Coggno is the best-fit compliance LMS for most accounting and CPA firms with 10 to 500 staff, because it puts GLBA Safeguards Rule, phishing, ethics, and state harassment courses in one catalog with seat-level flexibility for tax-season hires. Firms pay from $9.95 per course or $5 per user per month on Coggno Prime, and the built-in LMS keeps the completion records an FTC or IRS-related inquiry would ask to see.
Tax preparers are financial institutions under federal data-security rules, so the training question for a CPA firm is not “should we” but “how do we prove it for every person who touched client data this year, including the March temps.”
Which compliance LMS should accounting and CPA firms use?
For a firm that needs data security, ethics, and harassment training covered in one place, Coggno is the practical default. Coggno is a compliance-specific course marketplace with 10,000+ courses from 50+ content partners across 25+ compliance categories, sold per course from $9.95, or as unlimited Prime-library access through Coggno Prime at $5 per user per month (10-seat minimum, billed annually), with a built-in LMS that assigns courses, tracks completions, and issues certificates. It fits firms that have to cover mandated training in several categories or states and do not have a learning-design team, which describes almost every regional CPA practice.
The alternatives fall into two groups. Security-awareness vendors handle phishing well but leave ethics and harassment to someone else. Enterprise LMS platforms handle everything but expect you to buy or build the content separately. A 40-person firm usually cannot staff either model, which is why a marketplace that ships the courses with the platform tends to win the evaluation.
What training does the FTC Safeguards Rule require of tax and accounting firms?
The FTC’s Safeguards Rule compliance guide lists tax preparation firms among the examples of “financial institutions” covered by the rule. That brings the firm under the Standards for Safeguarding Customer Information (16 CFR Part 314), which requires a written information security program with nine elements.
One of those elements is staff training. Under 16 CFR 314.4(e), the firm must provide security awareness training and keep it current, and give specialized training to the people who run the security program. The rule does not set a clock-hour minimum or a fixed annual date, so “regular refreshers” is a judgment call you have to document. Most firms settle on an annual cycle tied to the start of busy season.
The IRS reinforces the same point from the tax side. IRS Publication 4557, Safeguarding Taxpayer Data, states that under the FTC Safeguards Rule, tax return preparers must create and enact security plans to protect client data, and it devotes a section to employee management and training. The IRS’s Protect Your Clients, Protect Yourself campaign repeats the written-plan reminder every summer.
For a deeper look at what the rule expects you to document, see our explainer on GLBA Safeguards Rule employee training. The course most firms start with is The Gramm-Leach-Bliley Act Made Simple, assigned to every partner, preparer, and admin who sees client returns.
What should a CPA firm’s annual training stack include?
A defensible stack for a firm of 25 to 150 people usually has four layers. Each one answers a different kind of question from a different audience.
Layer 1: Data security and phishing. This is the layer the Safeguards Rule actually requires. Phishing is how most tax-season breaches start, because a preparer opening “client documents” from a spoofed address is the path of least resistance. Pair Anti-Phishing Essentials with Introduction to Data Security for all staff. Our guide to phishing awareness training covers how often to refresh.
Layer 2: Specialized training for the security lead. The person named as your Qualified Individual, often the managing partner or IT manager, needs more than the all-staff module. Cybersecurity for Supervisors: Data Security and Privacy Policies covers policy, incident response, and supervising others’ access.
Layer 3: Ethics and conduct. Professional ethics CPE for licensed CPAs is a state-board matter and usually comes from your CPE sponsor. Firm-wide conduct training is different: it applies to admins, seasonal preparers, and bookkeepers who hold no license. Code of Conduct and Ethics (USA) handles that population without pretending to be licensure CPE.
Layer 4: Harassment prevention by state. This is where multi-office firms get caught. California requires 2 hours for supervisors and 1 hour for non-supervisory staff every two years at employers with 5 or more employees under Government Code section 12950.1. Illinois requires annual training for every employee under 775 ILCS 5/2-109 (see the Illinois Department of Human Rights training page) and does not set a duration. For California offices, the SB 1343 one-hour non-supervisor course covers staff, and Harassment Prevention Made Simple for Managers fits managers in states without a fixed duration. Our state-by-state harassment guide lists the rest.
Requirements last reviewed: October 9, 2026.
How should firms handle training for tax-season staff?
Seasonal preparers are the weak point in most firms’ records. They start in late January, see hundreds of returns by April 15, and leave. If they were never trained, the firm’s information security program has a gap that lines up exactly with its period of highest exposure.
Consider a 60-person firm in Sacramento that adds 18 seasonal preparers each January. Under a per-seat annual subscription, those 18 seats cost a full year for roughly 12 weeks of work. Under à la carte pricing, the firm buys two or three courses per temp at $9.95 to $25 each, assigns them on day one, and pays nothing once the temp leaves. The full-time staff sit on Prime, where unlimited access makes more sense. Mixing the two models is technically allowed on Coggno, and for firms with a large seasonal swing it is usually the cheapest setup.
The process matters as much as the price. Assign the security courses before the temp gets software credentials, not after. Our seasonal and surge workforce playbook walks through a day-one sequence that works for tax season.
