The Silent Risk Inside CPA Firms
- orio1985
- Feb 13
- 28 min read
How Good People Accidentally Create Bad Security
Security Failures Rarely Start With Hackers
In most CPA firms, cybersecurity conversations start in the wrong place.
They start with hackers.
They start with ransomware headlines.
They start with worst-case scenarios and scary statistics.
But the truth is far less dramatic and far more uncomfortable.
Most security incidents inside CPA firms do not begin with a sophisticated attacker. They begin with a well-meaning employee trying to get their work done.
Someone shares a file as quickly as they can.
Someone reuses a password because it’s late and the client is waiting.
Someone bypasses a clunky system during tax season because deadlines don’t move.
None of these actions comes from negligence or malice. They come from pressure, responsibility, and a desire to help.
And that is exactly why this problem is so dangerous.
CPA firms are built on trust, precision, and responsiveness. The same traits that make firms successful also create conditions in which small shortcuts quietly turn into systemic risk. Over time, those shortcuts pile up. Visibility fades. Documentation gaps widen. And leadership remains unaware until something forces the issue.
An insurance questionnaire.
A client security review.
An audit.
Or worse, an incident.
This blog is not about blaming staff, not about fear, and it’s not about turning your firm into a locked-down maze that frustrates everyone.
It is about understanding the silent risk that arises when good people operate within systems that were never designed to handle the pressure they face.
Why CPA Firms Are Uniquely Vulnerable
CPA firms are not careless with data. In fact, most firms are deeply aware of the responsibility they carry. Financial records, tax filings, payroll data, and personally identifiable information all come with serious legal and ethical obligations.
But CPA firms also operate under conditions that amplify risk:
Extreme seasonal workload spikes
Hard, immovable deadlines
Long hours and cognitive overload
Distributed teams and remote access
A culture that prioritizes client service above all else
Unlike many industries, CPA firms cannot “slow down” to fix systems. Work must continue, even when tools fall short. That reality creates a dangerous gap between policy and practice.
On paper, many firms have rules:
Don’t share passwords
Use approved tools
Follow security procedures
In reality, staff are navigating dozens of systems, client demands, and time pressure simultaneously. When friction appears, they don’t stop working. They adapt.
Adaptation is where silent risk begins.
The Most Common Misdiagnosis
When leadership finally becomes aware of a security issue, the reaction is often instinctive:
“Why did someone do this?”
“Who approved that?”
“We need to lock this down.”
But focusing on the individual misses the real issue.
In well-run CPA firms, staff behavior is usually rational within the system they’re given. If people are bypassing controls, it’s rarely because they want to break rules. It’s because the secure path is harder than the fast one.
Security failures, in this context, are not people problems. They are design problems. Design problems don’t get solved by issuing warnings or by stricter language in policy manuals. They get solved by understanding why workarounds exist in the first place.
The Myth of the “Bad Employee”
There’s a persistent belief in many organizations that security incidents happen because someone:
“wasn’t careful enough.”
This belief is comforting.
It suggests the problem is isolated.
It implies that training or discipline will fix it.
In reality, this framing is both inaccurate and dangerous.
Most Incidents Involve Your Best People
In CPA firms, the employees most likely to create unintended risk are often:
High performers
Senior staff
Trusted team members
The people others rely on during the busy season
You have a great team around you. We understand that and want to encourage best practices to help your firm stay secure and grow.
How can we help?
Here is a FREE eBook that covers 10 key IT problems for CPA's and how to fix them.
These individuals are not careless. They are experienced. They understand client urgency. They know how to keep work moving when systems slow down.
Ironically, that competence makes them more likely to improvise.
They know which rules can be bent without immediate consequences.
They know how to get around friction quietly.
They know how to “just make it work.”
For months or years, it has worked. Until it doesn’t.
Why Blame-Based Security Fails in CPA Firms
When security messaging focuses on punishment or fear, staff quickly learn one thing: don’t get caught.
They don’t stop using shortcuts. They stop talking about them.
