Folder Health Auditor

The folder health auditor scans a client or matter folder on your firm’s own machine and reports what is wrong with it. It reads the contents, checks them against your firm’s completeness and naming rules, and returns a plain report of missing documents, duplicate files, and names that break your conventions. That is the entire job. The tool does not move your files into a new platform, and it does not try to act as a document manager. You point it at a folder, it looks at what is already there, and it tells you where the gaps are before they cost you time during a busy filing week.

Most firms carry a mental checklist of what a finished client file should hold. The auditor turns that checklist into something a machine can apply to every folder, the same way each time. If a return folder should contain a signed engagement letter, prior-year workpapers, and the current source documents, it flags whichever ones are absent. It catches the duplicate copies that pile up when three staff members save the same PDF under slightly different names. It spots the file called “scan_final_v2” that never followed the pattern your firm agreed on.

Orderly files are not busywork for their own sake. The IRS expects a business to keep supporting records in a form it can actually produce on request, and its guidance in Publication 583, Starting a Business and Keeping Records lists the sales slips, invoices, receipts, and canceled checks that belong in a complete file. When those items are scattered or missing, a later document request turns into a scramble across drives and inboxes. The tool surfaces the gap now, while the client is still reachable and the missing item is still easy to re-request.

The output is meant to be read in about a minute. It groups what is missing, what is duplicated, and what is misnamed so a reviewer can act without opening every file by hand. Nothing gets deleted or renamed automatically. The tool only shows you the problems and leaves the correction to a person, which keeps you in control of the files your firm is responsible for. That restraint is deliberate. You would not want a background process quietly rewriting client records that a return depends on.

The report is also something you can hand to a junior staff member as a task list. Rather than asking a reviewer to open every file and guess what a folder should contain, you give them a plain account of exactly what is missing and what needs renaming. That makes the cleanup something you can delegate, which matters during the weeks when senior people have no spare minutes. The work still gets done to your standard, because the standard is the rule set the tool checks against.

Because the folder health auditor runs on your existing folder structure with no migration, most firms try it on a handful of client folders in a single afternoon and see the pattern right away. You can read how it fits a working practice on the folder health auditor product page. The promise is narrow and honest. It does one job, checks whether a folder is complete and correctly named against your own rules, and then steps back so your team can keep moving through the season.

Recordkeeping rules are less about how many files you have and more about whether you can produce the right one when it is asked for. The IRS lays out how long a business has to hold on to different records in its guidance on how long you should keep records, and the periods vary. The general rule runs three years, employment tax records run at least four years, and some situations reach further or never close at all. A file that is missing a key document today is a file that cannot answer that request later.

The folder health auditor helps by making completeness visible while there is still time to fix it. Instead of discovering a gap during an examination or a client transition, you see it during normal work. The tool checks each client folder against the set of documents your firm decided it should contain, then reports the missing items in a list a reviewer can clear in order. That turns retention from a hope into something you can actually confirm folder by folder.

Naming matters as much as presence. A record you cannot find is not much better than a record you do not have. The auditor enforces your firm’s naming pattern so that when a document is requested by year, client, and type, it can be located without opening ten near-identical files. Consistent names also make retention schedules workable, because you can tell at a glance which folders belong to which period and which are due to be reviewed or purged.

Duplicates are the quiet enemy of a clean retention policy. When the same statement lives in a folder three times under three names, a later reviewer cannot tell which copy is authoritative, and a purge might remove the wrong one. By flagging duplicates, the tool lets your team keep a single clear version of each record. That is exactly the kind of order the retention rules assume you already have in place when they set a clock on each document type.

Think about how a document request actually unfolds. Someone asks for a specific record from three years ago, and the clock starts. If the file is complete and correctly named, you pull it in seconds. If it is not, you lose an afternoon reconstructing what should have been there all along. The folder health auditor moves that work forward in time, to the quiet moment when the document first came in and was easy to file. Catching a gap early is worth far more than finding it under pressure later, because early is when the missing item can still be requested without alarming anyone or scrambling to explain a hole in the file.

None of this replaces your own judgment about what to keep and for how long. The tool does not decide policy. It checks folders against the policy you set and reports where reality has drifted from it. Firms that want to see how the auditor slots into a wider set of accounting and tax tools usually start by pointing it at their oldest client folders, where the gaps and stray duplicates from past seasons tend to hide. Fixing those first makes every future retention question easier to answer with confidence.

The files stay exactly where they already are. The folder health auditor runs locally on your firm’s machine and reads your existing folder structure in place. It does not upload documents to a cloud service, it does not keep a second copy somewhere else, and it does not need an outside account to do its work. When it finishes, you have a report and your files remain in the same folders they started in. For a firm handling returns full of names, addresses, and identifying numbers, that local-first design is the point rather than a footnote.

Keeping client data on your own hardware also fits the security duties that tax and accounting firms already carry. Under the FTC Safeguards Rule, firms that prepare taxes count as financial institutions and have to maintain a written program of administrative, technical, and physical safeguards for customer information. A tool that reads folders in place, without shipping them to a third-party server, keeps the surface you have to protect small and inside your existing controls.

The auditor also does not change your files. It reports missing documents, duplicates, and naming errors, and it leaves every correction to a person. Nothing is deleted, moved, or renamed automatically. That matters for safety because an automated cleanup that misfires on client records can do real damage, and a read-only check cannot. You keep the same access rules, the same backups, and the same encryption you already run on those folders. The tool simply looks and describes.

