Dear Suzannah

Here’s the deal

Choose one job: create a missing-document checklist for a new small-business tax engagement. Do not ask the AI to decide tax treatment, determine that a return is ready to file, or invent a request based on what it thinks a client probably owns.

The October 20 IRS security reminder warned tax professionals about suspicious new-client and document-request messages and urged them to update their Written Information Security Plans. Keep the document review inside systems your firm has approved, not a random chat window with someone’s tax records pasted into it. See the IRS reminder.

What this actually helps you do

Your coordinator can compare a received packet against a preparer-approved checklist and send a short, accurate request after review. The useful result is fewer back-and-forth messages about the same missing page, without pretending that an AI-generated file list is a professional tax conclusion.

One niche use case: a local tax firm onboarding a small retailer

The retailer has uploaded monthly sales summaries, bank statements, payroll reports, and a prior-year return through the firm’s approved portal. The firm’s engagement checklist calls for specific periods. The AI finds some matching filenames, spots duplicates, and puts an uncertain payroll report in a review queue. A staff member opens the files, confirms the periods, and asks only for what is actually missing.

Exactly three benefits

Step by step: Build the missing-document check

1. Start with your engagement checklist. Have the assigned preparer approve the required document types and periods for this client. Do not use a universal list that assumes every business has the same accounts.
2. Limit what the tool can see. Use a firm-approved environment with role-based access, secure transfer, and appropriate retention rules. Ask your security lead to check whether the service and data use fit your Written Information Security Plan.
3. Map each file to one requirement. Capture document type, covered period, file identifier, and a short reason for the match. Treat vague filenames as uncertain, even if the model sounds sure.
4. Separate the exceptions. Use three labels: matched and verified, review required, or missing after review. Do not count duplicates as separate months.
5. Open flagged files. A staff member checks the actual content, dates, names, readability, and correct client. A zero-byte file, wrong tax year, or missing pages needs a human decision.
6. Approve and send one specific request. Confirm the client’s approved communication channel, remove unnecessary sensitive details from the message, and name the exact items required. Record who approved the request.

Tips and tricks

• Ask for a file identifier and page or period reference beside every proposed match.
• Use a short client-facing list, grouped by month or document type, rather than forwarding the AI’s notes.
• Keep the original upload and reviewer decision traceable under the firm’s retention policy.
• Try a made-up sample packet first, including one duplicate, one wrong year, and one blurred page.

Common mistakes

• Counting filenames instead of checking files: “December.pdf” might be November’s statement.
• Assuming unreadable means missing: Ask a person to decide whether the client should upload again.
• Sending tax records to an unapproved AI service: The FTC Safeguards Rule includes tax preparation firms among covered examples and requires an appropriate information-security program.
• Letting an AI-generated request go out untouched: It can ask for a document your office already has.

Human review checklist

• The requested document list matches this specific engagement.
• The AI used only approved files and access permissions.
• Every “received” item has a human-checked type and period.
• Duplicate, unreadable, and wrong-client files were flagged correctly.
• Only confirmed missing items appear in the outgoing request.
• The staff reviewer and approval date are recorded.

How to measure success

Run the process on a small set of packets and compare it with your current manual method. Track missing items caught before preparation, incorrect requests sent, staff review minutes per packet, and client follow-up rounds. Make sure faster reviews do not lead to more mistaken requests. Record a starting baseline and check again after several cycles.

FAQ

Glossary

Document intake

The process of receiving, organizing, and checking records a client provides.

Exception

A document or checklist item that needs a closer look, such as a duplicate or unclear date range.

Written Information Security Plan (WISP)

The documented security plan tax professionals use to protect client information.

Human sign-off

A named person’s approval after checking the actual documents and proposed next action.

Sources and further reading

• Thomson Reuters, third-quarter 2026 results, November 3, 2026. Notes the next-generation CoCounsel Tax, Audit & Accounting release and business demand.
• IRS, Security reminders and tools for tax pros, October 20, 2026. Covers suspicious document requests and basic security practices.
• IRS, Written Information Security Plans are essential for tax pros, June 16, 2026. Explains the WISP requirement and its practical purpose.
• Federal Trade Commission, Safeguards Rule guidance. Describes covered businesses, including tax preparation firms, and information safeguards.

For another example of checking what AI used before trusting its output, read AI Can Research the Market in Minutes. Make It Show Its Work. For access boundaries, see Your Maintenance AI Needs Its Own Access Log.