Accounting firms usually have four very different kinds of data, and treating them as one backup job is where things break. QuickBooks company files, tax software data tied to annual program versions, a cloud productivity suite, and the client document store all fail differently and recover differently. And unlike most businesses, a firm’s recovery deadline is not abstract. It’s April 15, or the extension deadline, or the day a client’s lender needs financials.
Here’s what each one actually needs.
How should QuickBooks be backed up?
QuickBooks Desktop company files need an application-consistent backup, not a file copy. A .QBW file copied while it’s open, especially with multiple users in it, is frequently damaged or unusable on restore.
What that means in practice:
- Use QuickBooks’ own verify and backup process, or a backup tool that captures the file in a consistent state after users are out. The verify step checks the file for corruption at backup time, which is when you want to find it
- Watch the multi-user problem. Creating a proper local backup generally requires the file to be out of multi-user mode, so backups that “just copy the folder” overnight can silently capture a locked, inconsistent file for months without anyone noticing
- Back up the whole data environment, not just the .QBW: attached documents, loan manager files, and anything else living in the company file folder
If you’re on QuickBooks Online, Intuit runs the platform and protects it against their own failures. Recovering from your side, a bad import, a mass delete, a compromised login, is a different question, and QBO’s native undo options are limited. Regular exports or a third-party QBO backup give you a copy you control, and a point of reference if you ever need to show the books as they stood on a specific date.
What does a tax software backup have to include?
Tax data has a wrinkle most backup plans miss: the annual version treadmill. Lacerte, UltraTax, Drake, ProSeries, and their peers ship a new program every season, and a prior year return generally opens only in that year’s software. A backup of your 2019 data files is not restorable in practice unless you can also stand up the 2019 program.
A complete tax backup covers three things:
- The data files for every year you retain, in whatever structure your package uses
- The software itself, meaning installers, license information, and any conversion notes, for each retained year. When a workstation dies in March, “we have the data somewhere” and “we can open the return” are very different states
- E-file acknowledgments. These are your proof that a return was transmitted and accepted. If a filing dispute surfaces years later, the acknowledgment is the record you want, so it needs to live somewhere the backup actually covers
The test is simple to state and rarely run: pick a return from four years ago and get it open on a clean machine. If that takes more than an afternoon, the backup is incomplete. For the day-to-day side of keeping these packages running, see our notes on tax and accounting software support.
Doesn’t Microsoft back up Microsoft 365?
No. Microsoft operates under a shared responsibility model: they keep the service available and protect against their own infrastructure failures. Recovering your data after your own people delete it, or after ransomware encrypts it, is your responsibility.
The retention windows people mistake for backups are deletion grace periods:
- Exchange Online: deleted items sit in Recoverable Items for 14 days by default, extendable to 30
- SharePoint and OneDrive: first and second stage recycle bins total 93 days
- A departed employee’s OneDrive: retained 30 days by default after the account is deleted
Past those windows, it’s gone. For a firm, that departed-employee window deserves special attention, because seasonal staff turnover is built into the business, and a preparer’s OneDrive full of client correspondence quietly expiring a month after their account is removed is exactly the kind of loss nobody notices until a client asks.
None of those windows help when a compromised account’s files are encrypted and the encrypted versions sync to the cloud looking like legitimate edits. A third-party Microsoft 365 backup with its own independent retention is the fix, covering Exchange, SharePoint, OneDrive, and Teams. This is the same gap we cover for construction companies in the construction backup guide, and it’s the most common one in any industry.
What about client documents and the document management system?
Client files are the memory of the firm: source documents, workpapers, engagement letters, signed returns. Two questions decide the design.
First, where do they actually live? A DMS like a document management module in your tax suite, a SharePoint library, a file server, or some mix of all three. The backup has to cover the real working locations, including the informal ones. Scans sitting in a shared “ToFile” folder are client records too.
Second, how far back can you reach? The failure mode with documents is rarely a dramatic outage. It’s a workpaper overwritten, or a folder quietly deleted, and nobody noticing until the next engagement, months later. If your version history and backup retention only reach back 30 days, the good copy is already gone. Retention depth matters more than backup frequency here.
If your DMS runs on a database, it needs the same application-aware treatment as QuickBooks: a backup that coordinates with the database rather than copying live files underneath it.
How long do backups need to reach back?
Your retention policy, commonly seven years for many record types, drives the design. IRS record keeping guidance and professional standards push firms toward multi-year retention for returns and workpapers, and many firms set seven years or longer in their written policy. The exact periods are a decision for the firm and its own counsel. The IT requirement is simpler: whatever the policy says, the backup and archive design has to actually support it.
The mismatch we find most often is a firm with a seven year retention policy and a backup platform holding 90 days. The gap is invisible until someone asks for a 2020 workpaper. Long-term retention usually means a separate archive tier rather than stretching the daily backup, which keeps costs sane and keeps the archive copies out of the way of day-to-day operations.
What rules tie all of this together?
Three, two, one. Three copies of the data, on two different types of storage, with one copy off-site. This is the baseline standard, not an aspiration. Our 3-2-1 backup rule explainer walks through it in plain terms.
One copy immutable. Immutable means the backup cannot be altered or deleted for a set period, even by an administrator account. Ransomware crews target backups first, and a backup an admin credential can delete is a second target rather than a recovery plan.
Encrypted at rest, everywhere. Backups are complete copies of exactly the client financial data the FTC Safeguards Rule covers, so they sit inside your information security program, not beside it. Every copy encrypted at rest, access restricted, and the backup platform itself protected with MFA.
Test restores on a schedule. Quarterly at minimum, and always once before filing season opens, which is one of the checks in our tax season IT readiness guide. Test the restore, not the green checkmark: open the restored QuickBooks file, open the restored return in the matching program year, spot-check a restored client folder. Most backup failures are discovered during the emergency they were supposed to prevent.
Where do accounting firms most often come up short?
In our experience across Houston and Dallas-Fort Worth, the same gaps repeat: Microsoft 365 with no real backup at all, a QuickBooks file being copied live instead of verified and backed up, tax data retained without the matching software versions, and a restore that has never once been tested. All of them are fixable in weeks, and none of them should be discovered in March.
Braintek has supported Texas businesses since 2002, with staff in Houston, DFW, and the Philippines. Fully managed support fits firms of roughly 10 to 50 employees, and co-managed arrangements scale to around 1,500. Phone calls are typically answered within about 60 seconds and emailed tickets typically get a response within about 2 hours, which matters most in the weeks when a down system costs billable time by the hour.
If you want to know where you actually stand, our backup and disaster recovery service starts by inventorying what’s covered today versus what everyone assumes is covered, and our IT services for accounting firms keep the restore testing, the Safeguards documentation, and the vendor coordination with Intuit and your tax software provider on a schedule rather than leaving it to whoever remembers.