Client Data Handling SOP

Document: FX-SOP-01  |  Version: 2.0  |  Owner: Security Owner (Partner)  |  Review cycle: annual, or on any significant change

1. Purpose

This SOP makes sure that every engagement handles client data in the same secure, documented and verifiable way, regardless of which team member performs the work or which country the client is in. It translates our Information Security Policy into specific steps that personnel follow and that clients can audit.

2. Scope

The SOP applies to all client engagements, including bookkeeping, accounting, payroll, tax preparation support, compliance filings, notices and litigation support, and outsourced staffing arrangements. It applies to all partners, employees, trainees and contractors, and to all client data in any form.

3. Definitions

• Client data: any information received from or about a client or its customers, employees, vendors or taxpayers, including financial records, tax data, bank statements, payroll data and personal identifiers.
• Approved channel: a method of exchanging data that has been agreed with the client in writing at onboarding, such as the client's portal, the client's own system, or a restricted cloud folder.
• Engagement file: the secure folder and records maintained for each client engagement, including checklists, review notes, query logs and deliverables.

4. Roles and responsibilities

Role	Responsibilities
Engagement Partner	Overall responsibility for the engagement, quality and client relationship; approves the engagement security plan.
Engagement Manager	Runs onboarding, requests and removes access, manages client communication and deadlines, maintains the engagement file, leads exit.
Assigned Accountant	Performs the work only in approved systems and folders and follows the engagement checklist.
Reviewer	Performs an independent quality review before anything is delivered to the client.
Security Owner	Approves access, maintains the access register, performs access reviews, leads incident response.

5. Procedure

Step 1: Engagement acceptance and onboarding

1. The engagement letter or Master Services Agreement and the Statement of Work are signed.
2. A mutual NDA is signed before any confidential information is exchanged. Where personal data will be processed on the client's behalf, a Data Processing Agreement is also signed.
3. The Engagement Manager completes the engagement security plan, recording: the systems to be used; the approved channel for data exchange; the data types involved; the retention period; jurisdiction-specific requirements (for example GDPR, UK GDPR, CCPA, the Australian Privacy Principles, UAE or Saudi PDPL); and the named team.
4. For US tax preparation work, the client confirms in writing that any taxpayer consent required under the Section 7216 regulations has been obtained before tax return information is shared with our team.
5. The Security Owner approves the plan and creates individual accounts for the named team, with MFA enabled. Each grant is recorded in the access register.

Step 2: Receiving client data

1. Data is accepted only through the approved channel. Documents sent by any other route (for example to a personal email address or a messaging app) are not opened for work; the sender is asked to resend through the approved channel and the stray copy is deleted.
2. Receipt is logged in the engagement file with the date and a description of what was received.
3. The Assigned Accountant checks completeness against the engagement checklist and raises a query for anything missing.
4. Data that is not needed for the work is returned or deleted, and the client is informed.

Step 3: Storage

1. Client data is stored only in the client's dedicated, access-controlled folder or in the client's own system.
2. Folder sharing is restricted to named individuals. Public links and "anyone with the link" sharing are not permitted.
3. Client data is never stored on personal devices, personal cloud accounts or removable media.

Step 4: Processing

1. Work is performed according to the engagement checklist agreed with the client, using the client's templates where provided.
2. Personnel work only on the clients they are assigned to.
3. Queries are raised and answered only through the approved channel and recorded in the query log.
4. Screens are locked when unattended; printing is avoided and any printouts are shredded after use.

Step 5: Review and quality control

1. Every deliverable is reviewed by a Reviewer who did not prepare it.
2. The Reviewer checks the work against the checklist, source documents and prior periods, and records review notes.
3. Review notes are cleared by the preparer and signed off by the Reviewer before delivery.
4. For tax returns prepared in support of a foreign licensed professional, the deliverable is marked as a draft for the client's review and signature.

Step 6: Delivery

1. Deliverables are sent only through the approved channel.
2. The client's confirmation of receipt is recorded in the engagement file.

Step 7: Retention, return and deletion

1. Data is retained only for the period stated in the contract or required by law.
2. At the end of the engagement, or on the client's written instruction, client data is returned or securely deleted from all locations, including shared folders and any temporary copies.
3. All access for the engagement is revoked the same day, and the access register is updated.
4. The Engagement Manager confirms deletion to the client in writing.

6. Access reviews

The Security Owner reviews the access register every quarter and whenever a person joins, leaves or changes engagement. Any access that is not needed is removed immediately and the review is recorded.

7. Exceptions

Any deviation from this SOP requires prior written approval from the Security Owner, a documented reason, a time limit and compensating controls. Exceptions are recorded in the exceptions log and shared with the client where they affect the client's data.

8. Incidents

Any person who suspects that client data has been lost, sent to the wrong recipient, accessed without authorisation or exposed through a compromised account or device must report it to the Security Owner immediately. The incident is handled under our Incident Response procedure.

9. Records

The following records are kept for each engagement: signed agreements and NDA; engagement security plan; access register entries; data receipt log; query log; review notes and sign-offs; delivery confirmations; and the exit and deletion confirmation.

10. Training and acknowledgement

All personnel are trained on this SOP at induction and sign an acknowledgement. The SOP is revisited in team briefings before busy seasons and whenever it is updated.

11. Workflow at a glance

Client data received through an approved channel; logged and stored in the client's restricted folder; processed by the assigned accountant; reviewed independently; delivered through the approved channel; retained for the agreed period; returned or securely deleted with written confirmation.