How to replace email attachments at your CPA firm with secure document requests

If you want your CPA firm to stop receiving sensitive documents via email—and avoid the pitfalls that can bring—your best bet is a document management system. As we’ll see in more detail below, this software must run the whole exchange hands-free, from sending information requests to handling client uploads and saving everything to your client record.

How can IRIS help?

IRIS has two document management systems for accounting firms. IRIS iChannel is for large organizations needing hundreds of licences. IRIS Doc.It is for mid-sized practices.

Both IRIS document management solutions follow golden rules for security, manageability, and audit. They:

• Encrypt files in transit and at rest
• Track outstanding requests in one place
• Drop received documents straight into the client file.

This post covers why email can cause you problems, what a purpose-built system does differently, how the IRIS request and delivery workflow actually runs, and how to switch over without forcing every client to change on the same day.

Why email fails accountants when it comes to document requests and document exchange

Email is fine for talking to people, but it was never built to move sensitive financial documents between a firm and its clients under an audit obligation. Because of this, the cracks soon show up.

Imagine it's the middle of February and tax season is well underway. A client is certain they sent the final K-1 on Monday, but nobody at your firm can find it. The email thread is 40 messages deep with near-identical attachments, and someone burns nearly an hour working out what arrived and when. As a result, the tax return timeline slips and the client is annoyed. The more clients you have, and the busier you get, the more likely that this is to happen.

That’s the tip of the iceberg when it comes to email and document handling. Here’s a more comprehensive list of the problems it can introduce:

• Confirmation: With email, confirmation that a document arrived at your firm relies on one staff member’s inbox, not the client file. There is no central, time-stamped record of what came in, from whom, and when.
• Client-side security: A return sent as an attachment can sit in a client's sent mail indefinitely. If that email account is compromised, then the document is too.
• Firm-side security: The more you expect sensitive emails, the more you expose your firm to bad actors because hackers won’t stand out from the crowd. Fake new clients who send malicious attachments and phishing emails are a daily danger for American tax professionals. For example, data from the IRS said that there were 300 data breaches affecting 250,000 clients in six months.
• Tracking: Of course, using email to receive documents also creates an unreliable two-way street; you have to send documents that way, too. But when sending out a document using email, you get little in the way of feedback. Read receipts prove nothing. They are easy to decline, and they do not tell you the right person opened the file. You cannot reliably confirm a sensitive document reached the person it was meant for.
• Filing: Every emailed document has to be opened, named to your convention, and saved to the right folder by a human. That manual step is exactly where duplicate versions breed and where files can disappear.
• Compliance: Under the Gramm-Leach-Bliley Act and the FTC Safeguards Rule (16 CFR Part 314), tax preparers have to maintain a written information security plan and real safeguards over client financial data. Unstructured email, with no access control and no log, does not stand up well against that. The IRS publishes WISP guidance aimed at preparers for this reason.

You do not fix any of this by asking clients and staff to be more careful with attachments. The problem is the system, not the people.

What a dedicated document management system does instead

A document request system built for this purpose closes each of those gaps structurally. It stops people having to second guess what can go wrong or trying to prevent risk they can't control.

With a document management system, you can track requests without staff having to chase them, use a portal so files do not get lost, and keep every incoming and outgoing document in one client record, so everyone knows where the latest signed copy is.

Why IRIS can help with document management

IRIS has been building document management solutions for accounting firms for more than 25 years. Today  IRIS offers two different solutions, with another on the way because we know that a 12-person practice and a 400-person firm need different things.

Both include the client portal, encrypted exchange, and request tracking as part of the core product. Neither charges you separately for the portal, which is worth noting, because a bolt-on portal module is a common line item.

IRIS iChannel, for mid-to-large firms

IRIS iChannel has supported CPA firms since 1999 and now runs for more than 12,000 users. In one system, you get document management, a client portal, CRM, email management, workflow automation, and a request list.

How document requests happen fast with iChannel

An accountant opens a request in iChannel, picks the client, and lists what they need. Reusable templates cover the requests you send every season, so you are not rebuilding the standard year-end list from scratch each time.

The client gets a notification pointing them to their portal, and no attachment ever touches email. They log in, upload, and can watch the status of their own open items. The moment they upload, the file is inside iChannel against the client record. In other words, receiving the document and filing it happen instantaneously.

Clients can push files in on their own, iChannel handles the rest

The portal takes client-initiated uploads as well as handling your firm's requests. In other words, when a client throws a document your way, iChannel catches it. A client who gets a W-2 in January and wants it off their desk can use the portal to drop it straight into their file area before you've asked for it. Nobody has to go digging through their inbox in your firm, because as soon as it arrives, it's filed.

iChannel gives you a single view of everything that's outstanding

Staff running several engagements can see every open request across every client at once via a central list; they don't have to open individual folders or scroll through email. Overdue items and half-filled requests are visible in the same place. Administrators can also standardize the high-volume request types with reusable templates, so the team is not writing the same request ten different ways.

