IT support for CPA firms has to be judged against one brutal test: what happens between January and April. A regional accounting practice in the San Fernando Valley came to SFV Cloud with aging servers, sluggish tax software, and a remote and hybrid staff connecting through infrastructure that was never designed for it. Every busy season became a stretch of workarounds, slow file access, and quiet worry about whether the systems would hold.
We rebuilt their environment around the reality of that seasonal load and the sensitivity of the data they hold. Here is what we found, how we approached it, and what changed by the following filing season.
Why Accounting Firms Are a Harder IT Problem Than They Look
Two characteristics make CPA firms genuinely different from a typical professional services office.
The workload is extraordinarily seasonal. A firm that runs comfortably in September can be at three times that intensity in March, often with seasonal preparers added to the roster. Infrastructure sized for the quiet months fails exactly when failure is most expensive. Onboarding temporary staff securely and quickly becomes an annual requirement rather than an occasional task.
The data is a primary target. A CPA firm holds Social Security numbers, bank details, full financial pictures, and business records for hundreds or thousands of clients in one place. That concentration makes accounting practices a deliberate target for criminals, and attacks are heaviest during filing season when staff are rushed and more likely to click something they should not.
Regulation reflects that risk. Tax professionals fall under the FTC Safeguards Rule, and IRS guidance in Publication 4557 directs every tax professional, regardless of firm size, to maintain a Written Information Security Plan. That plan is expected to cover a designated person responsible for security, a documented risk assessment, access controls including multifactor authentication, encryption of sensitive data, and a written incident response process. Effective IT support for CPA firms has to deliver those safeguards in practice and produce the evidence that they exist.
The Situation: Infrastructure That Could Not Take the Peak
Our assessment surfaced a familiar pattern for a firm that had grown faster than its technology plan.
Aging servers carrying the whole practice. The primary server was past warranty and hosted both the tax application data and the document archive. It was a single point of failure, and during peak season it was visibly struggling.
Slow accounting and tax software. The applications the firm depends on are database driven and sensitive to latency and disk performance. Preparers were waiting on returns to open and on document sets to load, and those seconds compounded across hundreds of returns.
Remote access that fought the staff. Hybrid and remote preparers connected over a VPN that had been added reactively. Performance was inconsistent, and several staff had started keeping local copies of client documents on personal machines simply to work at a reasonable pace. That single habit represented the firm’s largest unmanaged risk.
Scattered client documents. Files lived across the server, email attachments, a portal, and individual desktops. Locating the current version of a client’s supporting documentation took longer than it should have, especially during review.
Security gaps under regulatory scrutiny. Multifactor authentication was applied inconsistently, a few shared accounts existed for convenience during busy season, and offboarding of seasonal staff was informal. Shared credentials are a particular problem here, because they make an audit trail unable to answer who accessed a specific client’s return.
No current Written Information Security Plan. The firm had security measures in place but no documented plan, no formal risk assessment, and no written incident response procedure.
Local, untested backups. Backup ran to a device beside the server. Nobody had attempted a restore, and a fire, theft, or ransomware event would have claimed the original and the copy together.
None of this reflected a careless firm. It reflected a practice whose attention goes to clients and deadlines while infrastructure accumulates in the background. Closing that gap is exactly what real IT support for CPA firms is for.
Our Approach: Build for the Peak, Not the Average
Assessment and Documented Risk Analysis
We started with a formal risk assessment covering every system that stores or transmits client financial data, including the tax applications, document management, email, backups, workstations, mobile devices, and the network. Each finding was rated by likelihood and impact, which produced both the documentation the firm is expected to maintain and a ranked remediation plan. Leadership could see which risks mattered most rather than spending budget on whatever was most visible.
Critically, we scheduled the work around the calendar. Nothing disruptive happens to an accounting firm in February. We planned the significant changes for the post-deadline window and staged the rest so the firm entered filing season on stable ground.
Presenting Real Options With Real Tradeoffs
As with every client, we presented the viable architectures and the honest advantages and disadvantages of each rather than steering the firm toward whatever we prefer to sell.
- Hosted desktop or virtual desktop infrastructure. Places the application next to its data so remote preparers get consistent performance regardless of home internet quality, and keeps client data off personal devices entirely. Higher per user cost, and it changes how staff work.
