Michael Bannach
The second week of March, 7:50 in the morning. The managing partner of a sixty-person CPA firm is the first one in, and the tax application will not open. She restarts her workstation. Same thing. She walks to the server room, which is a closet with a louvered door, and the server is beeping in a pattern nobody has heard before.
By 8:30 there are thirty preparers in the building and none of them can work. Every return in progress is on that server. So is the document management system with every client’s source documents, the engagement letters, and the e-file acknowledgments from the last six weeks. The firm’s IT provider says a technician can be there by early afternoon. The provider also asks, in a tone the partner does not like, whether the firm has a spare machine the tax application could run on.
She does not know. She has never been asked.
Busy season is the stress test your IT has never passed
Accounting firms live on a calendar that compresses a large share of the year’s work into a few weeks, and most of the risk with it. The same server that coasted through August is now carrying every preparer, every scanned source document, and every e-file in the firm, and the firm has no slack to absorb an outage. A lost day in July is an inconvenience. A lost day in March is extensions, missed deadlines, and clients who tell the story at dinner parties.
What makes this worse is that busy season is also when nobody in the firm has time to think about technology. The decisions that determine whether a March failure costs an hour or a week were all made, or not made, between May and December. By the time the server is beeping, the only question left is whether somebody did the work.
The three things that decide the day
Whether the failure was seen coming. Drives that fail in March often started throwing warnings in January. A server that is monitored around the clock reports a degraded disk, a failing power supply, or a backup job that quietly stopped completing, and somebody replaces the part on a Saturday in February. A server that is not monitored tells you about the problem by failing. Ask whoever runs your systems a simple question: what did our server tell you last month, and who read it?
Whether the backup is a backup. Every firm says it has one. The only test that matters is whether anyone has restored from it. A backup that copies files to an external drive in the same closet is useful for a deleted spreadsheet and useless for a dead server, a flooded closet, or a ransomware event that encrypts the external drive right along with everything else. The version that saves busy season is an encrypted backup with a copy somewhere your own network cannot reach, taken often enough during the day that a morning failure does not erase the previous afternoon’s returns, and restored as a drill at least once a year so somebody can say how long it takes. “We have a backup” is not an answer. “We restored the tax server to a spare machine in November and it took fifty minutes” is an answer.
Whether anyone decided where the firm works from in the meantime. For a firm with its applications in the cloud, the answer may be “from home, on laptops, until the office is fixed.” For a firm with an on-premises tax server, the answer has to be a spare machine, a cloud copy, or a provider who can stand one up quickly. If the answer is “we wait for the technician,” the firm has decided to lose the day and simply not said so.
The quieter problem: busy season is also phishing season
The outage gets the attention because it is loud. The more common busy-season loss is quieter. Preparers are moving fast, clients are sending documents from every address they own, and the firm’s inbox is full of exactly the kind of messages an attacker can imitate: a client forwarding “the rest of my documents” as a link, a payroll provider asking the firm to re-confirm its portal login, a partner who is traveling and needs a wire sent before noon.
A preparer who clicks the wrong link in March does not usually notice. Someone else now reads her mailbox, learns which returns are about to be filed, and replies in a client’s real thread with “updated” bank details for the refund. The return goes out as filed. The firm finds out when the client calls to ask why the refund has not arrived.
The controls that stop this are not exotic, and your cyber insurance carrier and the Safeguards Rule expect to see them, and so does an examiner if your firm has one: multi-factor authentication on every account, email protection that checks links and attachments after they arrive and watches for a mailbox that starts behaving differently, and staff training that uses the messages preparers see in March. A ten-minute reminder at the start of busy season about refund scams and “updated bank details” requests does more than the annual module.
What the regulators expect, in one paragraph
If your firm prepares returns, you are covered by the GLBA Safeguards Rule. If you advise clients or hold a broker-dealer license, FINRA and SEC cybersecurity expectations apply as well, along with PCI DSS where card data is handled and state privacy rules. Each of them, in its own language, asks for most of the same things: a written assessment of where client data lives and what could go wrong, controls that match it, somebody responsible for the program, training, tested backups, and evidence that all of it is real. The firm that can hand an examiner or an insurer a dated risk assessment, a list of who has access to what, and the date of the last restore test has a program. The firm that has the controls but no paperwork has a problem waiting for the first audit.
Three questions for whoever runs your IT
- What did our server report in the last thirty days, who read it, and what did they do?
- When did you last restore our tax and document systems from backup as a test, and how long did it take?
- If the server failed on the second Monday of March, where would our preparers be working from by lunch?
A provider who manages accounting firms answers all three with dates and numbers. If the answers are “we would have to look into that,” you have learned what you need to know before busy season does it for you.
How we handle it for accounting and financial firms
Our work with accounting firms, advisors and financial service providers is built around the calendar. We plan maintenance for the quiet months, monitor around the clock so the January warning gets fixed in February, keep encrypted backups with verified recovery testing, and treat any incident that blocks a client deliverable as a priority during busy season. Multi-factor authentication on every account, endpoint detection and response, email protection against business email compromise, and regular access reviews are the baseline, with reporting you can put in front of an examiner or a carrier. Before anything starts, the firm gets a documented onboarding plan with dates and agreed service levels that we report against.
If you want a plain read on where the firm stands before busy season, the three-minute IT and security scorecard turns your answers into a written roadmap, and the conversation after it is free. You can also read more about how we work with financial firms.
