A useful security review does not begin with a generic score. It collects current evidence from the written plan, identities, client systems, devices, integrations, vendors, alerts, backups, support records, and incidents. The evidence should show whether safeguards operate during ordinary work and peak deadlines.
Preserve logs, approvals, ownership, client records, and recovery paths before changing access or deleting anything. Confirm which obligations apply to the firm’s services and registration. A review should identify uncertainty for leadership or counsel rather than present every IRS, FTC, SEC, or FINRA requirement as universal.
Evidence to collect before changing CPA and financial firm IT
The review produces a dated record of scope, tested controls, failed evidence, affected services and data, risk priority, accountable owner, corrective action, verification, and written-plan update. It separates configuration problems from training, workflow, vendor, capacity, and governance problems.
- Current service inventory, regulatory determination, written information security plan, policies, insurance requirements, and responsible people.
- User, group, administrator, service-account, recovery, device, application, portal, integration, and vendor-access exports.
- Security alerts, email events, endpoint status, vulnerability and patch findings, support tickets, incidents, and response records.
- Backup scope, job history, restore evidence, application exports, business-continuity tests, and deadline coverage.
- Vendor contracts, data flows, breach-notice contacts, access methods, recovery promises, and exit procedures.
Confirm scope, ownership, identity, and client access
Written plan and service scope
What to check: Record approval date, responsible person, covered services and information, risk assessment, safeguards, providers, training, testing, incident process, review cadence, and unsupported assumptions.
What to do next: Assign an accountable owner, confirm actual legal and contractual scope, update the plan from current systems and risks, and schedule leadership approval and recurring review.
Privileged identity and recovery
What to check: Export administrators, roles, shared accounts, service identities, MFA status, recovery methods, emergency accounts, last use, and vendor access. Test backup ownership without exposing privileged credentials.
What to do next: Add company-controlled recovery, separate daily and administrative identities, reduce roles, remove unknown access, rotate affected secrets, and alert on privileged changes.
Client and engagement access
What to check: Sample active, inactive, restricted, payroll, assurance, tax, and advisory clients across permanent, seasonal, remote, and former users. Capture inherited groups, public links, exports, and exceptions.
What to do next: Assign access from approved role and engagement, correct broad groups, close stale links, transfer ownership, document exceptions, and repeat the sample until denied and allowed paths match the roster.
Test applications, devices, communications, and monitoring
Endpoint and remote-work control
What to check: Reconcile people to devices and collect enrollment, encryption, patch, protection, administrator, last-seen, risk, ownership, and recovery status. Test one office and one remote workflow.
What to do next: Quarantine high-risk devices, enroll supported equipment, patch, encrypt, reduce local privilege, replace unsupported systems, close unknown remote tools, and document approved personal-device boundaries.
Application integrations and service identities
What to check: List owner, purpose, permissions, client data, credential type, last use, logs, failure handling, renewal, export, and removal path for each integration and service identity.
What to do next: Disable unknown or unused connections after preserving evidence, reduce scopes, replace employee credentials with managed service identity where supported, rotate secrets, assign monitoring, and document failure recovery.
Email, phishing, and financial-change procedure
What to check: Test spoofing controls, external forwarding, hidden rules, executive impersonation, reporting, escalation, and independent verification using representative messages.
What to do next: Correct authentication and protection, remove malicious rules and access, require known-channel verification, retrain affected roles, and monitor high-risk financial and credential changes.
Security monitoring and support evidence
What to check: Choose representative critical and warning events and record whether they were received, owned, investigated, contained, resolved, documented, and followed by corrective action within expectations.
What to do next: Fix missing telemetry and routing, assign severity and ownership, create escalation and after-hours coverage, test a known event, and review recurring alerts that support staff have normalized.
Review vendors, recovery, support, and incident readiness
Provider safeguards and breach notice
What to check: For each material provider, record client information handled, access, safeguards evidence, notice timing, responsible contacts, recovery, subcontractor relevance, and replacement or export steps.
What to do next: Escalate missing material terms, reduce standing access, add internal ownership and notice contacts, test export and recovery, and obtain leadership or counsel review where contractual risk remains.
Backup, restore, and continuity
What to check: Match production data to protected copies and capture retention, encryption, immutability, success history, failed jobs, restore time, restore completeness, responsible owner, and deadline priorities.
What to do next: Add missing data, isolate backups, correct failures, document cloud responsibility, run clean restores, and revise continuity steps around filing, payroll, close, client delivery, and communications.
Incident and support readiness
What to check: Run a scenario involving client-data access, account takeover, ransomware, vendor outage, or financial fraud and capture response timing, decisions, missing information, deadline effects, and corrective tasks.
What to do next: Correct contact, authority, evidence, containment, continuity, notification, and recovery gaps, then repeat the exercise and update the written plan and training.
Prioritize findings by client impact and deadline risk
Present findings by affected client information, service, deadline, likelihood, operational consequence, evidence strength, immediate containment, long-term correction, owner, due date, and retest. A useful report tells leaders what to decide and technicians what must pass.
Priority 1: Active exposure or inability to operate
Respond immediately to confirmed compromise, exposed client or taxpayer information, uncontrolled privileged access, fraudulent financial changes, failed critical backup, unsupported internet-facing systems, or an outage threatening filing, payroll, close, or client obligations.
Priority 2: Material control failure
Correct missing MFA, broad client access, unknown service identities, unmanaged devices, untested recovery, vendor-notice gaps, or ineffective alert handling on a scheduled urgent plan with accountable leadership.
Priority 3: Process and evidence weakness
Address incomplete inventories, stale procedures, inconsistent training, unclear metrics, weak ownership, and lower-impact configuration drift after higher-risk paths are controlled.
