-Fi, personal phones used for authentication codes, or staff who print client documents at home.
The WISP is the document. The FTC Safeguards Rule at 16 CFR 314.4 sets the controls it has to describe. The FTC's own business guide lists "tax preparation firms" among the financial institutions covered. For a distributed team, the provisions that matter most are these:
| Rule | What it says | Remote implementation |
|---|---|---|
| 314.4(a) | Designate a Qualified Individual to run the program | Name one partner or manager; the FTC allows this person to work for a service provider |
| 314.4(b) | Base the program on a written risk assessment | Add home networks, personal devices and offshore access to the risk list |
| 314.4(c)(3) | Encrypt customer information in transit and at rest | Full-disk encryption on laptops; portals and VPNs for every file transfer |
| 314.4(c)(5) | Multi-factor authentication for anyone accessing any information system | MFA on email, tax software, cloud ledgers, portals and the password manager |
| 314.4(c)(8) | Monitor and log authorized users' activity | Turn on audit logs in Microsoft 365 or Google Workspace and in tax software |
| 314.4(j) | Notify the FTC of an event involving at least 500 consumers | Notice is due no later than 30 days after discovery |
The MFA requirement is broad. The rule text requires it "for any individual accessing any information system," unless the Qualified Individual approves an equivalent or stronger control in writing. The FTC guide adds that MFA means at least two of three factor types: something you know, something you have, and something you are. A password plus a texted code meets the letter of that. App-based or hardware keys are harder to phish and suit staff who log in from many locations.
Smaller firms get partial relief. Under 16 CFR 314.6, firms that maintain customer information on fewer than 5,000 consumers are exempt from the written risk assessment, the incident response plan, the annual board report, and the continuous monitoring or penetration testing requirement. MFA, encryption and the WISP itself still apply.
Worked example. A three-partner firm prepares 1,400 individual returns, each joint return covering two people, plus 300 business returns where it holds owner and employee data on an average of 6 people. That works out to 2,800 individuals from the 1040 work and 1,800 from the business side, or 4,600 consumers in total. The firm sits under the 5,000 line today. Adding one payroll client with 450 employees takes it to 5,050, and the exemption falls away. Firms near the threshold should count annually and plan as though they are already over it.
For the full control set on cloud ledgers and shared drives, see our guide to cloud accounting security best practices for remote teams.
A WISP for a remote CPA firm should answer a few concrete questions. Who owns the laptops, and can the firm wipe them remotely. Is client data allowed on local drives at all, or only inside a hosted desktop or cloud application. Which tasks require a VPN or virtual desktop. How quickly is access revoked when someone leaves.
Virtual desktop infrastructure (VDI) is the cleanest answer for staff who handle full client files, because the data never lands on the endpoint. Clipboard and download restrictions inside the VDI session close the most common leak paths. For offshore team members, the same controls apply, and the Safeguards Rule's service provider section requires contracts that spell out security expectations and periodic reassessment of the provider. Disclosure of tax return information to a preparer outside the US also triggers separate client consent rules, covered in our guide to Section 7216 consent. Our vendor risk assessment guide for accounting firms sets out the checks to run before granting any outside team access.
Email attachments are the weakest link in most remote firms. Staff forward documents to personal accounts to print them, clients reply-all with Social Security numbers in the body, and nobody can say later who opened what.
A client portal fixes most of this in one move. Documents travel encrypted, which covers the in-transit half of 314.4(c)(3). Access is tied to an authenticated user, which supports the logging requirement. And a portal gives remote staff one place to find client files without asking a colleague to resend them.
When choosing or configuring a portal, check that it enforces MFA for clients as well as staff, keeps an access log you can export, supports e-signature for engagement letters and Form 8879, and lets you set retention rules so old documents do not sit online indefinitely. Most practice management platforms include a portal; the CPA firm tech stack guide compares the main options. Roll it out with a firm policy that client data is not accepted or sent by plain email, and build the portal invitation into your client onboarding checklist so new clients never learn the old habit.
Hiring remotely usually means hiring across state lines, and a remote employee can create employer duties in the state where they work, such as registration, withholding, unemployment insurance and state labor rules. The details differ by state and change over time, so this guide does not try to restate them. Our guide to the hybrid employee working in two states covers the withholding and credit mechanics. For registration, unemployment insurance and the rest of the employer checklist, see multi-state payroll 101 for small businesses, and for the step-by-step payroll setup itself, the guide on how to set up payroll and taxes for remote workers.
Two practical habits keep this under control. Require staff to tell the firm before they move or spend extended time working from another state, and record each employee's work state in the HR system so payroll changes are triggered by a data change rather than discovered at year end.
Licensing is the compliance layer that firms most often forget when they go remote. A CPA licensed in one state who serves clients in another relies on that state's mobility or practice privilege rules, and the rules for the firm can differ from the rules for the individual.