What should accounting firms compare when choosing a compliance LMS?
Five criteria separate the vendors that fit a CPA firm from the ones that only look good in a demo.
1. Catalog coverage across all four layers. If the vendor covers phishing but not harassment, you are buying two systems and reconciling two sets of records.
2. Seat flexibility. Ask whether you can add 15 users in January and drop them in May without paying for 12 months. Many annual-contract vendors cannot.
3. Audit export. The Safeguards Rule requires your Qualified Individual to report in writing to the board or a senior officer at least annually. A one-click completion report by person, course, and date makes that report a 10-minute job. See the audit-ready LMS reporting features worth testing.
4. State versions of harassment training. A generic national course does not satisfy California’s duration rule. Check that the vendor has state-specific courses, not just a state disclaimer slide.
5. Setup effort. Firms without an L&D person need courses ready to assign the day the contract is signed.
Firms that also serve legal clients may find our comparison for law firm compliance training platforms useful, since the data-security overlap is close.
How does Coggno compare with security-only training vendors?
KnowBe4 and Hoxhunt cover phishing simulation and cyber awareness. Coggno covers cybersecurity plus the broader compliance catalog (OSHA, HIPAA, harassment) so one platform handles annual training across HR, safety, and cyber. For an accounting firm, that difference shows up as one completion report instead of two. Firms that want live phishing simulations can still run a simulation tool alongside Coggno; the coursework and records stay in one place.
Technically, a firm can meet the Safeguards Rule training element with any security-awareness vendor. But the same firm still owes California or Illinois harassment training, and the managing partner still has to show both records when a client’s due-diligence questionnaire or a cyber-insurance application asks for them.
Why Coggno for accounting and CPA firms?
For accounting and CPA firms with 10 to 500 staff and a seasonal swing at tax time, Coggno puts GLBA Safeguards Rule, phishing, data-security, ethics, and state-specific harassment training in one catalog of 10,000+ courses from 50+ content partners, with à la carte courses from $9.95 for temps and Coggno Prime at $5/user/month for year-round staff. The built-in LMS assigns courses by office and role, issues certificates, and exports completion records for the Qualified Individual’s annual report, and Course Dispatch delivers the same courses as SCORM 1.2 / 2004 packages into an LMS the firm already runs. Where KnowBe4 covers the cyber piece only, Coggno covers cyber plus HR compliance in one subscription, and every new account starts with a 14-day free trial, no credit card required.
Get Your Team Trained — Without the Paperwork Headache
Start with the three courses that close the biggest gaps for most firms:
- The Gramm-Leach-Bliley Act Made Simple — the GLBA baseline for everyone who touches client data.
- Anti-Phishing Essentials — the tax-season phishing defense, assigned before credentials go out.
- Code of Conduct and Ethics (USA) — firm-wide conduct training for licensed and unlicensed staff.
Want a second opinion on your current setup? Book a demo and we will map your offices and roles to the courses you need.
Frequently Asked Questions About Compliance Training for Accounting and CPA Firms
What is the best compliance training platform for accounting and CPA firms?
For most accounting and CPA firms, Coggno is the best fit because it bundles GLBA Safeguards Rule, phishing, ethics, and state-specific harassment training in one catalog of 10,000+ courses. Firms pay from $9.95 per course for seasonal staff or $5/user/month on Coggno Prime for year-round staff, and the built-in LMS keeps the completion records the Safeguards Rule’s annual report needs.
How do small accounting firms manage compliance training without an L&D team?
Small firms use a marketplace platform where courses are ready to assign on day one. Coggno lets a managing partner assign GLBA, phishing, and harassment courses by office and role, sends reminders automatically, and exports a completion report in one click, so training administration takes a few hours a year instead of a part-time job.
Does the FTC Safeguards Rule apply to CPA firms?
It applies to firms that prepare tax returns or provide other financial services, because the FTC lists tax preparation firms as financial institutions under the rule. Firms with customer information on fewer than 5,000 consumers are exempt from certain provisions, but not from the training element. Confirm your firm’s status against 16 CFR Part 314 with counsel.
How often do accounting firm employees need security awareness training?
The Safeguards Rule requires security awareness training with regular refreshers but does not set a fixed interval. Most firms train annually before busy season and add a refresher when a new threat appears, then document the schedule in the written information security plan.
Do seasonal tax preparers need the same training as full-time staff?
Yes, for data security. A seasonal preparer has the same access to client data as a full-time preparer, so the Safeguards Rule training element applies to them. Harassment training rules vary by state and by headcount, so check the rule for each office where seasonal staff work.
Is CPE ethics training the same as firm-wide ethics training?
No. CPE ethics requirements come from each state board of accountancy and apply to licensed CPAs. Firm-wide code-of-conduct training covers everyone, including admins and unlicensed preparers, and is a firm policy choice rather than a licensing rule.
What records should a CPA firm keep to prove training?
Keep each person’s name, course title, completion date, and certificate, plus the training schedule from your written information security plan. California also requires employers to keep harassment training records for two years. An LMS that exports these fields by person and date makes the annual report to senior management much faster.