That creates a culture where:
Shadow IT thrives quietly
Visibility disappears
Leadership assumes compliance that doesn’t exist
In professional services firms, especially accounting, trust runs deep. Staff are trusted with sensitive data every day. Treating them like adversaries undermines that trust and drives risky behavior underground.
Effective security cultures are built on:
Transparency
Psychological safety
Systems that support reality
Not suspicion.
The Real Root Cause
If your firm experiences:
File sharing outside approved platforms
Shared credentials during busy season
Data moving through personal devices
Gaps in access tracking
The question is not “who broke the rules?”
The real question is: What made the secure option harder than the risky one?
Until leadership answers that honestly, no amount of policy updates will fix the problem.
Reframing the Conversation
Instead of asking:
“Why did someone do this?”
Ask:
“What pressure were they under?”
“What obstacle were they trying to overcome?”
“What system failed them first?”
This shift is uncomfortable, but it’s necessary. In CPA firms, good people don’t intentionally create bad security. They create it incidentally, while trying to meet expectations inside systems that weren’t built for the pace of modern accounting.
Where is This Is Going Next
Now that we’ve reframed the problem, the next step is naming it.
In the next section, we’ll break down Shadow IT in plain language. Not as a buzzword. Not as an accusation. But as a predictable outcome of how CPA firms actually operate.
We’ll explore:
What Shadow IT really looks like inside firms
Why leadership rarely sees it
And why does trying to ban it outright usually backfires
Shadow IT (Explained Without Jargon)
Shadow IT sounds like a technical problem. It isn’t. In CPA firms, Shadow IT is almost always a behavioral response to friction.
It shows up quietly. It feels harmless, and most firms don’t realize how much of it exists until an audit, an insurance review, or an incident forces visibility.
Let’s strip away the buzzwords and talk about what Shadow IT actually looks like inside accounting firms.
This blog touches on some very valid points of shadow IT. But if you're curious to learn more about shadow IT, follow this link.
What Shadow IT Really Means in a CPA Firm
At its simplest, Shadow IT is anything staff use to get work done outside approved systems or with limited visibility.
That’s it.
No hackers. No bad actors. No intent to bypass rules. Just people solving business problems with the tools available to them.
In CPA firms, Shadow IT often looks like:
Emailing client documents to a personal email address so they can finish work at home
Using personal Dropbox, Google Drive, or iCloud to move large files
Sharing a login temporarily because “IT hasn’t set them up yet.”
Saving files locally instead of to the firm's system because it’s faster
Texting sensitive information because email feels too slow or clunky
None of these actions feels dangerous in the moment. They feel practical.
That’s what makes Shadow IT so hard to eliminate with policies alone.
Why Leadership Rarely Sees It Happening?
From leadership’s perspective, things usually look fine.
The firm has approved tools
IT says systems are secure
Staff are productive
Clients are happy
There are no obvious red flags.
Shadow IT doesn’t announce itself. It blends into daily work.
It also tends to happen:
During late nights
Under deadline pressure
When helpdesk response times feel too slow
When staff are trying not to bother anyone
The very people leadership trusts the most are often the ones quietly working around friction to keep things moving. From the outside, everything appears compliant. Under the surface, visibility is eroding.
The Most Common CPA Shadow IT Scenarios
Let’s ground this with scenarios.
Scenario 1: “I’ll Just Email It to Myself”
This is one of the most common and least questioned behaviors.
A staff member:
Needs to finish work after hours
Can’t access the file remotely
Or finds the VPN unreliable
So they email the file to their personal inbox.
From their perspective:
It’s faster
It’s temporary
It helps meet the deadline
From a compliance perspective:
The firm loses control of the data
There’s no audit trail
Data now exists outside protected systems
Retention and deletion policies are broken
No one intended to create risk. But risk was created anyway.
Scenario 2: Personal Cloud Storage “Just for Busy Season”
Busy season brings temporary chaos.
Staff may:
Use personal cloud accounts to sync files across devices
Share folders with teammates
Move large client files quickly
This often starts as a workaround for:
File size limits
Slow internal systems
Inconsistent remote access
The problem isn’t convenience.The problem is invisible duplication of sensitive data.
