E-signature for accountants: engagement letters to returns

An accounting practice signs more small documents than almost any other small business: an engagement letter for every client entity, a declaration for every lodgment, a scope change whenever a client’s affairs get complicated. Most of them are not contracts in any dramatic sense, and some do not need a signing platform at all. The value of e-signature for accountants is in choosing well which documents get a signed, certified PDF, and making those few effortless. This is general information, not tax or legal advice.

What actually gets signed

Three groups of documents cover most of a practice’s signing.

Engagement documents. The letter of engagement, its annual reconfirmation, fee proposals and changes of scope. These set out what the practice will and will not do.

Declarations. The client’s written declaration before each return, activity statement or other approved form is lodged.

Administrative forms. Bank details, direct debit authorities and letters ending an engagement.

The table below lists common documents with the signers, the order and the identity check that fits each one.

What the ATO says about declarations

The ATO’s guidance on client declarations is specific and more flexible than many practices assume. A client must give a declaration in writing each time an activity statement, tax return or other approved form is given to the Commissioner; a bulk declaration is not allowed. The declaration must state that the client has authorised you to lodge the document and that the information is true and correct, and when you lodge you must state that you have received it. A phone conversation is not sufficient.

The declaration can come by email, fax or paper. Given electronically, the ATO says your consent to that method can be inferred from your conduct, and a reasonable method must be used to identify the person, such as their email address. It also says that a client who sends the declaration by email does not need to include a scanned signature: sending the email and your accepting and acting on it is enough.

That matches the general rule in section 10 of the Electronic Transactions Act 1999, which, for Commonwealth laws, treats a signature requirement as met where a method identifies the person and indicates their intention, is as reliable as appropriate, and the recipient consents.

The ATO’s Practitioner Lodgment Service guide makes the same point from the lodging side: each time you lodge an approved form for a client, the law requires you to have first received their signed declaration in writing, and your practice software may refuse to send the form until you have recorded that the declaration is complete. Whatever method you use to collect the declaration, finish it before the lodgment, not after.

So an emailed declaration is valid. A signed PDF earns its place when you want something an email does not give you: the declaration fixed to the exact document, a verified identity rather than an inbox, and a record you can produce without searching years of mail. The ATO says the client must keep the declaration for up to five years depending on their circumstances, and recommends the practice keep a copy.

Engagement letters and scope

The Tax Practitioners Board recommends having a written agreement with a client setting out the terms of the engagement before you provide tax agent or BAS services, and says it can be a formal agreement, a standard handout or an electronic communication. Its suggested contents include the name and registration number of whoever provides the service, information about the public register, the client entities covered, a description of the work, both parties’ obligations, how information will be communicated, and arrangements for ending the engagement. It also suggests reconfirming ongoing engagements regularly, preferably annually.

The embedded statement of work signing example shows the pattern an engagement letter follows, even though its subject is a data migration. The client approves the scope first, in a block headed APPROVED FOR THE CLIENT with an optional purchase order number, and the provider signs second. An earlier version was withdrawn with its reason on record when the schedule changed, which is exactly what should happen when an engagement’s scope changes before signing.

For a fee proposal, one signer is enough. The proposal acceptance signing example puts every field on the last page: a marked option, a signature, a typed title and a stamped date, with no identity check because the proposal is a document the sender wants read.

Declarations, identity and order

Match the identity check to what the document unlocks.

An email link suits a fee proposal or a reconfirmation for a client you already know. An emailed one time code proves the signer controls the inbox at the moment of signing; the code is six digits, lasts ten minutes and works once. An access code is set by you and shared out of band, for example read out on a phone call, and it is never included in the email. The master services agreement signing example uses one for a client signatory, so a forwarded invitation alone cannot open the document. Five wrong entries lock that signer out for fifteen minutes.

Where more than one person must sign, such as two directors, add both and decide the order. With Sign in order on, the second is invited only after the first signs. A single request can hold up to 25 signers. The trade offs between the checks are laid out in what signer identity verification is and in more depth in how to verify a signer’s identity.

Record keeping and privacy

Think carefully about what the signing process emails. The request title and message are shown before any identity check, so keep tax file numbers and figures out of them. When signing completes, the certified PDF is attached to an email sent to every signer and to you. For a full return, that may be more than you want in inboxes. Many practices prefer to send a one or two page declaration that names the form and the period, rather than the whole return.

After completion, keep two files together: the certified PDF, which any later edit invalidates, and the certificate of completion, which lists each signer’s identity method, signing time, IP address, consent and the hash of the document they saw. Every request expires 30 days after it was created, so a declaration request sent in the rush before a lodgment deadline needs chasing well before that.

Common mistakes

Sending a bulk annual declaration. The ATO requires one for each lodgment.

Putting a TFN in the request title. It is visible before verification.

One engagement letter for several entities without naming them. The TPB suggests listing the client entities covered.

Relying on a verbal yes. A phone call is not a written declaration.

Leaving fee terms vague. Say when invoices are due and what happens if they are late, as described in the payment terms clause page.

Build it

The multiple signers page shows how several people sign one document with their own coloured fields. A request holds up to 25 recipients and 500 fields, every signer needs a signature, initials or signature block field, and a Sign in order switch decides whether signers are invited together or in turn. Each signer can be given an email link, an access code or an emailed one time code. A request cannot be edited after sending, expires after 30 days, and on completion emails the certified PDF to everyone with a separate certificate of completion. The tutorial on sending a PDF for e-signature covers each step in the editor.