The rules are changing. On 14 May 2025, the AICPA and NASBA approved changes to the model Uniform Accountancy Act that add a licensure path of a bachelor's degree with an accounting concentration, two years of experience and the CPA Exam. The same changes describe "a shift from state-based mobility to an individual-based practice privilege," intended to keep a CPA's ability to practice across state lines with one license. Each state has to enact the change itself, so as of October 2026 the rules still vary by board.
A remote firm should keep a simple licensing map:
Check the board of accountancy for each state on the map whenever someone moves or the firm takes on attest clients in a new state, and confirm with that board whether the firm itself needs a permit or registration there.
Compliance gets a remote CPA firm to a lawful baseline. The firms that run smoothly also change how work moves between people.
In an office, knowledge lives in people's heads and travels by tapping a shoulder. Remote, those gaps turn into missed deadlines. Every recurring process needs a written standard operating procedure: monthly close by client, tax return workflow, onboarding, payroll runs. A useful test is whether someone new, onshore or offshore, could follow the document next week and produce work that passes review. Keep SOPs in a shared wiki, update them when the process changes, and add short screen recordings for the complicated steps.
Remote work goes better with fewer meetings and better writing. If something can be written, write it. If it needs discussion, hold a short call with an agenda. Organize Slack or Teams channels by client or engagement so status updates and decisions are searchable later. A weekly 15-minute standup and monthly one-on-ones cover most of what needs live conversation.
Async is required for teams in different time zones, because the overlap may be an hour or two a day. Our guide to managing communication with offshore teams across time zones covers handoff formats that work.
Surveillance software and constant check-ins damage trust and measure the wrong thing. Define what done looks like for each role: closes completed on time, review notes per deliverable, turnaround on client requests. Use the practice management platform as the accountability system, with every task carrying an owner, a due date and a status, so a partner can see on Monday morning which engagements are behind without asking. Review the metrics monthly so problems surface before a deadline slips.
New hires in a remote firm cannot pick up culture and process by watching colleagues. Give them a day-by-day plan for the first week, a peer buddy for small questions, a library of process recordings, and a 30-day checkpoint with their manager against written expectations. Include security in week one: MFA enrollment, portal training, and a signed acknowledgment of the WISP.
Isolation drives turnover. A non-work chat channel, occasional virtual social time and periodic in-person gatherings cost little relative to replacing an experienced staff member. Treat offshore colleagues as part of the same team, invite them to the same meetings, and use their names.
Firms that struggle with remote operations tend to repeat a short list of errors. Recreating the office on video calls, with staff in meetings for half the day, is the most visible. Leaving the WISP unchanged after going remote is the most costly if a breach occurs, because the plan no longer describes how the firm actually handles data. Paying a remote employee through the home-office state's payroll after they have moved is a frequent and fixable error that surfaces as notices from the other state. And letting staff accept client documents by email, even occasionally, undoes most of the benefit of a portal.
Does a small remote CPA firm need a written information security plan? Yes. The IRS states that federal law requires tax and accounting professionals to create and maintain a WISP, regardless of practice size. Firms holding data on fewer than 5,000 consumers are exempt from some Safeguards Rule elements, such as the written risk assessment and incident response plan, but the plan, MFA and encryption still apply.
Is multi-factor authentication required for every system? The Safeguards Rule requires MFA for any individual accessing any information system, unless the firm's Qualified Individual approves an equivalent or stronger control in writing. In practice that covers email, tax software, cloud accounting, the client portal and remote access tools.
Do I need to register as an employer in a state where only one remote employee lives? Often yes, but the answer depends on the state. Confirm the specifics with that state's revenue and labor agencies before the first payroll, and see the multi-state payroll guide linked above for the general checklist.
Can a CPA licensed in one state serve clients in another state remotely? Usually, under that state's mobility or practice privilege rules, and the 2025 model law changes aim to make this depend on the individual's license. Firm-level rules for attest work are set by each state board, so check the board in the client's state before taking on audit or review engagements there.
Can a remote CPA firm operate without any physical office? Many do. Client meetings move to video or the client's location, and the firm's registered address and mail handling need a solution. Security and supervision then depend entirely on the controls described above.
Madras Accountancy supports US CPA firms with outsourced bookkeeping, tax preparation and accounting work delivered through secure remote access. To discuss how an outside team could fit into your remote CPA firm's workflows and security setup, contact our team.
The section 4960 excise tax is 21% of nonprofit pay over $1M. From 2026 it covers all employees. See the medical carve-outs, Form 4720 and a worked example.
The paid family and medical leave tax credit is permanent from 2026. See the 12.5% to 25% rates, the premium option, the 6-month rule and how Form 8994 works.
Opportunity zones become permanent in 2027 under the One Big Beautiful Bill. See the new deferral, rural bonus, and the 2026 handoff.