Leadership doesn’t know:
Where client data lives
Who has access
Whether it’s encrypted
Whether it’s ever deleted
Shadow IT doesn’t just create risk. It destroys certainty.
Scenario 3: Shared Logins “Just Until IT Fixes It”
This one is especially dangerous and extremely common.
A new hire starts during a busy period. Access requests are slow. Deadlines are looming.
So someone says, “Just use my login for now.”
From a workflow standpoint, this solves a problem. From a security standpoint, it creates several:
No accountability
No access tracking
No way to prove who did what
Impossible audit trails
Once shared logins exist, compliance collapses quietly. Staff see this worked once, and it becomes normalized.
Scenario 4: Bypassing Systems That Feel “In the Way”
Sometimes, Shadow IT isn’t about new tools at all. It’s about avoiding existing ones.
Staff may:
Save files locally instead of to document management systems
Avoid secure portals because clients complain
Skip multi-factor authentication when possible
Use screenshots or photos instead of approved exports
Why?
Because friction compounds under pressure. When security feels like an obstacle rather than a source of support, people work around it.
I have given you a few scenarios; let's dig deeper into the whys around Shadow IT next.
Why Banning Shadow IT Outright Usually Backfires?
The instinctive response to Shadow IT is control.
Leadership discovers risky behavior and reacts by:
Locking down systems
Blocking tools
Tightening permissions
Sending warning emails
On paper, this feels responsible. In practice, it often makes the problem worse. albeit the right decision for your business. The key here is that you have identified the Shadow IT. Now, what have you done to address the problem?
When tools are banned without alternatives:
Staff don’t stop needing to work
They stop talking about how they work
Workarounds become more creative and harder to detect
Shadow IT thrives in environments where:
People feel judged
Mistakes feel punishable
Asking for better tools feels risky
Fear doesn’t eliminate Shadow IT. It drives it underground. You cannot solve a problem with software; you must build your culture and provide solutions that address the problem.
Why is Shadow IT a Signal, and not a Failure?
This is the most important part of this section, shifting your mindset.
Shadow IT is not proof that staff are careless. It is proof that systems are misaligned with reality.
Every workaround answers a question leadership should be asking:
What friction exists here?
Why wasn’t the approved path viable?
What pressure made this shortcut feel necessary?
When leadership treats Shadow IT as intelligence rather than insubordination, firms achieve better outcomes.
Because Shadow IT reveals:
Bottlenecks
Gaps in access
Tool mismatches
Process breakdowns
Someone else can profit from your hard work.
Threat actors feed on mistakes, and shadow IT is butter to any recipe. however shadow IT is just 1 attack surface. Click below and discover how your business stacks compared to your peers. What other areas can attackers use to their advantage?
It shows you where your firm is asking people to choose between security and productivity. People will choose productivity every time. Why? Because it's normal for a great resource to want to shine in their role. Even if it means breaking a few rules. Taking care of the customer is always the number one rule.
Why Can Shadow IT Become a Hidden Cost?
The danger of Shadow IT isn’t the shortcut itself. It’s what leadership loses when it becomes normal. We lose visibility (we discuss this more later in this blog).
Once Shadow IT spreads:
Data locations become unknown
Access can’t be confidently reported
Incident response slows down
Audits become stressful guesswork
Maneuvering strategy to improve service becomes difficult.
When asked:
“Who had access to this file?”
“When was this data shared?”
“Was this information encrypted?”
If Leadership can’t answer with certainty.
Uncertainty is risk. Accepting risk can become expensive. Not knowing is not armor. Insurance companies consider ignorance as negligence.
Why This Matters More Than Ever
Client expectations are rising. Insurance requirements are tightening. Regulatory scrutiny is increasing. None of these cares about intent.
They care about:
Control
Evidence
Repeatability
Proof
Shadow IT erodes all four, not loudly, not dramatically, but quietly.
Shadow IT can become the catalyst for stopping your operations. If you're not vigilant, this can be a surprise you can't recover from.
Let's move on from Shadow IT
Shadow IT doesn’t happen in isolation. It accelerates under pressure. Next, we’ll explore why busy season changes behavior, how cognitive overload drives shortcuts, and why even well-designed systems break down when time disappears.
