An IT failure at an accounting firm is never just an inconvenience. In February it means staff sitting idle while deadlines don’t move. A security lapse is worse: client financial data walking out the door, or a spoofed email turning into a six-figure wire. So don’t choose an IT provider on price and a friendly sales call. Evaluate every candidate, including us, on the factors below, then score them.
Do they have real FTC Safeguards Rule experience?
This is the heaviest weight on the scorecard because it’s where generalist providers fail quietly. The FTC Safeguards Rule requires firms handling customer financial information to maintain a documented security program, and IRS Publication 4557 adds expectations specific to tax professionals. “We do security” is not a program.
Ask each candidate:
- Have they implemented a Safeguards program before? Ask to see a sanitized written information security plan.
- Can they walk through the required pieces: risk assessment, access controls, encryption, MFA, monitoring, and a designated qualified individual?
- Will they document the program so an audit or cyber insurance questionnaire is answerable, not a scramble?
A provider who has done this will answer with document names and processes. One who hasn’t will answer with product names. Our IT support for CPAs and financial advisors page covers how we approach it.
Will they be there during tax season?
Your workload is not flat, and your IT coverage shouldn’t pretend it is. The weeks before March 15 and April 15 are when a slow server or a broken remote session costs the most, and when “we’ll look at it tomorrow” is unacceptable.
Ask directly:
- What does after-hours and weekend support look like, and what does it cost?
- How do they handle seasonal staff, onboarding and offboarding accounts and access quickly and securely?
- Do they schedule maintenance and updates around filing deadlines, or on their own calendar?
- What happens when something breaks at 9 PM during the final week?
Listen for whether the provider has thought about accounting firm rhythms at all. Many haven’t.
How fast do they actually respond?
Every provider says “fast response.” Make them define it with numbers, and demand those numbers in writing.
- How quickly is the phone answered by a human?
- How quickly does someone start working the problem, not just acknowledge the ticket?
- How are those numbers measured?
For calibration: Braintek’s phone is typically answered within about 60 seconds, and emailed tickets typically get a response in about two hours, with staff in Houston, DFW, and the Philippines covering the desk. Whatever numbers a candidate gives you, get them written into the agreement. We break down what good looks like in what counts as acceptable IT response time, and what belongs in the contract itself in what a managed IT agreement should include for a CPA firm.
How do they stop wire fraud and email attacks?
Most attacks on accounting firms arrive by email: fake invoices, spoofed partner accounts, and the business email compromise scams behind real wire fraud losses. Firms that handle payment instructions and client funds are exactly who these scams target.
Ask any candidate to describe their layers:
- Email filtering and impersonation protection
- Multi-factor authentication on email and remote access
- Security awareness training for staff, including seasonal hires
- Verification procedures for payment and wire instruction changes
- What happens in the first hour after someone reports a suspicious click
The answers should be specific processes. If a provider can’t explain how they’d keep a spoofed email from becoming a completed wire, they’re not ready for an accounting firm.
Do they understand your software environment?
Be wary of two extremes: the provider who has never touched a tax application, and the one who claims certified mastery of every package on the market. The honest middle is what you want. Your tax prep, accounting, and document management applications run on servers, workstations, file shares, and remote access that someone has to keep fast, patched, and available, especially under peak load. And when the application itself misbehaves, you want a provider who gets on the phone with the software vendor rather than leaving you stuck between two companies pointing at each other.
Ask candidates to describe accounting environments they support today. Specific, recognizable answers about hosted versus local installs, file share performance, and vendor coordination are the tell.
How do they handle backup and document retention?
Accounting firms have two backup problems, not one: getting data back quickly after a failure, and retaining records as long as your obligations require. Ask:
- How often are restores actually tested? A backup that has never been restored is a hope, not a plan.
- Does coverage include Microsoft 365 and the data behind your tax and accounting applications, not just a file server?
- Can retention periods be set to match your document retention requirements instead of a generic default?
- After a ransomware event or server failure, how long until the firm is working again?
Recovery time matters most in context. Losing a day in August is annoying. Losing a day in the first week of April is a different conversation.
What do their references and reviews say?
Ask for references from other accounting or professional services firms, then actually call them. Ask about tax season specifically: was the provider reachable, did response hold up under the crunch, and how did they handle a real incident?
Then read each provider’s Google reviews with a critical eye. Count matters less than recency and relevance. A wall of five-star ratings from two years ago says less than a steady stream of recent reviews that mention response times and named technicians. Apply that lens to every provider on your shortlist, ours included.
How do you score the finalists?
Once you’ve asked the questions, resist the urge to decide on gut feel or price. Score each finalist out of 100:
| Factor | Points |
|---|---|
| FTC Safeguards Rule and IRS Pub 4557 experience | 25 |
| Tax season availability and after-hours coverage | 15 |
| Response speed and service model | 15 |
| Email security and wire fraud prevention | 15 |
| Tax and accounting software environment familiarity | 10 |
| Backup and document retention | 10 |
| References and Google reviews | 5 |
| Price | 5 |
| Total | 100 |
Weighting price at 5 points is deliberate. The spread between serious proposals is usually small compared to the cost of one wire fraud loss, one compliance failure, or one down day during filing season. If you want the pricing side of the comparison in detail, see how much managed IT costs for a CPA firm. The short version: expect roughly $150 to $250 per device per month plus $15 to $35 per mailbox, with licensing billed separately, and compare inclusion lists before comparing numbers.
Which service model should you ask about?
The right structure depends on what you already have in-house. If the firm has no internal IT staff, which is typical around 10 to 50 employees, fully managed IT puts the whole stack, help desk through security and compliance, under one provider. Larger firms with an internal IT person or team usually do better co-managed, where internal staff keeps day to day ownership and the provider supplies depth behind them: security tooling, escalations, projects, and after-hours coverage. We support co-managed environments up to around 1,500 employees. Be wary of any provider that pushes the bigger contract before understanding your setup.
Put us on the scorecard
Braintek has supported Texas businesses since 2002, with staff in Houston, DFW, and the Philippines, and accounting and advisory firms are a core part of that work: Safeguards Rule programs, tax season coverage, wire fraud defenses, and the environments tax and accounting software depends on. Ask us the same questions you ask everyone else. We’ll give you specific numbers and specific processes, in writing, and let the scorecard do the deciding.