Before your practice sends its next request for tax documents, check the route a client will use. A working upload button is only part of the task: the right staff must receive the files, and other clients must not be able to open them.
The Tax Practitioners Board's data-security guidance recommends secure methods for receiving sensitive information and identity documents, with advice on controls suited to the practice. Start by agreeing which method your team will offer and who maintains it.
Follow one request from the client's side
Use a blank test document and accounts your practice controls. Open the invitation as the intended recipient, complete the upload and check where it arrives. Then confirm that an unrelated test account cannot open the same material.
Check the instructions as well as the software. A client should know which documents are needed, which address or service is expected, and how to get help if access fails. Give staff an approved recovery path so a login problem does not automatically become a request for ordinary email attachments.
Inspect the permission behind the link
If your practice uses Microsoft 365, a link's audience matters. Microsoft's sharing-link documentation distinguishes links available to anyone holding them from links restricted to specified people.
A link restricted to particular recipients is useful, but it is not a complete review of the file's access. Existing site or folder permissions can provide another route to the same document. Ask whoever manages the system to check both the link and the underlying permissions.
For a practice portal, ask the equivalent questions: which client account owns the request, who in the practice can see the upload, and what happens when access is removed?
Keep access aligned with current work
Review the people who can open client folders when staff, contractors or responsibilities change. Confirm who removes access and how the remaining team takes over work without sharing the departing person's password.
Make the same distinction when a job finishes: ending a sharing link and disposing of a business record are different decisions. Follow the practice's approved record-retention rules; do not delete client files simply to end access.
Microsoft's external-sharing guidance explains how to review and stop sharing. Have the responsible person confirm the result rather than relying on a link being old or hard to find.
Make the next request easier to handle
Agree one owner for the document-request process and one support contact for access problems. Keep the client instructions consistent across email, the portal and staff conversations. Recheck the process when the software or its sharing settings change.
For help with the IT responsibilities around client files, staff access and security, see managed IT for accounting practices. The accounting practice IT guide covers the wider questions to ask your provider.