For CPA firms, the FTC’s updated Safeguards Rule under the Gramm-Leach-Bliley Act (GLBA) is no longer just a best practice — it’s the law. But too many firms still overlook critical requirements, leaving themselves vulnerable to audits, penalties, and data breaches.
This article exposes the 10 most common mistakes accounting firms make when trying (and failing) to comply with the Safeguards Rule. If your firm handles client financial data — tax returns, payroll files, or QuickBooks access — this guide will help you identify gaps and take corrective action now.
1. Not Knowing the Rule Applies to Them
Many smaller CPA practices assume the FTC’s Safeguards Rule is only for banks or big financial institutions. Wrong. The rule clearly applies to tax preparers, bookkeepers, and any firm handling “nonpublic personal information.”
Fix it: If you work with client financial data, you’re covered. Period. Start your compliance checklist today.
2. No Written Information Security Program (WISP)
A WISP is the core document that outlines how you protect client data. It’s required — and often the first thing auditors request.
Fix it: Use a template tailored for CPA firms. Your WISP should include your policies, roles, risk assessments, and incident response plan.
3. No Appointed Qualified Individual (QI)
Every covered firm must designate someone to oversee the security program. Many firms forget to formally assign this role, or they assume their IT provider automatically qualifies.
Fix it: Appoint a QI — internal or external — and document their responsibilities. This person must report annually to ownership.
4. Lack of Risk Assessments
A one-time IT review is not enough. Firms must conduct written, recurring risk assessments that evaluate internal and external threats.
Fix it: Document what data you collect, where it lives, how it’s accessed, and what risks could compromise it. Repeat annually or after major changes.
5. No Multi-Factor Authentication (MFA)
If employees or contractors remotely access client data without MFA, your firm is in violation of the Safeguards Rule.
Fix it: Implement MFA across email, QuickBooks hosting, file sharing, and cloud portals.
6. Improper or Insecure Data Hosting
Hosting QuickBooks or tax files on local servers, Dropbox, or personal computers without encryption and logging is a huge red flag.
Fix it: Use a compliant platform like Azure Virtual Desktop (AVD) with Office Heroes — which includes encryption, access control, and logging.
7. Weak or Incomplete Vendor Oversight
Third-party IT providers, software vendors, or shredding services must also comply. Many CPA firms don’t vet or contractually bind their vendors properly.
Fix it: Review all vendor contracts. Add clauses requiring Safeguards Rule compliance, breach notification, and regular audits.
8. Failure to Train Staff
Phishing, poor passwords, and accidental data exposure are still leading causes of breaches. Without documented training, your firm is exposed.
Fix it: Run annual staff training and track attendance. Cover topics like phishing awareness, data handling, and breach reporting.
9. No Incident Response Plan (IRP)
When a breach happens, what’s your plan? If you don’t have a written process that includes FTC notification (for 500+ affected), you’re not compliant.
Fix it: Create a written IRP and rehearse scenarios. Know who to contact, what systems to isolate, and how to notify clients and the FTC.
10. No Annual Report to Ownership
The Qualified Individual must produce an annual report for leadership outlining program effectiveness, test results, and improvement plans.
Fix it: Schedule a yearly compliance meeting. Review reports, update your WISP, and confirm board or owner approval.
Key Takeaways on Compliance for CPA Firms Under FTC Safeguards Rule
FTC compliance isn’t just about avoiding penalties — it’s about protecting your clients and your reputation. By correcting these common mistakes now, your CPA firm can meet the Safeguards Rule requirements with confidence.
Need help closing your compliance gaps?
✅ Download our CPA Safeguards Rule Checklist
✅ Book a free Compliance Gap Assessment with Office Heroes
✅ Explore Guardian & Titan Tiers for WISP, QI, and Secure Hosting Tools
Don’t wait for an audit to find out what you missed. Build trust — and resilience — by fixing these 10 issues today.
