Often, yes. The FTC explicitly includes tax preparation activities among examples of covered financial institutions, and the IRS reminds tax and accounting professionals that they are expected to protect taxpayer data through documented safeguards, including a Written Information Security Plan (WISP).

In practice, the real question is not whether the rule applies, but whether your firm’s documented controls, testing, vendor oversight, and response procedures would hold up if you were ever scrutinized after an incident.

It is not a single software purchase or a one time project. For most CPA firms, it means a written security program (often called a WISP), a clearly designated person responsible for it, a risk assessment, role based access controls, MFA, encryption, monitoring and periodic testing, vendor oversight, and a defined incident response process.

That is the operational model both the FTC and the IRS consistently point firms toward.

Usually not. A better approach is to map where taxpayer and client data actually lives—across Microsoft 365, portals, scanners, tax applications, and e file tools—and then tighten identity, sharing, endpoint, backup, and vendor controls around those workflows.

The FTC is explicit that using third party service providers does not remove your responsibility for safeguarding customer information, which is why integration and governance matter far more than wholesale replacement.

Phishing, stolen credentials, cloud account compromise, and ransomware remain the repeat offenders. Ongoing IRS Security Summit guidance continues to warn tax professionals about phishing and related attacks, and IRS publications note that data thefts at tax professionals’ offices are increasing because CPA firms hold high value financial and taxpayer information.

Start with the controls that reduce risk the fastest: MFA everywhere, cleanup of privileged access, endpoint protection, secure and tested backups, a current WISP, and basic staff security training.

That sequence aligns with FTC and IRS expectations and reflects operational reality—many firms are interested in better technology and automation but cite lack of time and uncertainty about where to begin as the biggest barriers.

Yes—if the work is designed around the calendar. The right approach is to stabilize first, reduce obvious risks immediately, and reserve broader platform or workflow changes for less sensitive periods.

CPA firms cannot afford deadline week downtime, which is why transitions need to be predictable, incremental, and focused on continuity first.

A low drama transition starts with discovery, documentation, access review, and security baselining before any major changes are made.

In most cases, onboarding runs in parallel over a defined window, with direct coordination between providers. That operational clarity is often what CPA firms want to understand before they consider making a move.

Fully managed support makes sense when partners, office managers, or administrators are carrying too much day to day technology responsibility already.

Co managed IT is often the better fit when you have internal IT help but need deeper security monitoring, stronger project execution, or a more experienced bench for upgrades and incident response. Both models exist to reduce risk and workload—not add layers.

Treat AI as a governed workflow decision, not an ad hoc experiment with client data. Firms that adopt AI with clear use cases, training, data handling rules, and accountability consistently see better outcomes than those using informal or uncontrolled approaches.

This is especially important for CPA firms where client confidentiality, auditability, and defensibility matter as much as efficiency.

The real ROI is not just lower monthly IT spend. It is fewer interruptions during filing deadlines, less partner and staff time spent firefighting technology issues, stronger protection of client data, and more usable capacity for higher value client work.

That matters as firms manage capacity carefully and Client Accounting Services continue to be a major growth engine. Predictable, scoped pricing and flexible agreements also make it easier to align IT decisions with firm reality.