Your WISP Says You Oversee Your Vendors. Do You?

Accounting firm IT, in the order that matters

Most accounting firm IT pitches start with the word compliance and end with a retainer. Here is the useful version.

The Safeguards Rule has nine elements. Four of them are technical, and a hosting and email provider affects those four. The other five are yours: the risk assessment, the training, the incident response plan, the annual report to leadership, and the person accountable for all of it.

Nobody can sell you the other five. Be suspicious of anyone who implies they can.

Do the free things first

Multi-factor authentication on email. It is required, it is free, and it ends the majority of account compromises before they start.

SPF, DKIM and DMARC on your domain. These stop somebody sending mail that appears to come from your firm — which, during filing season, is exactly what somebody will try.

Remove seasonal accounts in May. Dormant accounts with live credentials are the cheapest risk you will ever retire.

Then move the documents

Between January and April a small practice takes in thousands of pages carrying Social Security numbers, dates of birth, bank details and complete financial pictures.

Most of it arrives as email attachments from clients using whatever device was nearest, and most of it is still sitting in those mailboxes years later.

A portal changes two things. Clients stop emailing documents, and you gain an access log — who opened what, when, and whether their access is still live. For a firm documenting controls, the log is the part that matters.

The vendor oversight nobody has written down

This is the element we see missing most often, and it is the one we are directly part of.

The Rule asks you to select service providers capable of protecting customer information, require security by contract, monitor them, and reassess periodically. If your hosting is on a card somebody expensed four years ago and nobody has looked at since, that section of your programme is fiction.

We will tell you in writing where your data sits, what encryption applies, how backups work and how long they are retained. You still have to write the oversight into your programme, but you will have accurate facts to write.

What we are not

We are not your Qualified Individual. We do not write your WISP. We do not certify compliance, because no vendor can — the FTC examines your programme, not your supplier’s marketing.

We also will not pretend that buying encrypted email makes a firm compliant. It satisfies part of one of nine elements. That is worth doing and it is not the whole job.

Questions to ask any accounting firm IT vendor

Your programme has to document vendor oversight, so these are not idle questions — the answers go in writing.

Where does our data physically sit, and under whose law? Company location and server location are often different countries. Both belong in your risk assessment.

Is encryption included or an upgrade? The Rule requires customer information encrypted at rest and in transit. A vendor charging extra for that is telling you where it sits on their roadmap.

What exactly is backed up, how often, and for how long? Vague answers here become vague answers in your programme. Ours: CodeGuard takes encrypted off-site copies daily with per-file version history, and the data center is backed up daily with seven days of retention.

Can we get an access log? For document exchange this is the difference between asserting that access is controlled and evidencing it.

What happens when we leave? Standard formats and a clean export mean your records are portable. A proprietary system with no export is a risk you are accepting on behalf of your clients.

Who do we call at 7am on April 14th? Ticket-only support is fine in September. It is not fine during the last week of filing season, and that is the week it will matter.

A note on templates

There is a healthy market in WISP templates, and a template is a reasonable starting point.

The failure mode is adopting one unchanged. A plan describing controls your firm does not have is worse than no plan, because it documents a gap between what you claimed and what you did — which is precisely what an examiner or a plaintiff’s lawyer is looking for.

Use the template, then correct every line that is not true of your firm. The infrastructure section is the one we can give you accurate facts for.

What a five-person practice actually spends

Encrypted email for five people, a client document portal and off-site backups with version history is a small monthly figure you can total from the pricing above.

Seasonal seats flex with the season. Network and endpoint support are quoted per firm, because a two-partner practice and a fifteen-person firm with a server room are not the same job and a single number would be wrong for one of them.

Tell us how client documents arrive during filing season and where they end up afterwards. We will show you what to move out of email first, what to authenticate on your domain, and what it costs. If two changes get you most of the way, we will say that rather than quoting you six.

One last thing worth saying plainly. Compliance work has a way of becoming an annual panic in the week before something is due, and then being forgotten for eleven months. The firms that find this easy are the ones that did the free controls once, wrote down honestly what their vendors do, and then only had to revise a page each year rather than rebuild the whole thing. That is a much smaller job than it looks like from the outside, and it is mostly a matter of starting.