We’ll connect Shadow IT directly to:
Deadlines
Burnout
Decision fatigue
And the hidden psychology of tax season
Because to fix Shadow IT, leadership must understand the environment that creates it.
Why Busy Season Drives Risky Behavior
If Shadow IT is the symptom, busy season is the accelerant. Most CPA firms don’t experience their worst security decisions during normal operations. They experience them when time disappears, pressure spikes, and everything feels urgent.
Busy season doesn’t just increase workload. It changes how people think, decide, and behave. Understanding that shift is critical if leadership wants security controls that survive real-world conditions.
Busy Season Isn’t Just “More Work”
From the outside, the busy season looks like volume, more returns, more clients. more emails, more hours.
From the inside, the busy season is something different entirely.
It’s:
Constant interruption
Cognitive overload
Decision fatigue
Emotional pressure
A shrinking margin for error
Staff aren’t just working longer. They’re making hundreds of micro-decisions per day, often under stress, with incomplete information, and no extra time to think about consequences.
Security controls that work in calm conditions often collapse here. Not because they’re bad controls. Because they weren’t designed for this environment.
We often build security when the budget allows. Which is normally off busy seasons, away from impacting any operation. This is what we tend to call the perfect world scenario build-out. When Busy season comes around, it tends to hold strong at first, but cracks in security begin to form because scenarios are not always perfect, and decision fatigue sets in.
Decision Fatigue and Why Policies Break
There’s a well-documented phenomenon called decision fatigue, as people make more decisions throughout the day, the quality of those decisions declines. Eventually, the brain looks for the fastest path forward, not the safest or most compliant one.
Busy season creates perfect conditions for this:
Staff are constantly context-switching.
They’re interrupted by clients, teammates, and systems.
They’re racing immovable deadlines.
They’re often working late, tired, and under-caffeinated.
In that state, policies become abstract. Suddenly, the policies that are keeping them and your business safe. The become another hurdle to deal with.
When faced with “Follow the approved process!” versus “Get this done now!”
Most people don’t consciously choose risk. They choose relief.
The Myth of “They Should Know Better”
Leadership often assumes experienced staff will naturally follow best practices under pressure. In reality, experience can increase risk during busy season.
Why?
Because experienced staff:
Know which rules are flexible
Know which shortcuts usually “don’t cause problems.”
Have successfully improvised before
Feel responsibility for outcomes, not process purity
They’ve been rewarded for making things work. So when a system slows them down at 9:30 p.m. on April 14th, they don’t escalate. They solve. That problem-solving instinct is valuable. Unchecked, it’s dangerous.
Busy Season Normalizes Temporary Exceptions
One of the most damaging dynamics in CPA firms is the normalization of “temporary” exceptions.
Examples:
“Just for this week”
“Just until extensions are done”
“Just while we’re short-staffed”
“Just until IT fixes it”
Busy season creates a culture where exceptions feel justified. The problem is: temporary exceptions rarely get rolled back, passwords stay shared, access stays open, and files stay duplicated.
What started as a short-term workaround quietly becomes standard operating procedure.
By the time leadership notices, no one remembers what “normal” looked like.
we all heard this at least once in our lives.
| Temporary becomes, permamnent real fast.
Remote Work Multiplies Busy Season Risk
Busy season used to be contained within the office. Now it isn’t.
Modern CPA firms operate with:
Remote staff
Hybrid schedules
Home networks
Personal devices
Shared spaces
During busy season, remote work isn’t optional. It’s necessary.
But remote access introduces new friction:
VPN instability
Authentication delays
File sync issues
Device performance differences
When secure remote access feels unreliable, staff default to whatever works.
They don’t think: “This violates policy.”
They think: “I can’t afford to lose another hour.” or "We cant afford to lose this client"
When Security Competes With Client Service
CPA culture places client service on a pedestal. Rightfully so.
But during busy season, that priority can unintentionally undermine security.
Staff feel pressure to:
Respond immediately
Be helpful
Avoid saying “no.”
Avoid delays
So when a client asks: “Can you just email it to me?” or “Can you send it another way?” or “Can you resend it quickly?” Staff simply comply.
