Document Destruction Compliance for CPA & Accounting Firms

1. Why CPA Firms Carry Unique Document Destruction Obligations

A client who brings their tax documents to a CPA is doing something the law recognizes as significant: they are disclosing private financial information — income, assets, debts, business dealings, family circumstances — in the context of a professional engagement that carries a legal duty of confidentiality. That duty does not end when the engagement concludes, when the return is filed, or when the file is moved to storage. It follows every record the firm ever held, through the final act of disposal.

The AICPA Code of Professional Conduct, Section 1.700.001 — the Confidential Client Information Rule — prohibits members in public practice from disclosing any confidential client information without the client’s specific consent. The AICPA’s own privacy checklist makes the implication for disposal explicit: hard copy paper documents must be shredded, and electronic records must be rendered unrecoverable.

Confidential client information is defined broadly: any information obtained from the client that is not available to the public. This encompasses not just tax return data but financial statements, business records, payroll information, and any other material a client shared in the context of an engagement. The duty to protect it — through secure disposal — applies to all of it.

IRC Section 7216 — Criminal Exposure for Tax Return Information

Tax return information carries an additional layer of protection under the Internal Revenue Code. IRC §7216 and its implementing regulations (Treas. Reg. §§301.7216-1 through 301.7216-3) prohibit any person who is engaged in the business of preparing tax returns from knowingly or recklessly disclosing or using tax return information other than to prepare, assist in preparing, or provide services in connection with the preparation of returns.

The penalty for willful unauthorized disclosure of tax return information is criminal: a fine of up to $1,000, imprisonment of up to one year, or both. Civil monetary penalties under IRC §6713 may also be imposed. Improperly discarded tax documents — left recoverable in recycling bins or passed to an uncertified vendor — constitute an unauthorized disclosure under this statute.

2. The FTC Safeguards Rule — The Compliance Framework Most CPA Firms Missed

The most significant development in CPA firm data security compliance in recent years is not an accounting standard — it is a Federal Trade Commission rule that most accounting firms never expected to apply to them.

The FTC’s Standards for Safeguarding Customer Information (the Safeguards Rule, 16 CFR Part 314), originally promulgated under the Gramm-Leach-Bliley Act, was substantially amended in 2021 and its revised requirements became fully effective on June 9, 2023. The Rule now explicitly classifies CPA firms and tax preparers as “financial institutions” because tax preparation is classified as a financial activity under GLBA.

The Rule requires covered financial institutions — which includes your CPA firm — to develop, implement, and maintain a comprehensive Written Information Security Program (WISP). One of the nine required program elements is the secure disposal of customer information. The specific disposal requirement (16 CFR §314.4(f)(2)) requires covered entities to securely dispose of customer information no later than two years after last use, unless law requires longer retention. Physical shredding of paper records and certified physical destruction of electronic media are the accepted methods of compliant disposal.

The Penalty Structure Most Firms Don’t Know About

Beyond fines, a documented breach resulting from inadequate security measures can affect a firm’s ability to e-file, jeopardize PTIN certification, trigger malpractice coverage disputes, and result in loss of client trust that effectively ends the practice.

3. IRS Publication 4557 — What the IRS Itself Recommends

IRS Publication 4557, Safeguarding Taxpayer Data: A Guide for Your Business, addresses the practical steps tax professionals should take to protect client data. The IRS explicitly states that proper disposal of records is key — and that paper documents should be shredded. For electronic media, the IRS recommends methods consistent with NIST Special Publication 800-88, which identifies physical destruction as the Destroy standard — the highest and most certain level of sanitization.

Compliance with IRS Publication 4557 is not optional for firms holding PTIN credentials. It has been required on PTIN application and renewal forms since 2019. A firm that cannot demonstrate compliant disposal practices in the event of an IRS investigation has both a regulatory and a licensing problem. Our IT asset disposal service provides the NIST 800-88 Destroy-level physical destruction and serial-number documentation that satisfies these requirements for electronic media.

4. CPA Firm Document Retention Schedule

Documents can only be destroyed once their retention period has been met. The following schedule reflects widely accepted standards for accounting and tax practices based on IRS audit windows, applicable statutes of limitations, professional liability considerations, and AICPA guidance. The full Massachusetts context is in our document retention schedule by industry.

5. The Risks of Non-Compliant Disposal

Professional Discipline and License Risk

A complaint to the Massachusetts Board of Public Accountancy (MBPA) or the New Hampshire Board of Accountancy arising from improper disclosure of client information can result in investigation, public censure, license suspension, or revocation. The AICPA can also initiate ethics proceedings. Under the AICPA Code, a member who fails to protect confidential client information — through inadequate disposal — may be found to have violated the Confidential Client Information Rule. The supervising CPA bears professional responsibility for the disposal practices of nonlicensed staff at the firm.

FTC Enforcement Action

The FTC actively enforces the Safeguards Rule. An investigation triggered by a data breach or a client complaint can result in civil penalties, consent orders requiring ongoing monitoring, and reputational damage that affects the firm’s ability to retain and attract clients. A breach notification event — now required under the May 2024 amendments to the Safeguards Rule for incidents affecting 500 or more customers — is public and reportable to the FTC within 30 days.

IRS Consequences — PTIN and E-File Privileges

The IRS has the authority to sanction tax return preparers under Circular 230, including suspension and disbarment from practice before the IRS. A firm found to have violated IRC §7216 through improper disclosure of tax return information — which includes improperly disposed records — can lose its ability to e-file on behalf of clients and have its PTIN revoked.