Because it adds no cloud copy, it also does not widen the set of places a breach could reach. The report it produces lives on the same machine as the files, so you can review it and discard it without creating a new trail of sensitive data in someone else’s system. If your firm keeps an internal record of what tools touched which folders, the auditor fits that model cleanly, since its footprint begins and ends on your own equipment.

There is also a quieter benefit to reading files in place. Because the tool never copies a document out of its folder, there is no temporary export sitting in a downloads directory or a staging area waiting to be forgotten. Those forgotten copies are how sensitive records leak long after the work that created them is done. A check that reads and reports, then leaves nothing behind but a short summary you control, avoids creating that kind of residue entirely. You decide whether to save the report, print it, or delete it once the folder is fixed. The auditor does not keep its own hidden copy anywhere, and it does not phone home. What happens on your machine stays on your machine, which is the simplest possible answer to where client data lives.

Safety is not only about walls around the data. It is also about knowing your records are complete and correctly labeled, because a disorganized file is easier to mishandle. By keeping folders clean and consistent, the tool reduces the odds that a document ends up saved to the wrong client or overlooked entirely. You can review how the local-first approach works on the folder health auditor product page before you run it against a single real folder.

Tools like FolderManifest, FileAudit, and Netwrix answer a different question. They audit access. They tell you who opened a file, who changed a permission, and whether someone reached a folder they should not have. That is real and useful security work. What those tools do not tell you is whether the folder is actually complete, whether a required document is missing, or whether files were named the way your firm expects. Access and completeness are two separate problems, and most of the market only covers the first one.

The folder health auditor owns the second problem. It does not track logins or permissions at all. It reads what is inside a client or matter folder and compares that against your firm’s rules for what should be there and how it should be named. A folder can pass every access check and still be a mess, missing a signed form, holding three copies of one statement, and carrying names no one can search. Security suites will report that folder as healthy. This tool will report it as incomplete.

The two roles are complementary, not competing. A firm following the written-plan approach the IRS describes in Publication 5708, Creating a Written Information Security Plan still needs technical safeguards and access controls, and the incumbents handle that layer. The auditor sits alongside them and covers the gap they leave open. You keep your access auditing and add a completeness check on top, rather than choosing one over the other.

The pricing reflects the narrower scope. Security-audit suites are built for firms that need enterprise access monitoring, and they are priced accordingly. This tool does one job and is priced well below those suites, which makes it reasonable for a small practice that already has access covered and only needs to know whether its folders are actually complete and correctly named against firm rules.

It helps to think of the two categories as answering to different owners. Access auditing answers to the person worried about who can see a file, which is a real and separate concern. Completeness answers to the person responsible for the work product itself, the preparer who has to sign off on a return built from that folder. The folder health auditor speaks to the second person. It does not care who has permissions. It cares whether the engagement letter is present, whether there are three copies of the same statement, and whether the names follow your rules. Those questions never appear in an access log, no matter how detailed it is, because access and contents are simply different things. A firm needs both answers, and until now the completeness half has had no dedicated owner in most practices.

The practical difference shows up on day one. An access tool that has run for a year cannot tell you which of your client folders is missing a prior-year return. This tool answers that in a single pass and hands you the list. If you want to see where it fits next to the security layer you already run, the product page walks through the split between auditing access and auditing whether the work is actually all there.

Yes, and that is one of the main reasons the tool exists. Every firm develops a naming convention, some pattern of client, year, document type, and version. The trouble is that conventions live in people’s heads and slip under deadline pressure. The folder health auditor takes the rules your firm actually uses and checks each file against them, then reports the names that do not fit so someone can correct them before they become permanent.

Naming is not cosmetic. A file called “final version 2 real” tells a future reviewer nothing, and it will not surface when someone searches by client and year. Consistent names are what make a folder usable months later, when the person who saved the file is busy with other clients. The tool flags the strays, points at the pattern they were supposed to follow, and lets your team bring them back in line while the context is still fresh.

Good naming also supports the underlying duty to keep records you can produce and read. The IRS reminds preparers in Publication 4557, Safeguarding Taxpayer Data that protecting taxpayer data is a legal duty, and part of protecting a record is being able to identify exactly which client and period it belongs to. A misnamed file is easier to email to the wrong person or file under the wrong client. Enforcing names lowers that risk without adding any new system to learn.

The tool checks names alongside completeness and duplicates in the same pass, so you get one report rather than three separate reviews. It does not rename anything on its own. It shows you which files break the pattern and leaves the fix to a person, which keeps you in control of records a return may rely on. That is a deliberate limit, since an automated bulk rename that guesses wrong can be worse than the original mess.

A naming convention is one of those things every firm swears it has and few firms actually keep clean. The rule might be written in an onboarding document nobody has opened in a year, or it might live only in the habits of one long-tenured staff member. When that person is out, or when a temporary preparer joins for the season, the pattern drifts. The folder health auditor makes the convention enforceable rather than aspirational. It reads the actual names on disk and compares them against the pattern you defined, so drift shows up as a list you can clear instead of as a slow decay nobody notices until a search comes up empty. That turns the naming rule from a good intention into something the whole team follows without having to remember it, because the check remembers it for them.

Firms usually load their existing convention once and then run the check on folder after folder. Because the tool works on your current structure with no migration, there is nothing to move and nothing to rebuild. You can see how naming rules, completeness, and duplicate detection come together across our accounting and tax tools, then point the auditor at a real client folder and read the first report the same afternoon.