October 2026 | Accounting Firm IT Services Utah | Security Culture | IRS Data Security Compliance
It's 4:17 on a Friday afternoon at a Salt Lake City CPA firm, a few weeks after the October 15 deadline.
A staff accountant receives an email that appears to be from the managing partner: "Can you update the bank info on the Hendersons' account for their refund deposit before you leave? They just called me with new details."
The name is right. The tone sounds familiar. The client is real. And with everyone trying to wrap up the week, the easiest thing to do is simply make the change. There's only one problem: the managing partner never sent it.
Your security tools can put strong protections around your tax software and client portals, but they can't stop every bad click, rushed reply or split-second decision. Some choices still come down to whether a staff accountant knows what to do when something feels off — and in an accounting firm, one wrong choice can mean a client's identity stolen and a fraudulent refund out the door.
The Assumption That Leaves Firms Exposed
Most partners believe cybersecurity lives somewhere behind the scenes. The IT provider has tools. The workstations have protection. Someone schedules the updates for UltraTax CS and QuickBooks. Cybersecurity is "handled."
In reality, your defenses are tested every time someone in the firm decides whether to trust an email, a link or a request. Those decisions happen every day, at every desk — from the receptionist forwarding a "client" attachment to the senior manager approving a portal access request. To truly strengthen your firm's security, your accounting staff must know what to do when something doesn't look right.
The IRS makes this explicit. Publication 4557 and the FTC Safeguards Rule place responsibility for protecting taxpayer data on the firm as a whole, not on whoever manages the servers. A security culture isn't a nice-to-have for a CPA firm — it's part of the compliance obligation you attest to every time you renew a PTIN.
Technology Can't Make Every Call
Good security tools block a lot of attack attempts before your staff ever sees them. But no technology can eliminate every questionable request or make every decision on a preparer's behalf.
Today's phishing attacks aren't obvious. They're built to mimic familiar writing styles, reference clients you actually serve and mirror the rhythm of normal firm communication. Attackers know your workflows: they send fake SafeSend and ShareFile notifications, spoofed IRS e-Services alerts and "new client" inquiries with malware dressed up as prior-year returns. When an unusual banking change arrives from a partner, a client legitimately updates deposit details mid-engagement, or a colleague requests access to a file they've never opened — someone must decide what happens next. The person at the keyboard has to determine in an instant whether they're looking at a scam or an authentic request.
"Be Careful" Isn't a Cybersecurity Plan — or a WISP
Most firms tell staff to watch out for suspicious emails. But what should they do when they find one? Every person in the firm should know:
- Who to contact when something looks wrong
- How to verify a request is legitimate — especially banking or refund changes, which should always be confirmed by phone at a known number
- Not to click links or download attachments from suspicious messages, even ones that look like IRS notices or client documents
- What to do if they already clicked a link or opened an attachment
- How to report the issue quickly and without fear of blame
Telling everyone to simply "be careful" without a clear next step puts the full weight of a high-stakes decision on the person least equipped to handle it at 4:17 on a Friday. It also falls short of what the IRS expects: your Written Information Security Plan is supposed to document these procedures, not leave them to instinct.
Assuming staff know what to do is a liability. A staff accountant who isn't sure whether they're bothering a partner may stay quiet. Someone who fears getting blamed for clicking the wrong thing may wait before reporting it. Hesitation is costly — the time lost while someone decides whether to speak up can turn a contained incident into stolen client identities, fraudulent returns filed in your clients' names and a firm-level liability problem.
Leadership Sets the Tone
Responsibility starts at the top, because staff take their cues from the partners. If a partner routinely skips verification steps during the October crunch because deadlines matter more, staff learn that speed beats process. If managers make it uncomfortable to flag suspicious activity, staff stay quiet. If someone clicks something they shouldn't and gets publicly reprimanded, everyone learns to hide their mistakes.
Fortunately, the opposite is also true. When leadership normalizes verification — even when it slows things down near a deadline — staff take it seriously. When a staff accountant who questions an unusual request is backed up rather than brushed off, the whole firm operates more carefully. When people trust leadership, they speak up before a situation becomes a crisis.
Security Works Better When Everyone Knows Their Role
Back to that staff accountant at 4:17 on a Friday afternoon.
The goal isn't to make them paranoid about every email in their inbox. It's to make sure that when something feels off — a banking change, an odd portal link, a partner request that doesn't sound quite right — they know exactly what to do, who to ask and how to verify. Speaking up should always feel like the right move.
Your accounting staff don't need to become cybersecurity experts to help protect the firm. They need clear expectations, good habits and the confidence to flag when something doesn't look right.
Creating that kind of security culture takes more than the annual training you check off for compliance. It requires the right safeguards, practical verification processes and ongoing guidance — the elements a real WISP is built from — to keep your firm prepared as threats change.
Frequently Asked Questions
Do you offer cybersecurity and IT support for CPA firms in Salt Lake City?
Yes. Qual IT delivers CPA firm managed IT in Salt Lake City and across the Wasatch Front, including email security, phishing protection tailored to IRS-impersonation scams, employee security awareness training, secure support for tax software like UltraTax CS, Lacerte and Drake Tax, and incident response planning that satisfies IRS Publication 4557.
What is employee security awareness training for accounting firms?
It's structured, ongoing education that teaches your accounting staff to recognize phishing, fake IRS notices, spoofed client requests and social engineering — and gives them a clear process for verifying and reporting suspicious activity. Done well, it turns your team into an active layer of defense and satisfies the training requirement in your WISP.
How does an IT partner help a CPA firm build a security culture?
A partner like Qual IT identifies your gaps, implements the right safeguards around your tax and accounting systems, sets up practical verification and reporting procedures, documents them in your WISP and provides the ongoing training that keeps security habits current as threats evolve — through tax season and beyond.
You Don't Have to Manage It Alone
That's where the right IT partner comes in. Qual IT helps accounting firms take the guesswork out of cybersecurity by identifying gaps, strengthening protections around client tax records and helping every member of the firm understand the role they play in keeping client data secure.
Cybersecurity is everyone's responsibility — but you don't have to manage it alone. We work with Salt Lake City CPA firms to protect client data and keep systems running through tax season. Schedule a 10-minute discovery call with Qual IT to find the gaps in your current approach and how to address them before January arrives.