Malpractice Insurance and Civil Liability

Professional liability carriers are increasingly scrutinizing data security practices at renewal. A firm that cannot demonstrate a written information security program, a documented vendor due diligence process, and a consistent Certificate of Destruction record may face higher premiums, coverage exclusions for data breach events, or non-renewal. If client data is recovered from improperly discarded records and harm results, the affected client may have a civil claim against the firm and its principals.

6. The Certificate of Destruction — Your Compliance Record

The FTC Safeguards Rule, AICPA guidance, and IRS Publication 4557 all share a common thread: documentation. A compliant disposal program is not just a shredding program — it is a documented shredding program. The Certificate of Destruction is the document that proves your firm met its obligations.

When the FTC investigates non-compliance, a documented WISP with a consistent trail of Certificates of Destruction demonstrates a good-faith compliance program. When a malpractice insurer evaluates your risk profile, that documentation is the evidence of due diligence. When the AICPA notes that a key factor in evaluating a potential breach is “whether the member had processes and procedures in place to ensure that client data were secure” — a Certificate of Destruction is the evidence of that process.

7. Building a Compliant Shredding Program for Your Accounting Firm

A compliant document disposal program for a CPA firm does not require significant ongoing cost. It requires clear procedures, consistent execution, and a certified vendor who provides proper documentation. The following checklist is designed for the office manager or administrator responsible for the firm’s records management program.

• ✓Create or update your WISP. The FTC Safeguards Rule requires a Written Information Security Program. Your WISP must include a secure disposal provision specifying how and when client records are destroyed. IRS Publication 5708 provides a template. Your state CPA society may provide a Massachusetts-specific version.
• ✓Establish a formal retention schedule. Document specific retention periods for each record category your firm maintains. Sign off at the managing partner level. Update annually or whenever applicable regulations change. See our Massachusetts retention schedule for the full framework.
• ✓Select a certified shredding vendor and document your due diligence. The AICPA has explicitly noted that using an outside vendor does not eliminate your responsibility. Select a provider with BBB accreditation, HIPAA certification, and a notarized Certificate of Destruction on every job. Document your selection criteria.
• ✓Execute a written confidentiality agreement with your vendor. AICPA Rule Interpretation 1.700.040 states that confidentiality is presumed to be threatened whenever a CPA uses a third-party service provider. A written confidentiality agreement with your shredding vendor addresses this presumption.
• ✓Place locked security consoles throughout the firm. Tax files, workpapers, and client correspondence should never be left on open desks or in accessible waste bins. Locked consoles at every workstation and in common areas ensure that sensitive material is secured pending scheduled destruction.
• ✓Schedule regular shredding service. Monthly or quarterly scheduled pickup is appropriate for most mid-size firms. The FTC Safeguards Rule requires disposal no later than two years after last use — a regular scheduled program ensures compliance without relying on ad-hoc purges.
• ✓Conduct an annual large-volume purge for records reaching end of retention. Most CPA firms have filing rooms full of records that passed their retention date years ago. Our annual purge service issues a Certificate of Destruction covering every closed file destroyed and reduces breach exposure and storage costs simultaneously.
• ✓Include electronic media in your disposal program. Computers, laptops, tablets, external drives, USB drives, and backup tapes all contain client data that must be certified-destroyed at end of life. Software erasure is not sufficient for SSDs. Our IT asset disposal service provides physical destruction with a serial-number Certificate of Destruction.
• ✓File every Certificate of Destruction. Maintain a destruction log linking each Certificate to the records it covers. These documents are your WISP audit trail. Your professional liability carrier should be aware that this documentation exists.
• ✓Train all staff annually. Under the FTC Safeguards Rule, your information security program must include staff training. Document the training, the date, and the attendees. Make clear that improper disposal of client records is not an administrative oversight — it is a professional violation with personal professional consequences.

Scheduled Service vs. Annual Purge: What Works for Accounting Firms

8. Serving CPA Firms in Cambridge, Lexington, Woburn, Wilmington, and Lowell

Our Tewksbury MA facility serves accounting and tax practices throughout Greater Boston and the Merrimack Valley. The communities listed below are all within easy reach for drop-off or scheduled pickup service.

All service areas include pickup under documented chain of custody, locked vehicle transport, same-day industrial shredding at our certified Tewksbury facility, and a notarized Certificate of Destruction within 24 to 48 hours. Call (978) 636-0301 for the exact transport fee to your firm’s address before you book.

9. Why CPA Firms in Greater Boston Choose Neighborhood Parcel

AICPA Rule 1.700.040 — Vendor Due Diligence Is Your Responsibility

AICPA Rule Interpretation 1.700.040 establishes that when a CPA uses a third-party service provider, the CPA should either enter into a contract with the provider to maintain confidentiality or obtain client consent. This means your choice of shredding vendor is a professional responsibility decision, not merely an administrative one. We provide the documentation you need to satisfy this obligation: a notarized Certificate of Destruction, a signed confidentiality agreement on request, BBB A+ accreditation, HIPAA certification, and 17+ years of operation with zero documented data breaches.

Publicly Posted Pricing — No Invoice Surprises

Our rates are published at mydocumentshredding.com/paper-shredding-rates. The price quoted before service is the price on your invoice. CPA firms billing clients for administrative costs have no margin for vendor invoices that exceed quotations — and cannot afford the professional embarrassment of explaining an unexpected charge to a partner.

GSA Contractor — Government and Institutional Clients Welcomed

We have held GSA contractor status since 2010, meaning CPA firms with government agency clients, public authority engagements, or federally funded nonprofit audit clients can represent to those clients that their materials are handled by a federally vetted provider under documented chain of custody.