Audit workflow software: the client portal a small CPA firm needs

An audit client portal, the part of audit workflow software your clients actually see, is the place they deliver PBC items: the bank statements, schedules and agreements on your request list. For a large firm it is usually part of an engagement suite. For a firm of five or fifteen people doing nonprofit, HOA and private-company audits, the question is narrower: what problem do you actually need solved, and what will your clients put up with?

This guide walks through what the portal in any audit workflow software should do, the security questions worth asking, and the cases where email and a shared folder are still fine.

The problem a portal is meant to solve

Most small firms already have somewhere for files to land: email, a shared drive, a file-sharing link. Files are rarely the bottleneck. The time goes into three other things:

• Knowing what is still missing. Rebuilding the outstanding list from email threads before every status meeting.
• Chasing it. Writing the same follow-up emails to the same people, engagement after engagement.
• Matching files to requests. Working out which attachment answers which line of the PBC list.

A portal earns its cost when it removes those three jobs. One that only replaces the shared folder moves files to a new place and leaves the chasing to you.

What to look for

Judge any option, including the one you already use, against the work you do today:

Client effort deserves more weight than it usually gets. A small nonprofit's executive director who sees the audit once a year will not enjoy setting up a login for it. Every extra step between the email and the upload button is a reason to put it off.

Security questions to ask

Your clients' files include bank statements, payroll registers and loan agreements, and you owe those clients confidentiality. Ask any vendor, and expect clear answers:

• Encryption. Are files encrypted in transit and at rest?
• Email attachments. Are files ever sent as email attachments, or only through the portal?
• What the client link can do. Can someone holding a client's link download earlier files, or only upload?
• Access log. Is every download recorded with who and when, and can you see that log?
• Retention. When are files deleted after the engagement closes, and can you delete them sooner?
• Sensitive data. What happens if a client uploads something you should not hold, such as a census file with Social Security numbers?
• AI. Are files processed or used to train AI models?
• Assurance reports. Does the vendor have a SOC 2 report, and will they share it? If not, what do they describe instead?

There is no single right answer to each question; what fits depends on your firm's policies and your clients. What matters is that the vendor answers in writing and that the answers match how the product actually behaves. Your firm's own policies, and any requirements in your engagement letters, decide what is acceptable.

Kinds of options

Small firms usually end up with one of these:

• Email and a shared folder. No cost and no learning curve. Works for a handful of engagements a year, with one organized person tracking the list in Excel. Breaks down when the chasing takes more than an hour a week.
• A general client portal. Often bundled with practice management or tax software. Good for document storage and e-signatures. Check whether it understands a PBC list, with items, owners and due dates, or only folders.
• An audit request platform. Built around request lists, often alongside workpaper or engagement software. The most complete, and usually priced and sized for larger teams.
• A focused request chaser. Takes your existing list, sends each contact their items, follows up, and reports status, without replacing your workpapers or file storage.

When email and Excel are enough

If you run a few engagements a year, every client has one contact, and items reliably arrive within a week of asking, a well-kept PBC list in Excel and a shared folder may be all you need. The PBC list template guide gives you columns and a days-late formula that do most of the tracking.

The signs you have outgrown it: staff spend hours a week on follow-up emails, fieldwork starts late because of a handful of items, or partners regularly ask "what is still missing?" and nobody can answer without searching.

Where PBC Nudge fits

PBC Nudge is a focused request chaser for small audit firms. You upload the PBC list you already use in Excel, and each client contact gets one link that shows only their items, with no login. Contacts get reminders until each item arrives, up to six, and you see what is outstanding by contact and days late, exported back to Excel.

On security, it publishes what it does rather than claiming a certification it does not have: it has no SOC 2 report. Files are encrypted at rest and never attached to emails, client links accept uploads and never show earlier files, every download is logged, files are deleted 30 days after you close the engagement, and no AI reads client files. A spreadsheet that looks like it holds Social Security numbers is held back and you are told. The details are on the security page.