Microsoft’s Conditional Access example selects a phishing-resistant authentication strength while the policy remains in Report-only mode. It shows a control selection, not a completed deployment: confirm licensing, users, target resources and registered methods, then verify sign-in results before enforcement.[5]
Before tax season or another client deadline, prove that staff can receive documents securely, work only on authorized engagements, obtain required approvals and recover usable client records. Start with the identity and financial-authority acceptance test, then use the checklist to assign owners and correct failed steps.
Determine coverage from the firm’s actual tax, bookkeeping, payroll, advisory or other services and registrations. FTC and IRS guidance addresses tax-preparer safeguards; other financial activities can have different oversight. Firm leadership and qualified advisers must decide applicable duties, contracts and retention requirements.[1][2]
What a dependable CPA and financial firm IT setup should accomplish
A strong environment gives every worker a named identity, assigns client data by role and engagement, uses approved portals and systems, protects administrative and payment authority, manages every device, records vendor dependencies, and proves that client work can continue during an outage or security incident.
- The firm has a current written information security plan that identifies responsible people, covered information, safeguards, service providers, testing, and incident procedures.
- Client information moves through approved intake, portal, workpaper, tax, accounting, document, delivery, billing, archive, and disposal paths.
- MFA, separate administration, least privilege, encryption, endpoint protection, secure remote work, monitoring, and tested backup are implemented.
- Tax-season, payroll, monthly-close, filing, payment, and client-delivery deadlines have documented owners and backup coverage.
- Vendor responsibilities, breach-notification paths, exports, retention, recovery, and contract exit steps are recorded.
Define scope, client data, systems, and accountable ownership
1. Identify services, covered information, and governing requirements
List tax preparation, audit, assurance, bookkeeping, payroll, advisory, wealth, lending, or other services separately. For each service, record the client information handled, required retention, responsible leader, systems, vendors, and applicable oversight. Do not label every firm as SEC, FINRA, or FTC regulated without confirming its activities and registration.
Where to work: Firm service list, written information security plan, client agreements, insurance conditions, professional rules, IRS guidance, and regulator requirements that actually apply
Verification: Firm leadership can explain why each control exists, which service and data it covers, and who approves changes to the written plan.
2. Map the complete client-information lifecycle
Follow representative tax, accounting, payroll, assurance, and advisory records from first request through final retention or disposal. Record where files are received, copied, exported, printed, cached, attached, synchronized, and shared. Include rejected prospects and inactive clients because their information may remain in forms, mailboxes, or portals.
Where to work: Website and phone intake, client portal, email, scanners, tax and accounting applications, workpapers, document storage, e-signature, delivery, billing, archive, and disposal
Verification: A client record can be traced end to end without discovering an undocumented personal inbox, local folder, consumer file-sharing account, or unknown export.
3. Create named identity and protected administration
Use individual accounts, MFA, role-based groups, separate privileged accounts, protected recovery, and at least two authorized administrators. Remove routine local administrator rights, shared credentials, and vendor-owned primary accounts. Document break-glass access and alert on privileged changes.
For a Microsoft Entra tenant that uses Conditional Access, confirm the required licensing and the specific authentication methods allowed and registered for the people in scope. Authentication strengths restrict acceptable methods; they do not register a usable method for the employee.[5][6] A policy shown in Report-only evaluates the sign-in but does not enforce its requirements. Verify the approved enabled policy and sign-in result separately from any screenshot.[7]
Where to work: Microsoft 365 or Google Workspace, tax and accounting platforms, client portals, payroll, document systems, backup, security, network, remote support, and local devices
Verification: A backup administrator can recover core systems while a normal employee cannot enter privileged settings or another service team’s client files.
Protect identity, portals, applications, devices, and money movement
1. Configure secure client intake and document exchange
Collect only the information needed to route a prospect before a secure relationship is established. Move tax forms, identity documents, bank records, payroll files, and financial statements through an approved portal or protected exchange. Control public links, recipient access, expiration, malware checks, download, and notification content.
Where to work: Contact forms, secure portal, upload request, e-signature, email security, scanner destinations, file-size exceptions, and client instructions
Verification: A novice client can submit a representative document from phone and desktop, the intended team receives it, analytics does not capture the contents, and access can be revoked and audited.
2. Separate client, review, filing, payroll, and payment authority
Define who can prepare, review, approve, transmit, release payroll, change bank details, issue refunds, write off balances, or administer the platform. Require independent verification for payment changes and high-impact actions. Use role assignments that reflect actual duties and temporary tax-season responsibilities.
