LVP maintains or intends to maintain a written information-security program appropriate to the size, scope, complexity, and sensitivity of its operations. Tax professionals are expected to maintain written information-security safeguards, and tax preparation firms are among businesses subject to applicable federal information-security requirements.
Safeguards may include designated responsibility for information security and incident response; risk assessment and periodic review; personnel training and confidentiality requirements; access based on job responsibilities and legitimate business need; vendor and service-provider security review; and documented incident-response and recovery procedures.
Depending on the system and risk, safeguards may include multi-factor authentication; encryption in transit and at rest where feasible and appropriate; secure portals and protected document-transfer methods; endpoint, firewall, patching, anti-malware, logging, and account-security controls; protected backups and recovery procedures; and timely revocation of access when personnel or vendor access is no longer needed.
Physical files, devices, and work areas containing sensitive information are intended to be protected against unauthorized access. Paper records may be stored in locked or access-controlled locations, and sensitive records are disposed of securely.
The secure client portal is the preferred method for transmitting sensitive tax and financial documents when available. Portal users are responsible for protecting passwords and authentication methods, using reasonably secure devices and networks, and promptly reporting suspected unauthorized access.
Clients should not send full Social Security numbers, complete tax returns, bank credentials, unmasked identification documents, or other highly sensitive records through ordinary email, text message, or a public website contact form when a secure portal or other approved protected method is available.
LVP may require government identification, portal authentication, security questions, identity verification, or other reasonable measures before releasing sensitive records, accepting certain electronic instructions, or discussing account-specific information.
If LVP identifies a suspected security event, LVP may take steps to contain the event, preserve evidence, investigate affected systems and data, engage technical or legal resources, restore systems, provide legally required notifications, and make required regulatory reports. No information system, electronic transmission method, or storage platform can be guaranteed to be completely immune from attack, loss, error, or unauthorized access.
LVP uses a minimum three-year retention floor when an applicable three-year tax-preparer requirement applies, but many records are retained longer. The longest applicable federal, state, contractual, professional, audit, dispute, property-basis, legal-hold, or service-specific requirement controls.
LVP generally maintains filed-return copies and core tax workpapers for seven years as an internal business policy unless a longer period is required or appropriate. Certain paid-preparer due-diligence records must be retained for at least three years from the applicable federal triggering date.
E-file authorization, identity-verification, and related records are retained for the period required by current IRS e-file rules and any longer period applicable to the engagement.
Employment-tax records are generally retained for at least four years after the tax becomes due or is paid, whichever is later, and longer when another requirement applies.
Bookkeeping ledgers, reconciliations, financial statements, year-end workpapers, and related source support maintained by LVP are generally retained for seven years after the applicable fiscal year or completion of the engagement, subject to longer requirements.
Formation certificates, EIN confirmations, governing documents, ownership records, and material amendments may be retained for the life of the entity plus at least seven years. Permanent retention is preferred for core formation and governance records.
Records supporting property basis, depreciation, improvements, and related tax positions should be retained through the period applicable to disposition of the property and the relevant limitations period thereafter.
Normal destruction schedules are suspended for records reasonably related to an audit, tax notice, investigation, subpoena, dispute, claim, litigation, or legal hold until the matter is finally resolved and the hold is released.
Clients should not rely on LVP as the sole permanent repository for original records. Original documents are generally returned after scanning or when no longer needed. LVP may retain permitted copies.
Clients should maintain permanent copies of filed tax returns, entity formation documents, EIN confirmations, important ownership or governance records, and other documents that may be needed long after LVP’s ordinary retention period.
When records become eligible for destruction, LVP uses methods intended to make protected information unreadable or unrecoverable. Paper records may be cross-cut shredded or securely destroyed. Electronic records may be securely erased, deleted, cryptographically destroyed, or otherwise rendered unreadable using methods appropriate to the system or media.
