Busy season is the worst time for a server to fail, a laptop to get stolen or a staff member to click the wrong link. A few weeks of preparation in the fall prevents most of it. Here is the IT checklist we use with accounting and CPA firms before tax season.
1. Confirm your written information security plan is current
Tax professionals are expected to keep a written information security plan (WISP) under the FTC Safeguards Rule, and the IRS asks preparers to confirm they have one when renewing their PTIN. IRS Publication 4557, Safeguarding Taxpayer Data, and Publication 5708, a WISP template for tax and accounting practices, are good starting points. Before busy season, make sure the plan names who is responsible, reflects your current systems and has been reviewed this year.
2. Turn on multi-factor authentication everywhere
Email, remote access, tax software, client portals and cloud storage should all require multi-factor authentication. The Safeguards Rule calls for it, and it stops most account takeovers before they start.
3. Test a restore, not just the backup
Check that your tax and accounting data, document management system and Microsoft 365 are all backed up, then actually restore a file and a client folder. A backup that has quietly failed for weeks looks fine on a dashboard nobody opens. Our six backup questions are a quick way to check.
4. Update and license your tax software early
Install the new year’s tax software, confirm licenses and seat counts, and test it on every workstation that needs it, before the first returns arrive rather than the week they’re due.
5. Patch and check every computer
- Apply Windows and application updates now, so large updates don’t land mid-season.
- Replace any computer that is out of support or struggling to keep up.
- Confirm every laptop is encrypted, in case one is lost or stolen.
- Make sure endpoint protection is installed and reporting on every device.
6. Make remote work secure before you need it
Long hours mean more work from home. Test remote access for every staff member who may need it, and keep client files in protected systems rather than downloaded to personal devices.
7. Train staff on tax-season scams
Phishing aimed at tax professionals spikes every season: fake IRS notices, “new client” emails with malicious attachments and requests to change payment details. A short refresher before January is one of the cheapest protections you can buy.
8. Secure how you exchange files with clients
Clients will send documents however is easiest for them, which is often plain email. Give them a secure portal or encrypted email instead, and make it simple enough that they’ll actually use it.
9. Know who to call, and when
Write down who handles a down server, a locked-out user or a suspected breach, and how to reach them after hours. If you have a security incident, the Safeguards Rule also has notification requirements, so know your process before you need it.
We help Madison and Janesville-area firms work through this list every fall as part of our IT support for accounting firms. If you’d like a second set of eyes before busy season, get in touch or call 608-441-9888.