IOLTA Account Safeguards: Protecting Client Funds at the Bank, in Your Software and in Your Records
By Tammy Hoang, Certified QuickBooks ProAdvisor
A trust account holds other people's money, so protecting it is part of the lawyer's job. Good intentions are not a control. What protects client funds are specific IOLTA account safeguards: limits on who can move money, checks on every payment, secure logins, reliable backups and a regular review.
This guide organizes those safeguards into three layers (the bank, the software and the records) and adds the people-and-routine habits that make them work.
Why IOLTA Account Safeguards Work in Layers?
No single safeguard is enough. A strong password does not stop a mistaken payment, and dual approval does not help if the records are lost. Layering means a failure in one place is caught by another.
California's Rule 1.15 sets the baseline for records: a written ledger for each client, a journal for each bank account, bank statements and cancelled checks, and a monthly reconciliation, retained for five years from the date of appropriate disbursement. The safeguards below are the practical controls that help a firm meet that standard, whether it has one attorney or fifty.
For the role of oversight in particular, see our guide to why solo paralegal oversight of IOLTA disbursements falls short.
Good IOLTA bookkeeping assumes the controls exist. Attorney trust account bookkeeping can record every transaction perfectly and still miss a payment that should never have been authorized. That is why law firm trust accounting and safeguards belong together, and why California IOLTA compliance is more than a set of reports.
Layer One: Safeguards at the Bank
The bank is where money actually moves, so it is the first place to set limits. Ask your bank which of these it offers for the trust account, and use them:
Named users only. List exactly who has authority on the account, and remove anyone who no longer needs it.
Dual approval. Require two people to authorize transfers, wires and larger payments, so one person cannot move funds alone.
Alerts. Turn on account alerts for withdrawals, wires and low balances. California banks must report trust account overdrafts to the State Bar under Business and Professions Code section 6091.1, so you want to hear about a problem first.
Payment verification. If anyone asks you to change wire or payment instructions, confirm by calling a number you already had on file, not one in the email asking for the change.
Since January 1, 2026, Business and Professions Code section 6091.3 also calls for a designated licensee notice for trust accounts, so keep your account contacts and designations current.
Orange County firms often find that the weakest layer is the bank, because the account was opened years ago and nobody has revisited the signers. A fifteen-minute review of authorized users is one of the highest-value steps a firm can take. CTAPP compliance is also easier to show when current designations and signers are documented.
Layer Two: Safeguards in Your Accounting and Trust Software
Unique logins. Every user has their own credentials. Shared passwords make it impossible to say who did what.
Multi-factor sign-in. Turn on two-step verification wherever the software offers it.
Permission levels. Give each person the least access needed. Bookkeepers who prepare reconciliations need to post and report. Staff who only need balances can have view-only access.
A change log. Use software that records who changed or deleted an entry and when. If your system cannot show this, treat it as a gap.
One caution. Limiting access is not the same as removing the attorney from the picture. The attorney responsible for the account needs to see the reconciliation and the reports every month. A good setup restricts who can change records, while keeping the attorney's view of them complete.
Our QuickBooks IOLTA accounting setup guide explains how to set restrictions inside QuickBooks, and where it needs extra help.
Not sure who can move money in your trust account?
Irvine Bookkeeping can review your access and approvals with you.
Call or Text: (949) 482-2790 | irvinebookkeeping.com
A client trust account reconciliation is itself a safeguard: it will not stop a bad payment, but it will reveal one within a month. Legal bookkeeping services that deliver it promptly, with an open-items list, turn that safeguard into something the attorney can act on.
Layer Three: Safeguards for Your Records
Records protect the firm only if they survive. Rule 1.15 requires five years of retention, so plan for loss, damage and staff turnover:
Back up the accounting data on a regular schedule, with at least one copy stored away from the office.
Keep paper records, such as signed settlement statements and cancelled checks, in a locked place.
Store scanned copies in a system with controlled access, and name files so they can be found by client and date.
Test a restore occasionally. A backup you have never opened is a guess.
Every monthly reconciliation should be saved with the bank statement it was based on, signed and dated. That file is your best evidence that the other safeguards are working.
Irvine law firm bookkeeping clients and California law firm bookkeeping engagements often start with a simple map of who does what in the trust account process. The attorney client trust account rules are easier to follow when roles are written down.
Whatever the layer, the monthly client trust account reconciliation is where problems surface, and the attorney client trust account rules require that the reconciliation actually be done. Keep it signed, dated and saved with the statement.
People and Routine: Making the Safeguards Stick
Safeguards fail when nobody owns them. Assign someone to review access at least twice a year and every time a person joins, changes roles or leaves. When someone leaves, remove their access to the bank, the software and the files the same day.
Build a monthly rhythm: the bookkeeper prepares the reconciliation, the attorney reviews it, and anything unusual is written down. Train staff to recognize phishing and payment-change requests, since those are common ways fraudsters reach trust accounts.
To see how a documented monthly review works, read our guide to how vendor reports for IOLTA disbursements show approvals. The State Bar's CTAPP page and Rule 1.15 are the primary sources.
How Irvine Bookkeeping Strengthens Your Safeguards?
Irvine Bookkeeping provides bookkeeping for law firms in Irvine and Orange County, including IOLTA bookkeeping and monthly reconciliation. Our IOLTA bookkeeping services include an access and approval review, so you know exactly who can post, who can approve and who can see what.
As an Irvine law firm bookkeeping team led by a Certified QuickBooks ProAdvisor, we deliver legal bookkeeping services and California law firm bookkeeping that support California IOLTA compliance and CTAPP compliance. Our attorney trust account bookkeeping and law firm trust accounting follow the attorney client trust account rules, with a documented client trust account reconciliation each month.
Our IOLTA bookkeeping services, attorney trust account bookkeeping and legal bookkeeping services are built around layered controls, so California IOLTA compliance and CTAPP compliance do not depend on any single person. When comparing IOLTA bookkeeping services, ask what the provider can see, what it can change and who approves its work.
For California law firm bookkeeping clients, we document the access map and review it when staff change. Law firm trust accounting is only as secure as its weakest layer, and Irvine law firm bookkeeping support helps you find it.
Orange County attorneys can ask us for a one-page safeguards checklist covering the bank, the software and the records. We will walk through it with you and note the gaps.
Strong IOLTA bookkeeping and good IOLTA account safeguards fit together: the first records what happened, and the second makes it harder for the wrong thing to happen.
Talk with an Irvine law firm bookkeeping specialist
Schedule a consultation to review your trust account safeguards.
Call or Text: (949) 482-2790 | irvinebookkeeping.com
This is a valuable overview of the importance of maintaining accurate financial records and proper safeguards for IOLTA accounts. Clear documentation, reliable banking practices, and regular reconciliation can make a big difference in financial compliance. In a different area of personal expression, the Day of the Dead Halloween Sugar Skull Suit is a creative outfit that combines traditional-inspired artwork with a bold Halloween look.