Home / Industries / Accounting & tax

IT for firms that can’t lose a day in April.

Tax and accounting firms hold the most complete identity files of anyone: Social Security numbers, bank accounts, income and dependents. You get the written security plan the law requires, and systems that hold up when the deadline doesn’t move.

  • CPA firms
  • Tax preparation offices and enrolled agents
  • Bookkeeping and payroll services
  • Fractional CFO and advisory firms
  • Seasonal and home-based preparers
  • Valuation and forensic accountants

What makes accounting IT different

Accounting firms are busiest exactly when attackers are. Tax season brings long hours, seasonal staff, a flood of client documents by email and pressure to click quickly. It’s perfect cover for a fake new-client email or a message pretending to be the IRS.

The rules are clear even if they’re not well known. Paid tax preparers are covered by the FTC Safeguards Rule regardless of size, and the IRS describes a written information security plan, or WISP, as required by law. It publishes a free template to build one.

Most firms are a handful of people with tax software, a practice management system, a client portal and email. Getting the essentials right takes days, not months, and it makes the busy season calmer, not harder.

Rules you may answer to

Every firm that prepares returns answers to the first two. The rest depend on your clients and services.

FTC Safeguards Rule
Tax and accounting firms that handle consumer financial information need a written information security program, a Qualified Individual to run it, access controls, multi-factor sign-in and encryption. Firms with information on fewer than 5,000 consumers are excused from a few written requirements, such as the written risk assessment and incident response plan, but not from the safeguards themselves.
FTC breach notification
Since May 13, 2024, a breach of unencrypted information affecting 500 or more consumers must be reported to the FTC within 30 days of discovery.
IRS Publications 4557 and 5708
Pub 4557 explains the security steps the IRS expects of tax professionals. Pub 5708 is a free template for your written information security plan.
GLBA
The Gramm-Leach-Bliley Act is the law behind the Safeguards Rule. It also brings privacy notice requirements for many firms.
SOX
Firms that support public-company clients work inside those clients’ SOX internal control requirements, including the IT general controls around their financial systems.

Where accounting and tax firms get hurt, and how I close the gap

One tax firm holds hundreds of complete identities, which makes preparers a favorite target. These are the patterns the IRS and FTC see most, with the numbers behind them and what I do about each.

  1. Nearly 300data breaches at tax professionals reported in the first half of 2025, affecting as many as 250,000 clients

    Phishing aimed squarely at preparers

    Fake “new client” emails carry malicious attachments, and messages impersonating the IRS or software vendors try to steal e-Services and CAF credentials so criminals can file fraudulent returns in your clients’ names.

    What I doMulti-factor sign-in on email, tax software and IRS e-Services, email filtering, and short training before every tax season on the scams actually going around.

    Source: IRS, IR-2025-88 (August 2025)

  2. 30 daysto notify the FTC after discovering a breach of unencrypted data affecting 500 or more consumers

    No written plan, no Qualified Individual

    Every firm that prepares returns needs a written security program with someone named to run it. Without one, a firm is out of compliance before anything goes wrong, and a breach makes that very visible.

    What I doA written information security plan built on the IRS template and fitted to how your firm actually works, a named Qualified Individual, and a yearly review before tax season.

    Source: FTC, Safeguards Rule: What Your Business Needs to Know

  3. 5,000consumers is the line below which firms skip some written requirements, but not the safeguards

    “We’re too small for the rule”

    The Safeguards Rule applies regardless of size. Small firms are excused from paperwork such as a written risk assessment, not from multi-factor sign-in, encryption, access controls or the security program itself.

    What I doA plain reading of what applies to your firm, then the safeguards turned on and documented: multi-factor sign-in, encryption, secure disposal and access reviews.

    Source: FTC, Safeguards Rule: What Your Business Needs to Know

  4. 48%of breaches analyzed in 2025 involved ransomware

    Ransomware in the middle of tax season

    A locked system in March or April means missed deadlines, extensions for every client and a phone call to each of them. Attackers time their attacks for when you can least afford to be down.

    What I doBackups kept off the network and tested by actually restoring, monitored endpoint protection, and patches applied on a schedule rather than when someone remembers.

