CPA firms are under increased regulatory scrutiny as the FTC enforces the updated Safeguards Rule under the Gramm-Leach-Bliley Act (GLBA). Firms that handle client financial data — including tax returns, payroll details, and QuickBooks files — are considered “financial institutions” and are expected to demonstrate security compliance.
If your firm were selected for an FTC or GLBA audit tomorrow, could you pass? This guide outlines the practical, step-by-step preparations your accounting practice should take to stay compliant, audit-ready, and protected from penalties.
What Triggers an FTC or GLBA Audit for CPA Firms?
- Consumer Complaints or Data Breaches
- Missing or inadequate Written Information Security Programs (WISP)
- Lack of multi-factor authentication (MFA) or encryption
- Failure to report a breach under the new 2024 breach notification rule
- Random inspection of firms deemed high-risk (e.g., large data sets, remote access systems)
7 Steps CPA Firms Should Take to Prepare
1. Build or Update Your WISP
Your Written Information Security Program should outline safeguards, responsibilities, incident response procedures, and vendor policies. Make sure it’s updated annually and tailored to your firm’s size and complexity.
2. Appoint a Qualified Individual (QI)
Designate a person — internal or external — to oversee compliance. They must be involved in audits and must present an annual report to firm leadership.
3. Conduct a Documented Risk Assessment
This should identify:
- What client information you collect
- Where it’s stored
- Who can access it
- Foreseeable risks (phishing, ransomware, human error)
Your risk assessment must be in writing and reviewed regularly.
4. Implement Key Security Safeguards
Auditors will expect:
- Multi-factor authentication (MFA)
- Data encryption (in transit and at rest)
- Role-based access controls
- Secure data disposal protocols
- Logging and monitoring of user activity
5. Train Your Staff
Annual security training is mandatory. Staff should understand phishing risks, password policies, and data classification. Keep records of training dates and attendance.
6. Review Vendor Contracts
Make sure third-party vendors handling sensitive data have security clauses. Contracts should include breach notification language and expectations for encryption, access control, and reporting.
7. Test and Document Everything
Run a penetration test and a vulnerability scan before your next audit. Document all tests, tools used, dates, and outcomes. Keep records of system updates, patch management logs, and change control tickets.
What to Expect During an FTC or GLBA Audit
Auditors will typically request:
- A copy of your WISP
- Proof of your risk assessment and safeguard implementation
- Logs of user activity and breach testing
- Employee training records
- Vendor management documentation
- Board or owner reports from the Qualified Individual
Be ready to explain how your security program is enforced in daily operations — not just what’s on paper.
Final Tips for Staying Audit-Ready Year-Round
- Assign a compliance calendar to your QI
- Review logs monthly and train staff quarterly
- Use a GRC platform or IT partner (like Office Heroes) to manage documentation and audits
- Update policies when your tech stack or vendor list changes
What is a WISP and why is it important for an audit?
A WISP (Written Information Security Program) is a documented plan that outlines your firm’s approach to securing client data. It’s often the first document an auditor requests.
How often should a CPA firm update its risk assessment?
At least annually or after any major operational change — such as adopting new software, hiring remote workers, or handling new data types.
Do solo CPA practitioners need to comply with the Safeguards Rule?
Yes. The FTC does not exempt solo practitioners if they handle consumer financial data. However, safeguards can be scaled to match the firm’s size.
What happens if my firm fails an FTC audit?
The FTC may require remedial actions, impose long-term oversight, or — in serious cases — issue civil penalties. It can also harm your reputation and client trust.
Can I outsource the Qualified Individual role?
Yes. Many firms designate an outside compliance partner (like Office Heroes) to serve as their QI. This person must still report to your firm’s leadership annually.
Ready to make your firm audit-ready and breach-resilient?
✅ Book a free compliance readiness assessment with Office Heroes
✅ Download our CPA WISP Starter Template
✅ Explore QuickBooks Hosting with Built-In Compliance Tools
