What should an accountant’s initial inquiry form ask—and what belongs in a secure portal?

Keep first contact minimal

Ask for a name, business or household context where relevant, contact method, broad service category, and a short non-sensitive description. Give the visitor an option to say they are unsure.

Do not request Social Security numbers, full tax returns, bank details, or passwords in a general lead form. If the firm needs records to assess an engagement, provide instructions for a reviewed secure transfer after the appropriate onboarding step.

Check the firm’s tools and ownership

Ask who receives the form, what system stores it, who can access it, how long it remains, and whether submissions are forwarded to a third-party inbox. Then ask how the secure portal handles access, authentication, retention, and client support.

The IRS advises tax professionals to protect client data and maintain a written information security plan. Use current IRS guidance and the firm’s qualified security advisor; do not claim a particular form or portal is compliant without assessment.

1. Review every field and its recipient before collecting it.
2. Move tax records and identifiers to the firm’s approved portal.
3. Use IRS guidance and qualified review for the firm’s security plan.

Explain the handoff to the client

The confirmation should say that the firm received a request and will respond using the stated method. Tell clients when the firm will provide secure-portal instructions and how they should contact the firm if they are uncertain.

Test access controls, notifications, and mobile behavior with the firm before launch. Review the flow whenever a vendor, form, or file-transfer method changes.