    Source: Verizon 2026 Data Breach Investigations Report, via TechRepublic

Related services: Managed IT services · Network security & cybersecurity · Microsoft 365 & Google Workspace · Secure AI · Staff training

Where AI helps, and where it needs guardrails

AI can take hours out of engagement letters, client emails and research. It also makes it easy to paste a client’s return into a free chatbot, which is a disclosure you never meant to make.

Good places to start

  • Engagement letters, client reminders and organizer cover letters
  • Summarizing tax law changes and IRS guidance for staff
  • Plain-language client emails explaining a notice or a filing
  • Procedures, checklists and training for seasonal staff
  • AI features inside your tax or practice software, covered by your agreement with that vendor

Keep out of AI tools unless approved

  • Returns, W-2s, 1099s and bank statements in free or personal tools
  • Client Social Security and account numbers anywhere outside approved systems
  • AI tools that train on what you type
  • Tax positions taken from AI output without professional review

How a secure AI setup works

Put AI to work on tax season

The hours that disappear in March are mostly data entry and chasing documents. AI can read, sort and check. Your professionals keep the judgment calls.

Source document reading

AI that reads W-2s, 1099s, K-1s, receipts and bank statements and puts the numbers into your workpapers for staff to review.

What it covers

  • Tax forms read and matched to the right client
  • Bank and credit card statements categorized
  • Receipts and invoices captured for bookkeeping clients
  • Missing-document checklists sent to clients automatically
  • Year-over-year comparisons that flag what changed

Best forFirms where seasonal staff spend weeks keying numbers.

  • Less data entry
  • Faster returns
  • Fewer missed documents

Anomaly detection and forecasting

Client books checked for the things that cause trouble later, and cash flow forecasts you can offer as an advisory service.

What it covers

  • Duplicate payments and unusual transactions flagged
  • Vendor and payroll changes that don’t look right
  • Cash flow forecasts for bookkeeping and CFO clients
  • Month-end close checklists that check themselves

Best forBookkeeping, CFO and advisory practices.

  • Cleaner books
  • Earlier warnings
  • New advisory revenue

How it gets set up

  • Client data only in tools covered by your agreements and your written security plan.
  • Built into the tax, practice and bookkeeping software you already use wherever possible.
  • Every AI-extracted number reviewed before it lands on a return.

AI consulting & integration · Agentic operations

Common questions

Do we really need a WISP?

Yes. The FTC Safeguards Rule requires a written information security program for tax preparers and many accounting firms, and the IRS describes the WISP as required by law. IRS Publication 5708 is a free template. I’ll help you turn it into a plan that matches how your firm really works.

Can we use ChatGPT with client data?

Not with free or personal accounts. Tax return information also has its own federal confidentiality rules, so check how a tool handles your data and what your clients have consented to before client information goes anywhere near it. Many firms start with AI on engagement letters, procedures and research, where no client data is involved.

What should we do before tax season?

Confirm multi-factor sign-in is on everywhere, test a restore from backup, remove accounts for anyone who has left, set up accounts for seasonal staff properly instead of sharing logins, and run a short refresher on the current scams.

What if we suspect a breach?

Disconnect affected computers from the network without wiping them, change passwords from a clean device, and call for help. Contact your IRS Stakeholder Liaison so the IRS can watch for fraudulent returns, and check your FTC and state notification obligations. Having this written down in advance makes it far less painful.

Sources

  1. IRS, IR-2025-88 (August 2025)
  2. FTC, Safeguards Rule: What Your Business Needs to Know
  3. Verizon 2026 Data Breach Investigations Report, via TechRepublic
  4. IRS Publication 4557, Safeguarding Taxpayer Data
  5. IRS Publication 5708, Written Information Security Plan template
  6. IRS, IR-2026-111 (September 2026)

Figures and rules on this page were checked against these sources on October 27, 2026, using the latest edition available. This page is general information, not legal advice.

Other industries

Make tax season the only stressful part.

Tell me how your firm runs today. You’ll get a clear read on where you stand with the Safeguards Rule and a plan to close the gaps before the next deadline.

Book a callSend a message