The Temp With the Tired Laptop: A Device-Level Risk Audit for Tax Season Hires

Every January, accounting firms across the United States perform the same ritual. They hire a wave of seasonal preparers — retired CPAs looking for a few months of work, accounting students on winter break, contractors sourced through staffing agencies — and hand them access to client returns, Social Security numbers, and W-2 data. Almost nobody inspects the machines those people bring with them.

That omission deserves scrutiny. A firm can have a well-configured VPN, a documented incident response plan, and a clean IRS e-file authorization letter, and still be undermined by a single unmanaged laptop purchased in 2019 and running an OS patch from last spring.

The Endpoint You Don't Own Is Still Your Problem

There's a persistent belief among small-firm partners that if the temporary hire uses their own device, the firm's security obligations stop at the application layer. Regulators and insurers disagree. Under the FTC Safeguards Rule and the expectations embedded in IRS Publication 4557, any system that touches taxpayer data — including a contractor's personal laptop reaching into your practice management software — falls within the perimeter you're expected to govern.

The practical reality is worse than the theory. Seasonal staff are typically onboarded in a rush, given credentials and a video call's worth of instruction, and set loose before busy season volume hits. Device posture checks, if they exist at all, are a checkbox on a form nobody verifies. The result is a fleet of endpoints with unknown patch levels, unknown antivirus status, unknown browser extensions, and — critically — unknown VPN hygiene.

Three Failure Modes We See Repeatedly

The stale tunnel. A contractor installs the firm VPN client, saves the profile, and then also keeps a consumer VPN active on the same machine for personal browsing. Split tunneling rules conflict, DNS leaks between the two tunnels, and the firm's traffic occasionally exits through an endpoint nobody at the practice authorized.

The shared machine. A seasonal preparer works from a family laptop that a spouse uses for online banking and a teenager uses for gaming. Credential theft on that machine doesn't require the preparer to make a mistake; it requires only that someone else in the household does.

The forgotten profile. Come April 16, the temp's access is deactivated in the practice management system, but the VPN profile, cached client files in the downloads folder, and synced browser passwords remain on hardware the firm will never see again.

Each of these is a governance failure, not a technology failure. And each is fixable with a checklist.

A Seasonal Device Checklist That Holds Up

Onboarding — before the first client file is touched:

• Verify the device meets a written minimum standard: supported operating system version, disk encryption enabled, endpoint protection active and reporting.
• Require the firm VPN profile to be the only tunnel installed, with kill switch enabled and split tunneling configured to firm policy.
• Confirm automatic screen lock and a strong device passcode. This takes four minutes and prevents most opportunistic exposure.
• Document the device in an asset register — owner, serial or identifier, date approved. If you can't list which machines touched client data this season, you can't scope an incident later.

During the engagement:

• Restrict preparers to browser-based or virtualized access to client data wherever feasible, so nothing meaningful persists locally.
• Schedule a mid-season spot check. A fifteen-minute screen share to confirm the VPN is still the only tunnel and patches are current catches most drift.

Offboarding — the step firms actually get wrong:

• Revoke VPN credentials the same day the engagement ends, not at the end of the week.
• Instruct — in writing — that the VPN profile be removed, and verify where your tooling allows.
• Require confirmation that locally cached files, browser-saved passwords, and email caches have been deleted. Better yet, design the workflow so there's nothing local to delete.
• Keep the asset register entry closed with a date and the name of the person who confirmed decommissioning.

Make It a Condition of the Engagement

The cleanest way to enforce this without becoming the department of laptop police is contractual. Seasonal onboarding paperwork should state, in plain terms, that device approval is a precondition of system access, that the firm may verify posture, and that offboarding includes profile removal and local data deletion. Staffing agencies supplying contractors should be asked to warrant these controls — and most will, once asked.

None of this is exotic. It's the device-level equivalent of the engagement letter: unglamorous, occasionally awkward, and the reason you sleep in April. The weakest endpoint in your firm this tax season probably has a sticker on its lid and an owner who started three weeks ago. Audit it like you'd audit any other account that matters.