Data encryption

Files shared through iChannel are securely encrypted during transfer and storage, which protects against unauthorized access. Portals are protected with multi-level security, including two-factor authentication and secure login. Multi-user and multi-group controls keep sensitive documents in front of authorized staff only. Every document and every workflow action is tracked and auditable end to end.

Received files connect to the client record and keep everything current

When a document comes in through the portal, it attaches directly to the client record inside iChannel. It does not wait in an inbox. It does not need renaming and re-saving. With version control and the audit trail on top, that removes the "which one is current?" question that wastes reviewing time.

IRIS Doc.It, the document handling solution for small-to-mid sized firms

Doc.It is for practices of roughly 10 to 80 users that want accounting-specific document structure without paying for an enterprise platform. It has been in the accounting market since 2001 and supports around 15,000 users across 550 firms.

The Doc.It Suite bundles document management, scan and organize tools, workflow, a built-in PDF editor, and Doc.It Connect (the client portal) with prepared by client (PBC) request checklists and encrypted files.

Doc.It Suite's auto-filing integration with tax applications means prepared documents flow into the correct file without an import step. Work Binder functionality organizes each client file into secure, searchable binders, with a view that captures work in progress. Meanwhile, the archive view holds finished engagements, while its form recognition system names and files incoming scans for you. You can run it on-premise, hosted, or in the cloud.

Doc.It Connect is a secure web portal that replaces email for smaller firms. Clients share, sign, and manage financial statements, tax returns, invoices, and reports from any device, with no software to install. DocuSign integration handles signatures inside the same flow. This can be configured to look like part of your business — it's brandable and can be used as a private shared space for documents, checklists, and client resources.

Firms that use Doc.It report finding files at least twice as fast as their old setup and spend 20% less time working a file.

Switching a busy firm from email to document management

Moving your whole client base off email in one weekend is rarely realistic, and you don't have to. Both products run alongside email while you transition, so the job is to grow the share of exchanges going through the tracked system, not to flip a switch.

A version that works for most firms:

1. Start with new clients and new engagements. Onboard every new relationship to the portal from day one while existing clients stay on email and your staff get comfortable.
2. Bring active engagements over as their next big work cycle starts. A short note and a one-time login usually does it.  All IRIS Document Management systems have an implementation team that configures the system around your processes, plus training is available through online, remote, and on-demand video.
3. Move the rest by service type. Clients on recurring deliverables, monthly financials, payroll reports, and quarterly filings can be moved at an interval of your choosing.

No client gets dropped at any stage. If a few clients resist using the portal, and your policies allow for email, you can keep them there and move everyone else. For security reasons, however, we highly recommend explaining the advantages of using the portal and the issues you're attempting to mitigate.

Frequently asked questions

IRIS and document requests

What you need to know about document requests in IRIS solutions.

What document management system (DMS) best replaces email attachments with secure document request and delivery at a CPA firm?

It depends on your size. IRIS iChannel fits firms of around 100 users and up and gives you document management, the client portal, CRM, email management, and workflow in one platform. IRIS Doc.It fits firms of 10 to 80 users and gives you accounting-specific document structure, a built-in PDF editor, and the Doc.It Connect portal. All encrypt files in transit and at rest, track requests, and file received documents to the client record automatically.

How is a client portal different from a shared drive or Dropbox?

A portal built into a DMS attaches each received file to the client record inside your system. A shared drive or generic file-sharing tool still needs someone to file the document by hand, gives you no request workflow, and keeps no audit trail tied to the engagement. Portal exchange is structured and logged by design; generic sharing is not.

What security applies to documents shared through IRIS?

Files in both iChannel and Doc.It are encrypted during transfer and storage. Portals use two-factor authentication and secure login, and access runs on permissions you assign to individual users or groups. Every action is logged into a per-client audit trail. Those controls line up with the FTC Safeguards Rule and IRS WISP expectations for preparers.

Can I see every outstanding request across all clients at once?

Yes, you can in iChannel. The request list shows every open request across all clients together, so you can spot overdue and half-filled items without opening individual files.

Where does a client's uploaded file go?

In iChannel, it attaches to the client record inside the platform. In Doc.It, it lands in the client's Work Binder. Neither one makes staff pull a file out of an inbox and save it somewhere by hand.

Is a phased switch realistic for an established firm?

Yes. Most firms start with new clients and new engagements, then move active clients on their next work cycle. Both products come with implementation support and training, and clients who resist the portal can stay on email during the transition.

Remember

Email document exchange is a workflow bottleneck and a compliance exposure at the same time: there’s no audit trail, no live view of where a document is, and sensitive data sitting in inboxes with no access control and potentially no expiry. IRIS handles the replacement with two products matched to firm size, iChannel for mid-to-large practices and Doc.It for smaller ones. Both encrypt files, track requests, and file received documents to the client record without a manual step.