Where to work: Tax software, accounting system, payroll platform, banking integrations, e-file controls, invoice and payment systems, write-offs, refunds, and approval workflows
Verification: A controlled transaction shows that one compromised preparer or inbox cannot silently change payee details, transmit an unreviewed filing, or grant itself administrative authority.
3. Manage office, remote, and seasonal devices
Enroll firm devices, escrow encryption recovery, patch supported software, deploy endpoint protection, restrict local privilege, and control remote support. Define whether personal devices are permitted and how client data, printing, downloads, browser extensions, lost devices, and household access are handled.
Where to work: Device inventory, endpoint management, encryption, patches, endpoint detection, browsers, local storage, remote support, USB, printers, home networks, and disposal
Verification: A permanent employee, seasonal preparer, and remote manager complete approved work without personal email, unmanaged storage, shared computers, or disabled security.
4. Protect email, impersonation, and payment-change workflows
Configure email protection and teach users to report suspicious tax notices, client impersonation, payroll changes, direct-deposit requests, invoice changes, and urgent executive messages. Verify sensitive requests through a known independent channel rather than replying to the message that requested the change.[4]
Where to work: Email authentication, anti-phishing controls, display-name alerts, external sender treatment, secure message options, callback procedures, and staff reporting
Verification: A tabletop fraudulent bank-change request is detected, reported, contained, and documented without using attacker-provided contact details.
Connect vendors, monitoring, backup, and incident response
1. Document service-provider safeguards and notice paths
Record data handled, access granted, security responsibilities, subcontractors where relevant, retention, export, deletion, breach-notice timing, support escalation, recovery, and contract exit. Keep company-controlled ownership and remove standing vendor access when it is not required.
Where to work: Tax, payroll, portal, cloud, backup, security, website, payment, e-signature, shredding, and support provider contracts and administration
Verification: For every material provider, the firm can identify an internal owner, current administrators, protected data, notice contact, export method, recovery expectation, and replacement plan.
2. Build tested backup and business continuity around deadlines
Define recovery time and recovery point needs around filing, payroll, close, reporting, and client-delivery dates. Protect backups from ordinary administrator compromise, test representative restores, and document what each cloud vendor does and does not recover for the firm.
Where to work: Cloud and server backup, Microsoft 365 or Workspace backup, tax and accounting exports, portal records, payroll data, configurations, contact lists, recovery priorities, and alternate work procedures
Verification: The team restores a representative client file, deleted message, application export, and critical configuration and can continue a deadline workflow during a primary-system outage.
3. Prepare and exercise incident response
Assign decision makers and technical responders for account takeover, ransomware, tax-data theft, lost devices, payroll fraud, vendor breach, and unavailable cloud services. Include who assesses scope, preserves evidence, maintains deadlines, obtains legal or insurer guidance, and decides required notices.
Where to work: Written incident plan, employee reporting, monitoring, containment, evidence, cyber-insurance notice, regulator and client decisions, vendor contacts, communications, and recovery
Verification: A tabletop begins with a realistic alert and produces a time-stamped record of triage, containment, affected systems and data, continuity actions, recovery, communication decisions, and corrective work.
Test real client workflows and deadline continuity
Prove identity and business authority separately
Use synthetic records and preparer, reviewer, payroll, billing, seasonal and administrator test identities. Include bank, payroll, refund and filing changes initiated by a compromised test message. Compare identity evidence with business approval evidence: they answer different questions. The firm must define actual duties and exceptions rather than copy this illustrative role map as a compliance rule.[3]
| Scenario | Test | Required evidence |
|---|---|---|
| Preparer signs in successfully | Check access to the assigned test client and inability to reach other clients or approve the test payment. | Sign-in success and app authority are recorded separately. |
| Reviewer approves a test return | Confirm the review is attributable and transmission follows the firm's separate approval procedure. | Approval record and transmission actor can be traced. |
| Unexpected bank-detail change | Validate through an established independent contact before the authorized release step. | Trusted contact and second check are recorded; request-supplied contact is not relied on. |
| Seasonal assignment ends | Remove approved access and check current sessions, client portals and synchronized copies. | End-of-assignment checklist covers more than return of the device. |
| Client data restored | Restore isolated workpapers, a mailbox item, portal record, application export and critical configuration. | Complete, readable, correctly scoped records meet the selected deadline and recovery-time requirement. |
If the firm uses QuickBooks Online, continue with the QuickBooks access, roles and audit-log guide. For an existing environment, the financial-firm IT audit guide helps turn these tests into an evidence review. ALLMSP’s software support can help implement agreed corrections.
