A Signed Engagement Is Only the Beginning
Imagine a small firm bringing on a new monthly bookkeeping client. The engagement is signed, but the delivery team still needs the approved scope, access to the right systems, opening records, and a person responsible for the first close.
This is an illustrative workflow, not a client case study. It shows where automation can help—and where the team still needs to decide.
| What happens | What the workflow does | What a person decides |
|---|---|---|
| The engagement is signed | Checks for signed engagement and internal acceptance before starting setup | Whether the firm accepts the client and scope |
| Setup begins | Creates tasks from the approved service template and assigns owners | Whether nonstandard terms require a different checklist |
| Access is requested | Routes the request to the approver and records its status | Who needs access and which permissions they receive |
| A statement arrives for the wrong period | Records receipt and keeps the item open for review | Whether the document is usable or needs replacing |
| The first close approaches | Shows the delivery owner completed items and unresolved exceptions | Whether work can begin and who owns the remaining gaps |
People should approve client acceptance, scope, sensitive access, and readiness to begin work. A welcome email or a changed CRM stage should not silently make those decisions.
Keep the Setup Status in One Place
The coordinator needs to answer a simple question: what is holding this client up?
Use one onboarding record with the client and engagement IDs, approved scope reference, assigned owner, due dates, access status, and open exceptions. Link to contracts and documents in the firm's approved systems. Keep passwords and sensitive document contents out of task notes and workflow logs.
Separate requested, received, reviewed, and accepted. If an upload automatically marks an item complete, the delivery team may discover the wrong statement only when it tries to use it.
Onboarding finishes when the delivery owner acknowledges the handoff, including any exceptions they have agreed to take on. Creating the tasks is an intermediate step.
A Practical Eight-Step Onboarding Workflow
1. Release onboarding from an approved event
The trigger validates that the required acceptance evidence exists and records who released the workflow. If an engagement is unsigned, the client is declined, or an approval is missing, the workflow stops and tells a named owner what must be resolved.
2. Create the client and engagement records
Create or update records using stable identifiers. Check for possible duplicates before creating a second client. Copy only approved structured fields. Names that are similar, entity changes, multiple engagements, and related parties should route to review instead of being merged automatically.
3. Apply the correct onboarding template
Select the checklist from the approved engagement type, entity, service, and timing rules. A person should review material additions, exclusions, or nonstandard terms. The workflow may instantiate tasks; it should not infer the scope from a sales email or model summary.
4. Assign owners, dates, and escalation paths
Every required item needs a current owner and a due or review condition. Separate client actions from firm actions. Define who receives an alert when an owner is missing, a due date is impossible, or an item remains unresolved.
5. Provision only approved access
Create standard workspaces, groups, or permissions from approved roles. Require additional approval for privileged, financial, administrative, or unusually broad access. Test that intended users can reach what they need and that unintended users cannot.
The FTC's current Safeguards Rule guidance tells covered financial institutions to implement and periodically review access controls, evaluate service-provider safeguards, and use multi-factor authentication for access to customer information, subject to the Rule's requirements and exceptions. Each firm should determine which laws and professional obligations apply to its practice.
6. Request setup information through approved channels
Issue one clear set of instructions that points to the authorized portal, form, or document system. Keep taxpayer identifiers, account details, and document contents out of subject lines, chat alerts, and general workflow logs.
The detailed document-collection automation guide explains how to use a request register, distinguish receipt from acceptance, send reminders from current status, and route document exceptions. Client onboarding should call that controlled process rather than rebuild it inside a welcome workflow.
7. Review exceptions and readiness
Before release to delivery, a person reviews unresolved scope questions, missing approvals, access failures, rejected setup items, and unusual risk indicators. The workflow can assemble the evidence and enforce the stop; it should not waive the exception because a deadline is approaching.
8. Hand off and acknowledge ownership
Produce a concise handoff that identifies the approved scope, engagement owner, delivery owner, required dates, granted access, accepted setup items, remaining exceptions, and links to authoritative records. The receiving owner acknowledges the handoff. Onboarding then closes or remains open with named exceptions instead of disappearing when tasks were created.
Give AI a Supporting Role
AI may suggest a category or summarize an intake response for review. It should not accept the client, interpret the engagement letter, grant access, or waive a missing item. The person making that decision needs the original record and a clear way to correct the suggestion.
For access design, NIST SP 800-63B provides technical guidance on authentication. Use it alongside the firm's applicable requirements when deciding how people sign in and which access needs stronger controls.
Design Exceptions Before the Happy Path Goes Live
Onboarding failures are normal operational states. Define what stops, who is alerted, and how the workflow resumes.
| Exception | Safe workflow response | Human decision |
|---|---|---|
| Missing signature or acceptance | Stop record creation and notify the onboarding owner | Whether the evidence is sufficient to proceed |
| Possible duplicate client | Preserve both records and queue comparison | Whether to merge, relate, or keep separate |
| Scope mismatch | Freeze affected tasks and show the conflicting sources | Which approved scope controls |
| Access provisioning failure | Revoke partial grants when appropriate and alert an administrator | Whether to retry, change the role, or use an approved alternative |
| Sensitive data in the wrong channel | Stop propagation, restrict visibility, and follow the firm's incident process | Required containment and notification steps |
| Missing owner or impossible date | Keep onboarding open and escalate | Who owns the work and what date is authorized |
| Client pauses or withdraws | Disable pending actions and preserve the activity history | Whether to close, retain, or resume the engagement |
Alerts should carry identifiers, status, and a secure record link—not copied documents, credentials, or unnecessary client details. A workflow must also have a documented way to disable it without deleting the evidence needed to understand what happened.
