How to Evaluate Your IT Setup Before January: A CPA Firm Checklist

Remote access

• Can every staff member who needs to work remotely actually log in from home right now? Test it before January, not during.
• Is your remote access solution secured with multi-factor authentication? If not, this is the first thing to fix.
• Do you have a backup remote access method if your primary VPN or remote desktop goes down?
• Are remote access credentials current? Remove any former employees who still have access.

Backups

• When did you last verify that your backup actually works? A backup you have never tested is not a backup.
• How frequently are your critical files backed up? Daily is the minimum for active tax files.
• Is your backup stored offsite or in the cloud, separate from your main systems? An onsite-only backup does not protect you from ransomware.
• How long would it take to restore your most critical files if your server went down tomorrow?

Security basics

• Is multi-factor authentication turned on for Microsoft 365 and any other cloud applications your firm uses?
• Are all workstations running current operating system versions with automatic updates enabled?
• Do you have endpoint protection on every computer, including any home machines staff use for work?
• When did you last review who has admin-level access to your systems? Remove access that is no longer needed.
• Have you run a phishing simulation or done any security awareness training with your staff in the past year?

Hardware and software

• Are any workstations more than five years old? Aging hardware fails at inconvenient times and runs newer tax software poorly.
• Is your tax software licensed and updated for the current filing year? Do not find out it needs a major update on January 15th.
• Do you have enough workstations for your full staff, including any seasonal hires?
• Is your printer and scanner setup reliable? Document scanning is high-volume during tax season and hardware failures are disruptive.

Your IT support coverage

• Do you have an IT provider with a documented response time? Knowing you can get someone on the phone in under an hour matters differently in April than in July.
• Does your IT provider know that tax season is a critical window for your firm? Have you communicated that explicitly?
• Do you have an after-hours contact for IT emergencies, or only a ticket system that gets answered the next business day?
• Is there a written plan for what happens if a critical system goes down during filing season?

One more thing to check

Pull out your cyber liability insurance policy and read through the security requirements. Many policies require MFA, documented backup procedures, and regular security reviews as conditions of coverage. If you are not meeting those requirements, your policy may not pay out when you need it.

This is a fifteen-minute review that most firms skip. Do not skip it.