Pilot the setup with a partner or principal, preparer or accountant, reviewer, payroll or billing user, remote employee, and seasonal or temporary worker. Run secure intake, document exchange, workpaper review, a financial approval, client delivery, account recovery, lost-device response, deleted-file restore, and deadline outage. A passing environment protects data and lets authorized people complete real work.
- Client intake and portal: Submit ordinary and sensitive test records from phone and desktop and route them to the correct engagement team. Pass: Files use the approved path, the client understands the process, and unauthorized teams and analytics cannot see the contents.
- Tax-season remote work: Complete intake, preparation, review, communication, and delivery away from the office. Pass: Managed identity and devices support the workflow without personal or consumer workarounds.
- Security incident and deadline: Run an account-takeover or ransomware exercise during a filing, payroll, or close deadline. Pass: The team contains the event, preserves evidence, maintains priority work, assesses notification, restores service, and records decisions.
Frequently Asked Questions
How should a CPA or financial firm determine which security requirements apply?
Start with the services actually provided and the information handled, then have the responsible leader confirm the applicable regulator, contracts and professional duties. Tax-return preparation is specifically addressed by FTC and IRS guidance; that does not make every bookkeeping, advisory or registered financial business subject to an identical rule set. Keep the decision and written safeguards current.
What should a CPA firm include in a client-data map?
Trace one fictional client package from the first request through scanning, portal upload, preparation, review, delivery, archive and disposal. Record who owns each copy and who can retrieve it. Include email attachments, synchronized folders and exports; the application holding the final return does not necessarily control all copies of the taxpayer’s information.
How should administrator access be set up for an accounting or financial firm?
Give employees named accounts and the access needed for their engagements. Separate administrative identities, protect sign-in with appropriate MFA and keep firm-controlled recovery with a second authorized owner. Test both a seasonal worker’s removal and administrator absence. Passing an identity check must not grant permission to release payroll, transmit a filing or change bank details.
Should clients send tax and financial documents by ordinary email?
Use the firm’s approved protected exchange for tax forms, identity documents, bank records and payroll files. Give clients clear upload instructions and a route for mistakes or large files. Test access as the intended recipient and an unauthorized account; a delivered message or a functioning public link does not demonstrate confidential document exchange.
Which financial-system duties should a firm separate?
Define distinct authority to prepare, review, approve, transmit, release funds, change payee details and administer the platform. Small firms may need a documented independent check where staffing prevents complete separation. Test the workflow with fictional records and retain the approval evidence rather than treating an application role name as proof that duties are separated.
What device controls are important for remote and seasonal accounting work?
Set up seasonal and remote devices before client work begins: named identity, supported software, encryption, endpoint protection and controlled downloads and printing. Give temporary access an owner and end date. At departure, revoke accounts and sessions and handle retained files through policy; recovering a laptop alone does not remove access from portals or synchronized copies.
How can CPA and financial firms reduce payment-change and impersonation fraud?
Stop an unexpected bank, direct-deposit or refund change until it is verified using a trusted contact established separately from the request. Require the approved reviewer before release and record the verification. Email filtering and MFA reduce exposure but cannot replace this business check, especially when a genuine client or employee mailbox has been compromised.
What should a financial firm document about technology service providers?
Name an internal owner and record the provider’s data access, administrator accounts, security responsibilities, incident contact, export method, retention and recovery limits. Check how access ends if the contract changes. Where the FTC Safeguards Rule applies, provider oversight belongs within the firm’s safeguards program; a vendor’s assurance does not remove the firm’s own responsibilities.
What should a CPA firm include in backup and continuity testing?
Restore a workpaper set, mailbox item, portal record and application export into an isolated test location. Check readability, relationships and permissions, then complete a representative deadline task. Record the time and any missing records. Agree on recovery needs before tax season rather than discovering during an outage that a backup covers files but not the application’s usable state.
What should a CPA or financial firm incident-response exercise test?
Combine a realistic account-takeover or data-theft alert with a filing, payroll or close deadline. Test who can contain the incident, preserve evidence, identify affected information, contact providers and continue essential work. Keep notification decisions with the firm’s authorized advisers and current rules; the exercise should expose missing contacts and evidence before a real event.
Sources
- FTC: Safeguards Rule coverage and security program guide ↩
- IRS Publication 4557: Safeguarding Taxpayer Data (May 2024 revision) ↩
- NIST CSF 2.0 Small Business Quick-Start Guide ↩
- FBI IC3: Business Email Compromise ↩
- Microsoft Entra: Conditional Access authentication strengths ↩ ↩
- Microsoft Entra: Conditional Access license requirements ↩
- Microsoft Entra: Report-only policy monitoring and evaluation ↩