- Cloud native versions of the accounting and tax platforms. Removes server maintenance and scales cleanly, though it ties the firm more tightly to specific vendors and their pricing.
- Modernized on-premise with cloud backup and secure remote access. Lowest disruption and familiar to staff, but keeps hardware dependency and a refresh cycle in the picture.
- A hybrid split. Latency sensitive applications handled one way, documents and collaboration another.
We modeled cost across a realistic horizon, including the seasonal licensing pattern for temporary staff, and walked leadership through performance, security posture, and administrative overhead for each path. They chose with full visibility into the tradeoffs, which is a large part of why adoption went smoothly.
Designing for Seasonal Scale
We built onboarding and offboarding into a repeatable, documented process so seasonal preparers can be provisioned with correctly scoped access in minutes and fully deprovisioned the day their engagement ends. Capacity was designed for peak season rather than the annual average, with the ability to scale up for the busy months instead of paying year round for headroom used four months a year.
Securing the Environment
- Identity and access control. Individual accounts for every person, multifactor authentication enforced firm wide, shared logins eliminated, and permissions scoped by role so staff reach the clients they work on.
- Encryption throughout. Full disk encryption on every workstation and laptop plus encryption in transit, so a lost device is a hardware loss rather than a reportable data breach.
- Client data off personal devices. The new remote access model removed the reason staff were keeping local copies, which eliminated the firm’s largest unmanaged exposure.
- Email security and staff training. Advanced filtering, secure client document exchange in place of email attachments, and phishing awareness training timed ahead of filing season when attacks intensify and attention is thinnest.
- Audit logging. Records of who accessed which client file and when, supporting both regulatory expectations and credible internal investigation.
- Automated, tested backups. Encrypted backups on a defined schedule, replicated offsite so one incident cannot take both copies, with retention aligned to the firm’s record keeping obligations. We performed an actual test restore and repeat it on a schedule, because an untested backup is an assumption rather than a safeguard.
- A written incident response plan. A documented procedure covering who does what, how the firm continues serving clients during an outage, and what notification obligations apply.
- Documentation that supports the WISP. The technical safeguards we implemented are documented in a form the firm can point to directly.
The Results
The clearest measure came the following spring. The firm worked through filing season without an infrastructure interruption. Returns opened promptly, document sets loaded quickly, and remote preparers had the same experience as staff in the office.
The practice also gained:
Consistent remote and hybrid performance. Location stopped determining productivity, which widened the firm’s hiring pool for seasonal help.
A single source of truth for client documents. Version ambiguity during review disappeared.
Fast, secure seasonal onboarding. Temporary staff get appropriate access quickly and lose it cleanly, closing a gap that had persisted year after year.
A defensible security position. Documented risk assessment, implemented and evidenced safeguards, audit logs, and a written incident response plan. If a client or regulator asks how data is protected, there is a real answer.
Proven recovery. Tested restores mean the firm knows it can recover rather than hoping.
Predictable costs. Emergency repairs and hardware surprises became a planned monthly operating expense, budgeted rather than absorbed at the worst possible moment.
What This Means for Your Firm
If your staff keeps local copies of client files to work at a reasonable speed, if seasonal preparers share a login, if you cannot produce a current Written Information Security Plan, or if nobody has tested a restore, your firm is carrying more risk than it should, both operationally and in terms of regulatory exposure.
Strong IT support for CPA firms addresses performance and security together, because they are connected. Systems that are slow get worked around, and workarounds are precisely where client data ends up somewhere it should not be. The work also has to respect the calendar, which means significant changes happen in the off season and the busy months are protected.
SFV Cloud provides IT support for CPA firms and accounting practices across the San Fernando Valley and greater Los Angeles. We assess honestly, document thoroughly, present real options with real tradeoffs, and stay on as the team that runs it. If you want a clear picture of where your firm stands before the next filing season, reach out and let us start with an assessment.
This article describes general practices and is not legal or compliance advice. Consult qualified counsel or a compliance professional regarding your firm’s specific obligations under the FTC Safeguards Rule, IRS guidance, and applicable state law.
