Staff using approved tools only
Shows whether the approved option is good enough that people stop working around it.
Accounting and CPA firms · AI usage policy and governance
An AI policy that protects taxpayer data and still lets staff save time
Staff at most accounting firms are already using AI tools to draft client emails, summarize IRS notices, write Excel formulas or explain a code section. Some are doing it in free consumer accounts. That creates real exposure, because the firm holds Social Security numbers, bank details and full financial histories, and has obligations under the FTC Safeguards Rule and IRS Publication 4557.
How it often works today
- There is no written AI policy, or it is a general ban that staff work around with personal accounts on their phones.
- The written information security plan does not mention AI tools, so the firm cannot show how taxpayer data is protected in them.
- Staff are unsure whether they can paste a client's notice, trial balance or return data into an AI tool to get help.
- Reviewers do not know which work involved AI, so they cannot adjust their review for errors AI tools commonly make.
An AI use policy says which tools are approved, what data may be entered into each, how output must be checked, and who is accountable. We would draft it with your partners and IT provider, connect it to your written information security plan, configure tools to match, and train staff with real accounting examples, so the policy reflects how people actually work.
The improved workflow
Find out what is being used
An anonymous survey and a look at subscriptions and browser extensions show which AI tools staff use and for which tasks.
Approve tools and set data rules
Tools are classified as approved, limited or prohibited based on data terms, and data is classed, so staff know taxpayer identifiers never go into unapproved tools.
Write the policy and update the WISP
A plain-language policy covers approved uses, prohibited uses, verification and review, client communication and incident reporting, and the security plan is updated to match.
Configure accounts and devices
Enterprise accounts with training disabled, single sign-on, multi-factor authentication and blocks on consumer tools on firm devices make compliance the default.
Train staff with real examples
Short sessions show good and bad use on accounting tasks, such as summarizing a notice with identifiers removed, and the policy is reviewed after each season.
How we deliver this: AI automation for small business or fractional CTO leadership, scoped in writing and run over 90 days. See pricing or the sample scope.
What we would measure
Training completion
Supports both the policy and Safeguards Rule training expectations.
AI-related review notes
Errors traced to AI use tell you where the policy or training needs work.
Where people stay in control
- The policy is approved by the managing partner and checked by the firm's counsel or compliance adviser; InTheory does not provide legal advice.
- Taxpayer identifiers and client financial data are entered only into tools approved under the policy and recorded in the written information security plan.
- Any AI-assisted work product sent to a client or taxing authority is reviewed by credentialed staff under the firm's normal review process.
Example
Illustrative: a 30-person firm after tax season
For example, a 30-person firm runs a survey in May and learns that most staff use AI for email drafts and formulas, and a few have pasted notice text including SSNs. The firm approves an enterprise tool tied to Microsoft 365, prohibits consumer accounts for client work, adds AI to its WISP, and runs two training sessions before extension season. This is an illustrative example of the scope.
Tools typically involved
What the first 30 days look like
In the first 30 days we would survey staff AI use, review vendor terms for tools in use, read your current written information security plan and draft an approved tool list and policy outline for partner review, ideally completed before extension season.
Common questions
Does the FTC Safeguards Rule apply to AI tools?
The Rule applies to how your firm safeguards customer information, which includes any system that information goes into. AI tools that touch client data should be covered by your risk assessment, vendor oversight and written information security plan. Your counsel or compliance adviser can confirm specifics.
Can staff use AI to research tax questions?
Policies often allow it for general questions with no client data, as a starting point only. Output must be verified against primary sources or a professional research tool, since AI tools can be confidently wrong about tax law. The policy should say this plainly.
How often should the policy change?
Review it at least annually, ideally after busy season, and whenever you adopt a new tool or guidance changes. Tools and vendor terms change quickly, so the approved list will need more frequent updates than the core rules.
The business case
Does it pay for itself?
Illustrative defaults for an accounting firm. Replace them with your numbers.
What this workflow costs today
a month in staff time, before any lost sales
Monthly fee + assumed tools +
Break-even: new clients a month (at first-year value)
Or: staff hours recovered and redeployed
Break-even additional revenue
Value of +1 point of win rate
First 90 days, service fee
Worth a closer lookTest the assumptions
Illustration only, not a forecast or guarantee. Recovered staff time becomes a cash saving only if spending actually declines or the time goes into paid work. Tool costs are an assumption; we replace every number here with yours before recommending a scope.
AI usage policy and governance in other industries
Architecture firmsFinancial advisory firmsLaw firmsMedical and specialty clinicsNonprofit organizationsTax preparation offices
AI usage policy and governance: full guide
Related guides
Questions to ask a fractional CTOAI consultant red flagsGetting staff to adopt new toolsMicrosoft Copilot for small business
Terms used here
Next step
Bring one expensive workflow. Leave with a clear next step.
In 30 minutes we look at one recurring workflow, what it costs you today and whether there is a credible case to improve it. If there is not, we will say so.
Book a 30-minute workflow review
Not ready to talk? Take the 3-minute check
30 minutes with Phil or Martin. No technical brief, no pitch deck. Phil or Martin replies personally, usually within one business day.