Making Tax Digital for Income Tax: The IT Side for Small Practices

For years the self-assessment calendar had one date that mattered. Clients handed over a carrier bag of receipts in the autumn, the practice worked through them, and everything converged on 31 January. Making Tax Digital for Income Tax changes that shape. Records have to be kept digitally, and updates go to HMRC every quarter, for every sole trader and landlord who falls inside the rules.

The tax detail belongs to HMRC and your professional body. This guide is about the other half: what happens to a small practice’s logins, software, document flow and devices when client work arrives four times a year instead of once.

The dates, as HMRC currently states them

GOV.UK sets out a phased start based on qualifying income, meaning income from self-employment and property combined:

• From 6 April 2026: qualifying income over £50,000 on the 2024 to 2025 return.
• From 6 April 2027: over £30,000 on the 2025 to 2026 return.
• From 6 April 2028: over £20,000 on the 2026 to 2027 return.

Quarterly updates are due for each self-employment and property business separately, even in a quarter with nothing to report. The standard deadlines are 7 August, 7 November, 7 February and 7 May.

Look at the third one. The February update lands one week after the 31 January return deadline. Your busiest fortnight just got longer. Check GOV.UK for the current position before planning around any of this, because HMRC updates this guidance regularly.

Software: recognised, bridging, or a mix

HMRC’s guidance says compatible software must let a client keep digital records, send quarterly updates and submit the tax return. Listed products have been through HMRC’s recognition process, though HMRC is explicit that it does not recommend any of them. Where a client insists on spreadsheets, bridging software can link to the workbook and make the submissions.

In practice, most firms end up supporting a mix. Some clients are on Xero, some on QuickBooks, FreeAgent or Sage, a few on bridging software, all sitting alongside practice software such as IRIS or CCH. Every platform you accept adds more staff logins, more multi-factor enrolments and more places client data lives. You will never get it down to one, but a short list of preferred products is much easier to secure than whatever each new client happens to arrive with.

The agent services account is the front door

MTD for Income Tax runs through HMRC’s agent services account, not the older online services for agents. Existing Self Assessment authorisations can be copied across from inside the account. New clients authorise you through a request you send them. A client can have one main agent and any number of supporting agents, which is how an outside bookkeeper sending quarterly updates can sit alongside the practice that files the return.

The IT point is simple and often skipped. HMRC’s guidance tells firms to create a Government Gateway user ID for each member of staff and set permissions for what they can reach. One shared practice login, written on a sticky note by the partner’s desk, fails that immediately. It means you cannot tell who submitted what, and a leaver keeps access until someone remembers to change the password. Name at least two administrators, so one person’s holiday does not lock the practice out in February.

One login, dozens of client files

Cloud accounting platforms let a practice user work across many client organisations from a single sign-in. That is convenient, and it turns each staff login into a key to a large amount of other people’s financial data. A phished password on one of those accounts is not one client’s problem.

Enforce multi-factor authentication on every account that touches client books, including the part-timer who logs in twice a month. An authenticator app beats text-message codes; our guide to rolling out multi-factor authentication covers the choice and the lost-phone problem. Then keep a written list of which client files each person can open. A leaver should be removed from all of them on their last day, not discovered in a client’s user list the following spring.

Quarterly records need a better route than email

Quarterly reporting means quarterly document traffic. Bank statements, invoices and receipt photos that used to arrive once a year now come in four times, and most of them arrive as email attachments. Each one leaves a copy in two mailboxes indefinitely.

A client portal, or the receipt-capture feature in the client’s own accounting software where it has one, is a better default. Files go straight to the right place, access can be withdrawn later, and nobody has to find last quarter’s statement in someone’s inbox. It also removes a gap that fraudsters like, though a lookalike “please use our new upload link” email still deserves a phone call. We cover the wider practice picture, including why returns should not go out as attachments, on our page about IT for accountancy practices.

Client data held on someone else’s platform

When a client’s records live in a cloud accounting subscription, the client usually owns that subscription. If they cancel, move software or fall out with you, your access can end the same day. Your retention obligations do not.

Decide what the practice needs to keep for each client, whether that is working papers, submitted figures or supporting documents, and export it into storage you control on a routine schedule. That store then needs its own backup, which is where choosing a cloud backup provider with sensible retention matters. The same thinking applies to your practice software and Microsoft 365. Our backup and continuity service is built around restores that have actually been tested.

Seasonal staff and home working

Extra hands for January often means someone working from home on a personal laptop. Under MTD, that person may be signing into your agent services account and a dozen client files from a machine you have never seen.

The fix is not complicated. Seasonal staff get a practice-owned or practice-managed laptop with disk encryption, current patches and your security tools, set up and tested before their first day. When the season ends, the laptop comes back and the accounts are closed. If buying machines for a few months is hard to justify, managed support for business devices makes a small pool of spare laptops practical to keep ready.

Plan for a year with more peaks

The old model had one freeze period. Now the late-January squeeze runs straight into the 7 February update, and there are smaller pressure points in August, November and May.

Do the disruptive work in the gaps between them. Autumn is the obvious window for new laptops, MFA enrolment for anyone not yet covered, a restore test and a check of the office internet connection, which matters more when every submission goes through the cloud. Review user access at the same time, and tighten your cyber security controls while the practice has space to absorb change. By December, the systems for the season should be settled.