Priority 4: Planned improvement
Sequence usability, automation, reporting, and modernization work only after the firm can protect, support, recover, and explain the current environment.
Frequently Asked Questions
What evidence shows that a CPA firm's written security plan is current?
Review the following systems and records: Written information security plan, service catalog, responsibility chart, policies, contracts, and current regulator or professional guidance. Record approval date, responsible person, covered services and information, risk assessment, safeguards, providers, training, testing, incident process, review cadence, and unsupported assumptions. If evidence is incomplete or a control fails, assign an accountable owner, confirm actual legal and contractual scope, update the plan from current systems and risks, and schedule leadership approval and recurring review. Retest and document closure.
How should a financial firm review administrator and recovery access?
Review the following systems and records: Cloud tenants, tax and accounting applications, portals, payroll, banking links, backup, security, network, remote support, and local administrators. Export administrators, roles, shared accounts, service identities, MFA status, recovery methods, emergency accounts, last use, and vendor access. Test backup ownership without exposing privileged credentials. If evidence is incomplete or a control fails, add company-controlled recovery, separate daily and administrative identities, reduce roles, remove unknown access, rotate affected secrets, and alert on privileged changes. Retest and document closure.
How can a CPA firm test whether client access is too broad?
Review the following systems and records: Portal, document repository, workpapers, tax software, accounting systems, payroll, collaboration spaces, email groups, and archives. Sample active, inactive, restricted, payroll, assurance, tax, and advisory clients across permanent, seasonal, remote, and former users. Capture inherited groups, public links, exports, and exceptions. If evidence is incomplete or a control fails, assign access from approved role and engagement, correct broad groups, close stale links, transfer ownership, document exceptions, and repeat the sample until denied and allowed paths match the roster. Retest and document closure.
What should a CPA firm verify during a device security review?
Review the following systems and records: Device management, endpoint security, encryption, patching, local privilege, browsers, remote support, USB, printers, personal devices, and disposal. Reconcile people to devices and collect enrollment, encryption, patch, protection, administrator, last-seen, risk, ownership, and recovery status. Test one office and one remote workflow. If evidence is incomplete or a control fails, quarantine high-risk devices, enroll supported equipment, patch, encrypt, reduce local privilege, replace unsupported systems, close unknown remote tools, and document approved personal-device boundaries. Retest and document closure.
Why should accounting firms review integrations and service accounts?
Review the following systems and records: Tax, accounting, payroll, portal, e-signature, payment, reporting, workflow, browser extension, API, connector, and automation administration. List owner, purpose, permissions, client data, credential type, last use, logs, failure handling, renewal, export, and removal path for each integration and service identity. If evidence is incomplete or a control fails, disable unknown or unused connections after preserving evidence, reduce scopes, replace employee credentials with managed service identity where supported, rotate secrets, assign monitoring, and document failure recovery. Retest and document closure.
What should a financial firm test in its email security review?
Review the following systems and records: Email authentication, anti-phishing settings, suspicious-message reporting, mailbox rules, forwarding, delegated access, secure mail, payment and payroll verification, and training records. Test spoofing controls, external forwarding, hidden rules, executive impersonation, reporting, escalation, and independent verification using representative messages. If evidence is incomplete or a control fails, correct authentication and protection, remove malicious rules and access, require known-channel verification, retrain affected roles, and monitor high-risk financial and credential changes. Retest and document closure.
How can a firm tell whether security alerts are actually being handled?
Review the following systems and records: Identity, email, endpoint, firewall, cloud, application, backup, and remote-support alerts plus ticketing and escalation records. Choose representative critical and warning events and record whether they were received, owned, investigated, contained, resolved, documented, and followed by corrective action within expectations. If evidence is incomplete or a control fails, fix missing telemetry and routing, assign severity and ownership, create escalation and after-hours coverage, test a known event, and review recurring alerts that support staff have normalized. Retest and document closure.
What service-provider evidence should a CPA or financial firm keep?
Review the following systems and records: Provider inventory, contracts, security documentation, data-processing terms, administrator access, support contacts, incident language, exports, deletion, and exit plans. For each material provider, record client information handled, access, safeguards evidence, notice timing, responsible contacts, recovery, subcontractor relevance, and replacement or export steps. If evidence is incomplete or a control fails, escalate missing material terms, reduce standing access, add internal ownership and notice contacts, test export and recovery, and obtain leadership or counsel review where contractual risk remains. Retest and document closure.
What evidence proves that financial-firm backup can actually recover client work?
Review the following systems and records: Backup platforms, cloud data, tax and accounting exports, payroll, workpapers, email, configurations, contacts, alternate procedures, and prior exercises. Match production data to protected copies and capture retention, encryption, immutability, success history, failed jobs, restore time, restore completeness, responsible owner, and deadline priorities. If evidence is incomplete or a control fails, add missing data, isolate backups, correct failures, document cloud responsibility, run clean restores, and revise continuity steps around filing, payroll, close, client delivery, and communications. Retest and document closure.
How often should CPA and financial firms test incident response?
Review the following systems and records: Incident plan, insurer contacts, vendor escalation, employee reporting, response roles, evidence procedures, communication decisions, ticket priorities, and exercise records. Run a scenario involving client-data access, account takeover, ransomware, vendor outage, or financial fraud and capture response timing, decisions, missing information, deadline effects, and corrective tasks. If evidence is incomplete or a control fails, correct contact, authority, evidence, containment, continuity, notification, and recovery gaps, then repeat the exercise and update the written plan and training. Retest and document closure.
