September 2026 | Cybersecurity for CPA Firms Salt Lake City | AI & Disaster Recovery | WISP & IRS Compliance
Most CPA firms know they should have a disaster recovery plan. The IRS goes further: under Publication 4557 and the FTC Safeguards Rule, every tax preparer is required to maintain a Written Information Security Plan (WISP). Yet many firms have a plan that's outdated, untested or incomplete — and with extension deadlines consuming September and October, it's easy to see why.
That's not because firms lack initiative. Usually, the challenge is getting the first version down. People are far better at improving something than starting from scratch. Give your partners a rough draft and they'll point out what's missing, what's unrealistic and what needs to change. Leave them staring at an empty document during extension season, and the work gets pushed aside.
That's where AI fits into preparedness planning for Salt Lake City accounting firms — not as a replacement for strategy or cybersecurity expertise, but as a tool that provides a useful starting point. With September being National Preparedness Month, here are five ways to put it to work.
One rule before anything else: never put client tax data, SSNs or any identifying client information into public AI tools. IRS Publication 4557 and your professional confidentiality obligations apply to AI prompts just as they apply to email. Use AI for structure, drafts and questions — never for client tax records.
1. Document Processes Faster
One of the biggest obstacles to preparedness planning is getting everyday processes out of people's heads and into a format others can follow during an emergency — or when a key team member isn't available in the middle of a deadline push.
AI can turn rough notes or scattered bullet points into clear first drafts: how to restore access to UltraTax CS or Lacerte, who needs to be contacted during an outage, what steps your accounting staff should follow when the client portal or e-filing connection is unavailable.
The draft still needs review by the people who know the firm. But a working draft is much easier to refine than a blank page — especially when the blank page has been sitting empty since last tax season.
2. Create Checklists and Response Playbooks
A good plan is easier to follow when it's broken into clear steps. AI can create first drafts of checklists and response playbooks for situations like a data breach involving client records, a ransomware attack during filing season, a natural disaster or an unexpected system outage two weeks before a deadline.
Useful documents include an outage communications checklist, a seasonal staff onboarding and offboarding guide, a business continuity checklist ordered around tax deadlines, or a basic response outline for an e-filing disruption.
Here too, AI produces a starting point — not a finished plan. It doesn't know your firm, your clients, your software stack or your regulatory obligations unless you give it the right context. Firm leadership reviews the output and decides on the final version.
3. Identify Gaps You Didn't Know to Look For
The hardest part of recovery planning is knowing what questions to ask. AI can help close that gap. Try prompting it with specific questions:
- What happens if our tax software is down for eight hours on October 14?
- What operational and security risks should a CPA firm consider under IRS Publication 4557?
- What's typically missing from an accounting firm's Written Information Security Plan?
AI won't know which risks matter most to your firm without context. But it can surface questions, dependencies and weak spots your team should examine more closely — including phishing schemes dressed up as IRS notices, which target tax professionals precisely because client SSNs are among the most valuable data criminals can steal.
4. Simplify Technical Information
Most technical documentation isn't written with managing partners in mind. Backup reports, security findings and system notes can be accurate and still hard to turn into a clear decision.
AI can translate that information into plain English: summarize what a backup report actually says about your client tax records, explain what a security finding means for daily operations and identify the points firm leadership should discuss with your IT provider.
The goal isn't for every partner to understand every technical detail. It's for the right people to understand enough to make informed decisions about what needs attention before January, what can wait and what could become a serious problem — or a compliance failure — if ignored.
5. Keep Your WISP and Documentation Current
Policies and documentation become outdated faster than people expect. Seasonal staff come and go, tax software gets upgraded every fall, vendors update their processes and new threats emerge every filing season. An outdated WISP doesn't satisfy the IRS requirement — the plan has to reflect how your firm actually operates today.
AI makes it easier to review and refresh documentation: compare last year's procedures against this year's notes, standardize the format across documents written at different times, or turn recent changes — a new portal, a new practice management platform like TaxDome or Canopy — into updated drafts your team can review.
Human ownership still matters. AI can streamline the maintenance work, but only a person can decide what's accurate, what's approved and what your accounting staff should follow. The IRS requires a written plan your firm owns — AI can help draft it, but it can't be responsible for it.
Where AI Stops
Everything above depends on using AI the right way: as a draft, a guide, a way to move planning forward. The closer you get to real client impact, the more that distinction matters.
There are things AI simply can't do, regardless of how good the prompt is:
- Test your backups or confirm client tax records will actually restore under real conditions
- Verify that your recovery timeline is realistic when a filing deadline is days away
- Understand the nuances of your firm, your clients or your obligations as a tax professional
- Coordinate your accounting staff during an active outage or breach
- Replace the strategic judgment that comes from experience and accountability
That part takes leadership, tested processes and an IT partner who can validate that the plan holds up.
Where a Cybersecurity and IT Partner Fits
A recovery plan can look complete on paper and still fall short when it matters most. The difference is the experience behind it.
Qual IT understands how a CPA firm's systems depend on one another — tax software, portals, e-filing, document management — and where hidden risks emerge. We test recovery strategies to make sure they work in practice, not just in theory, and we bring the cybersecurity perspective that turns a WISP from a compliance document into genuine protection. We work with Salt Lake City CPA firms to protect client data and keep systems running through tax season.
AI can help you build the first draft. We make sure the plan is ready for the real world — and ready for January.
Frequently Asked Questions
Do you offer cybersecurity and IT support for CPA firms in Salt Lake City?
Yes. Qual IT provides cybersecurity, backup and disaster recovery, WISP support and business continuity planning for CPA firms across Salt Lake City and the greater Wasatch Front, along with day-to-day IT support built around tax deadlines.
Can AI write our firm's Written Information Security Plan?
AI can help draft it, but it can't own it. The IRS requires a written plan that reflects your firm's actual safeguards, and your firm is accountable for its accuracy. Use AI for structure and first drafts, keep client data out of the prompts entirely, and have firm leadership and an IT partner experienced in IRS data security compliance IT in Utah validate the final plan.
How often should a CPA firm update its disaster recovery plan and WISP?
Review both at least annually — ideally in the window between October 15 and January — and any time the firm changes significantly: new tax software, new portal, new staff or a new office. An outdated plan can be nearly as risky as no plan at all, and it won't satisfy IRS expectations either.
The Next Step Is Yours
AI can support you as you think through the plan, organize the work and surface questions your team may not have thought to ask. But knowing where your firm actually stands — on recovery, on security, on compliance — takes a different kind of conversation.
If you're curious how AI and proactive disaster recovery planning can work together for your firm, schedule a 10-minute discovery call with Qual IT. We'll assess where your preparedness efforts stand today and what it would take to strengthen them before tax season. Book your discovery call here.
