7 Signs Your Accounting Firm's IT Needs Attention, and the Easy Fix for Each

Why insurers are asking now

The FTC Safeguards Rule has covered tax preparers for years, and its updated requirements have been in full effect since June 2023. The IRS also expects anyone preparing returns to have a written security plan. IRS Publication 4557 sets out the safeguards it expects, and Publication 5708 is its sample plan for small practices. The rules themselves aren’t new. What’s new is that someone checks. Cyber and professional liability insurers ask specific security questions at renewal, and your answers can affect your premium or coverage.

Most firms are closer than they think. These seven are the gaps we run into most often when we first sit down with an Orange County accounting firm. If you want the rule itself explained, start with our plain-English guide to the FTC Safeguards Rule.

1. Your security plan isn’t written down

This is the most common gap and the easiest to close. Plenty of firms do the right things but have never written them down, and a plan that only lives in people’s heads tends to leave when they do.

The easy fix: a short written plan (your WISP) that names who’s responsible, lists how you protect client data, and gets a fresh look once a year. Our guide to writing a WISP walks through it section by section.

2. Email doesn’t have MFA

In most firms, email is where Social Security numbers, K-1s and bank details end up. If someone steals a password and there’s no second check, they get all of it. Email is also where payment fraud starts: business email compromise, where criminals take over or imitate a real mailbox to redirect money, drew 21,442 complaints to the FBI in 2024, with reported losses of about $2.77 billion, according to its Internet Crime Report.

The easy fix: turn on multi-factor authentication (MFA) for every mailbox, partners included. Partners are the people attackers target most, and the ones most often given an exception.

3. Everyone can see everything

Shared logins and wide-open folders are convenient, but if a seasonal preparer can open every client folder in the firm, one stolen password exposes everyone.

The easy fix: individual accounts, folders opened up by role, a quick review of who has access once a year, and a simple checklist that removes access when someone leaves.

4. Nobody has tested a restore

A backup only counts if you can restore from it, and a lot of firms have never tried. The day you find out it doesn’t work shouldn’t be the day you need it.

The easy fix: daily backups with a copy kept off site, and a test restore every quarter, with the date written down.

5. Nobody’s sure which vendors hold client data

Client portals, e-signature tools, document management, cloud tax software and an outsourced bookkeeper all touch client financial information. The Safeguards Rule asks you to keep an eye on those providers, and that starts with knowing who they are.

The easy fix: a simple list of the vendors that hold client data, security terms in their contracts, and a quick check-in with them from time to time.

6. The team hasn’t had security training

Most attacks on accounting firms start with a convincing email in the busiest week of the year, not with a broken firewall. A little practice spotting scams goes a long way.

The easy fix: short, practical security training once a year, with a record of who completed it, and a few practice phishing emails during tax season.

7. There’s no plan for a bad day

If client data were exposed tomorrow, who would you call first, what would you tell clients, and what does California law require? Working that out in the middle of an incident costs days.

The easy fix: a one-page plan with names and phone numbers, your notification obligations, and your cyber insurer’s claims number. Walk through it once as a team so everyone knows their part. Our guide to the first hour after ransomware or a hacked email account is a good starting point for that page.

Where to start

If a few of these sound familiar, you’re in good company. MFA on email and a tested restore can both be done this month, so we’d start there and write the plan next. If tax season is close, our tax season IT checklist puts the rest in order.

If you’re not sure which of these apply to your firm, book a free IT check-in. We’ll get to know how your firm works and point out what’s worth fixing first. You can also read more about our IT support for accounting and CPA firms.

This article is general information, not legal advice. For questions about your firm’s specific obligations, talk to your attorney or compliance advisor.