Schedule a Consultation
Schedule a Consultation

Do You Know Who in Your Company Works With the IRS? Building Controls Around IRS Access

  • Tax Leadership & Operations

Table of Contents

An IRS notice arrives for one of your entities. The finance team forwards it to the outside CPA firm and moves on. A week later, a firm the company stopped working with two years ago called to ask about the same notice. Their power of attorney was never revoked, so the IRS sent them a copy too.

Nothing improper happened. But a former advisor saw the company’s tax correspondence, and nobody inside the business knew they still could.

This is more common than most finance leaders expect. Ask who deals with the IRS, and most can answer immediately. Ask who is authorized to, across every entity, tax type and period, and the answer takes much longer. Only one of those questions is about a control.

The Four Ways Someone Can Act on Your Company's Behalf

The IRS recognizes several types of third-party authorization. Each grants a different level of access and lasts a different length of time.

  1. Power of Attorney (Form 2848): Allows an individual authorized to practice before the IRS, typically a CPA, attorney or enrolled agent, to represent the company. The representative can advocate, negotiate and sign on the company’s behalf for the matters and periods listed, and receives copies of IRS notices. It stays in effect until the company revokes it or the representative withdraws.
  2. Tax Information Authorization (Form 8821: Allows a named person or firm to review and receive confidential tax information for specified tax types and periods. It does not allow representation, but it does open sensitive records. It also stays in effect until revoked or withdrawn.
  3. Third Party Designee: A box on a tax return that lets a named person discuss that specific return with the IRS. It generally expires one year from the return’s due date, not counting extensions.
  4. Oral disclosure: Let the IRS discuss a specific issue with someone the taxpayer brings onto a call or into a meeting. Unless stated otherwise, it ends when the conversation does.

The first two matter most for governance. They don’t expire on their own, so they quietly accumulate. There is also a trap in the other direction: filing a new Form 2848 for the same matters generally revokes earlier ones unless the company chooses to retain them. Without a clear record of what is on file, it is easy to remove access by accident, or keep it by default.

The first two matter most for governance. They don’t expire on their own, so they quietly accumulate. There is also a trap in the other direction: filing a new Form 2848 for the same matters generally revokes earlier ones unless the company chooses to retain them, as the Instructions for Form 2848 explain. Without a clear record of what is on file, it is easy to remove access by accident, or keep it by default.

Where the Gaps Usually are

Authorization gaps rarely come from bad decisions. They come from no decision at all: authorizations granted one at a time, as needs arise, with nobody responsible for the whole picture.

  • Authorizations that outlive the relationship: An advisor is replaced, an employee leaves, a project ends. The authorization stays live.
  • No central register: Forms are signed by whoever was available, for whichever entity needed it, and filed wherever was convenient. In a group of entities, the picture fragments quickly, one of the symptoms covered in Multi-Entity Tax Complexity: When Your Corporate Structure Outgrows Your Tax Infrastructure.
  • Notices reaching the wrong people: Representatives receive copies of notices. If the list of representatives is out of date, so is the list of people reading your IRS correspondence, and the people who should act on it may never see it.
  • No policy on who can approve: Who can sign an authorization, for which entities, and with what review? In many companies, the honest answer is whoever was asked.

On their own, these look like administrative loose ends. Together, they are a hidden exposure of the kind described in Tax Risk Management: Identifying and Addressing Hidden Exposures Before They Become Problems: easy to defer, rarely visible, and costly when they surface at the wrong moment.

What Good Looks Like: Access, Visibility and Control

Access: Decide who should have it.

Start with a deliberate view of who needs authorization and why: the outside CPA firm, specific tax counsel, the internal tax lead. Anyone else should be an exception, with a reason and an end date.

Visibility: Keep one register. 

Maintain a single authorization register across every entity. For each authorization, record who holds it, which form, which tax types and periods, who approved it, when it was granted and when it was last reviewed. If the company uses the IRS Business Tax Account, include its designated officials and authorized users too. The register is what turns “I think so” into a clear answer.

Control: Build it into how the business already runs.

  • Name an owner for the register, usually the head of tax or the controller.
  • Define who can approve a new authorization, and for which entities.
  • Review the full register at least once a year. Year-end is a natural point.
  • Build revocation into offboarding, for employees and outgoing advisors alike.


That last point matters most during change. When a tax leader leaves or an advisor is replaced, authorizations are exactly the kind of detail that slips, a risk explored in Between Tax Leaders: How to Maintain Continuity During Leadership Transitions.

A Five-Minute Self-Check Before Year-End

  1. Can the company produce a list of every live authorization, across every entity, today?
  2. Is it clear who approved each one?
  3. Has everyone who left the company, or stopped advising it, been removed?
  4. Do IRS notices reach the people responsible for acting on them?
  5. Is there a written policy on who can grant authorizations?


If any answer is “not sure,” that is the finding. It is also a fixable one. Once someone owns it, reviewing and cleaning up authorizations is usually a matter of hours, not weeks.

Where Embedded Tax Leadership Fits

In many growing companies, nobody owns this because nobody owns the tax function as a whole. Authorization governance falls to the CFO, the controller or the outside firm by default, each assuming someone else is watching. An embedded tax leader closes that gap, with one person accountable for who works with the IRS on the company’s behalf, and for keeping that list accurate as the business changes.

Koru Accountancy Corp provides fractional VP/Director of Tax leadership to growing and complex organizations. We specialize in embedding executive-level tax expertise directly into finance teams, supporting companies through growth, transition, and complexity. To learn more, visit koruaccountancy.com.