New Employee Onboarding Checklist

Lock in the role classification before provisioning. CPAs, EAs, and tax preparers need PTIN and state-license workflows; bookkeepers and admin staff don't. Misclassifying drives the wrong access bundle and creates rework.

Image the laptop with full-disk encryption (BitLocker or FileVault), endpoint protection, and the MDM profile required by the firm's Written Information Security Plan. IRS Pub 4557 requires this before the employee touches any client SSN.

I-9 must be completed within three business days of the start date — Section 1 by the employee on Day 1, Section 2 by the firm with original documents. Push these into Gusto, ADP, or whichever payroll platform the firm runs.

Capture signatures on the WISP, the firm's confidentiality agreement, and the acceptable-use policy. State data-breach notification laws (MA, NY, CA, TX) require documented training before access to client SSNs is granted.

Cover §10.21 (knowledge of error or omission), §10.34 (positions on returns), and §10.36 (procedures to ensure compliance). Apply to anyone who touches a return, not just signing preparers.

Capture prior-employer attest clients, immediate-family financial interests, and any held investments. Cross-check against the firm's attest client list before any audit, review, or compilation engagement is staffed. AICPA independence rules apply firm-wide, not just to the engagement team.

A signing preparer needs an active PTIN and a state license or EA enrollment in good standing. Non-signing staff who only enter data don't, but any return touched by an unenrolled preparer still falls under Circular 230.

Active PTIN must be on file before the employee signs any return. New PTINs take 15 minutes online; transfers from a prior firm only require updating the employer info. Renewals run Oct 16 through Dec 31.

Add a user seat in the firm's tax platform (UltraTax, Lacerte, ProConnect, or Drake) with the correct preparer profile and PTIN attached. New seats during tax season can take 24–48 hours — don't wait until the day fieldwork starts.

Add the user to the firm's QBOA team and Xero Partner organization with the right access level (Master Admin, Standard, or Time Tracker). Default to least-privilege; bump up only after the partner approves.

In TaxDome, SmartVault, or Liscio, set the user to engagement-level access — not firm-wide. Anyone with all-clients access is a WISP audit finding waiting to happen.

Pair on a real client close — bank rec, sub-ledger tie-out, AJEs, reporting package. Reading the close manual doesn't substitute for watching a senior actually work review notes through to clearance.

Cover the PBC list lifecycle in Suralink or TaxDome, the firm's review-note tiering (preparer, senior, partner), and how cleared notes get archived. New seniors blow this up by signing off on their own notes.

Required annually for all paid-preparer staff. Covers phishing, social engineering, encrypted email for SSN exchange, and breach-reporting obligations. Save completion certificate to the personnel file.

Review first-month workpapers, mentor feedback, and any review-note patterns. Surface tooling gaps now while they're still fixable rather than at the 90-day review.

Most state boards require 40 hours annually plus a state-specific ethics requirement. Set the hire up in the firm's CPE tracker (CCH, Checkpoint, or in-house) and confirm carry-forward credits from prior employer transferred correctly.