Security and Auditability Are Workflow Requirements
Client onboarding creates accounts, moves information, and establishes who can see what. The map should identify:
- ·where client and engagement data are authoritative;
- ·which accounts can create, read, change, export, or delete records;
- ·where connection secrets are stored;
- ·what appears in logs and notifications;
- ·how access is approved, reviewed, corrected, and revoked;
- ·which third parties process customer information;
- ·how long onboarding records are retained; and
- ·who can pause the workflow during an incident or scope dispute.
For tax practices, the IRS Protect Your Clients; Protect Yourself program points tax professionals to written information security plan resources and data-security guidance. The article does not determine whether a specific firm is covered by a rule or whether a workflow makes it compliant; the firm must confirm its own obligations and controls.
Configure, Connect, or Redesign?
Configure the existing practice-management platform when it already owns client acceptance, onboarding templates, assignments, permissions, and status. Adding a second orchestration layer without a clear gap can create competing records.
Connect systems when the approved process crosses real boundaries—for example, a CRM records acceptance, an engagement system owns scope, Microsoft 365 hosts internal workspaces, and practice management owns delivery. The connection should move only the approved fields and preserve each system's authority.
Redesign the process before automating when staff cannot agree on the start state, required setup, approval authority, or finish line. The guide to what an accounting firm should automate first offers a practical selection test.
Scope a Reviewable First Build
A useful first scope might start when an authorized person records acceptance and end when one delivery owner acknowledges a complete onboarding package. It could connect one acceptance or engagement system, one workspace or practice-management system, and one secure intake path.
The signed specification should define:
- ·the trigger and finish condition;
- ·authoritative records and allowed fields;
- ·engagement templates and owners;
- ·normal access roles and approval thresholds;
- ·required intake items and review states;
- ·exception owners, alerts, and resume paths;
- ·test cases and prohibited actions;
- ·monitoring, disablement, and handoff; and
- ·administrative ownership after implementation.
Atkins CPA's CPA-led workflow automation for accounting firms starts with a free 30-minute mapping call. You keep the finished workflow map either way. When the workflow is a fit, a fixed quote arrives within 48 hours. Most quick-win builds are $4,000-$6,000 for one defined workflow, up to three connected systems, standard alerts and error handling, one revision, and a recorded walkthrough and handoff in a dedicated managed environment with client-owned access and a path to take over administration. See how automation scope affects cost before the call.
The guarantee is limited to the automation working as written in the signed specification. It does not guarantee faster onboarding, client adoption, security, compliance, savings, ROI, revenue, or any other outcome.
Start With the Handoff That Keeps Getting Missed
Bring one recurring setup problem to the mapping call: the unassigned task, the missing access, or the welcome email sent before anyone checked the scope. Trace that problem from approval to the person doing the work. That gives the first build a clear job and the team a practical way to test it.
Frequently asked questions
What parts of CPA firm client onboarding should be automated?
Good candidates include creating an onboarding record after approval, copying approved scope into task templates, assigning owners, creating standard folders or workspaces, issuing secure intake instructions, tracking required setup items, sending status alerts, and producing a handoff summary. Client acceptance, engagement terms, access decisions, unusual risks, and readiness to begin work should remain named human approvals.
When should an automated onboarding workflow start?
Use an explicit approved event, such as a signed engagement plus an internal acceptance decision. A proposal sent, payment method entered, email received, or CRM stage changed by mistake should not independently authorize setup or client work. The trigger should be testable, attributable to an authorized person, and reversible when the engagement is paused or declined.
Should AI approve new accounting firm clients?
No. AI may summarize non-consequential intake information or suggest routing for review, but it should not accept a client, interpret engagement terms, approve conflicts or risk, grant sensitive access, or decide that required information is complete. Those decisions need accountable people, explicit criteria, and an audit trail.
How should access be handled during client onboarding?
Create access from approved roles, grant only what the engagement requires, use the firm's approved authentication controls, record who authorized each grant, and include a correction and revocation path. Do not copy credentials into email, task notes, workflow logs, or a builder's personal computer. Access should be reviewable after onboarding instead of becoming permanent by default.
Can Atkins CPA build a client onboarding workflow for a CPA firm?
Yes, when one onboarding workflow can be clearly scoped. The current offer begins with a free 30-minute mapping call. The firm keeps the workflow map, and a fixed quote arrives within 48 hours when the build is a fit. Most quick-win builds are $4,000 to $6,000 for one workflow with up to three connected systems and the implementation terms on the offer page.