Not because they’re reckless, but because they’re conditioned to serve.
Security controls that force staff to push back against clients without leadership support are destined to fail. As a leader in your business, you know why the security policies are in place. Let's make sure the lights stay on tomorrow so we can continue providing the next-level customer service we know we can deliver.
Compromising security to satisfy one client can risk your ability to service the next one tomorrow.
Why Training Alone Doesn’t Fix This
Many firms respond to busy-season risk with more training, more reminder emails, and mandatory policy acknowledgments.
Training has value, but it has limits.
More reminder emails tend to go unread or end up in deleted folders.
Mandatory policy acknowledgments build an adversarial culture.
You cannot train people out of systemic pressure. When systems are slow, access is limited, and deadlines are unforgiving, everything other than satisfying the customer becomes background noise.
People don’t forget training. They override it. Because training doesn’t remove the friction. Besides, and we all know, a nagging mom/dad just becomes white noise anyway. As a leader, stay involved, ask what's working and what's not, tweak policies, and tailor security to fit daily operations.
The Compounding Effect No One Sees
The most dangerous part of busy season risk isn’t any single shortcut.
It’s the compounding effect.
One shared login leads to:
Lost accountability
Incomplete logs
Audit blind spots
One personal file sync leads to:
Duplicate data
Unknown retention
Uncontrolled access
One bypassed system leads to:
Normalized workarounds
Reduced trust in controls
More bypassing
Over time, leadership believes the firm is operating securely because nothing has exploded.
In reality, risk is accumulating quietly, and when that risk becomes relevant... It's already too late and has become an expensive problem to solve. Some cases involve litigation and/or heavy damage to your reputation. Being proactive with risks keeps the balloon from inflating too big. We can't be perfect, but we can be prepared. such as when that balloon shatters, it's not as damaging nor as costly.
Why Incidents Often Happen After Busy Season
A common misconception is that busy season causes incidents directly.
In many cases, the incident happens later.
Busy season lays the groundwork:
Credentials are shared
Access expands
Data spreads
Visibility shrinks
Then, weeks or months later:
A device is lost
An account is compromised
A breach is discovered
An audit begins
Leadership is blindsided because the risky behavior happened during a period when everyone was too busy to reflect.
The Leadership Blind Spot
Here’s the uncomfortable truth. Most CPA leadership teams evaluate security based on intent, not behavior.
They believe:
“Our people know better”
“We’ve trained them”
“We have policies”
“IT has it covered”
Busy season exposes the gap between belief and reality. Not because leadership is negligent. Because leadership doesn’t see the day-to-day friction staff face.
That friction is where risk is born.
Let's shift our focus to visibility
If Shadow IT is fueled by busy season pressure, the next question becomes critical.
What happens when leadership loses visibility altogether?
Next, we’ll examine how firms accidentally lose sight of:
Where data lives
Who has access
What’s actually happening inside systems
We’ll break down why visibility fades slowly, why dashboards don’t solve it, and why audits feel so stressful when answers should be simple.
How CPA Firms Accidentally Lose Visibility
Most CPA firm leaders believe they have reasonable visibility into their IT environment. They know what systems are in place, they know who their vendors are, they know sensitive data exists, and that it’s “protected.”
And in a narrow sense, they’re right.
The problem is that visibility doesn’t disappear all at once. It erodes slowly, quietly, and usually without triggering alarms. By the time leadership realizes something is wrong, the question isn’t “what happened?” It’s “why can’t we answer basic questions?”
What Visibility Actually Means (In Plain English)
Visibility isn’t about dashboards or alerts. It’s about certainty.
When a firm has real visibility, leadership can confidently answer:
Where does client data live?
Who can access it?
How is access granted and removed?
What happens when something goes wrong?
Can we prove our answers?
If any of those answers start with:
“I think…”
“It should…”
“IT probably…”
Visibility has already been lost.
The Illusion of Visibility
Most CPA firms don’t lack tools. They lack connected understanding.
Common situations:
Email security exists, but no one reviews reports
Backups run, but restores aren’t tested or documented
Access controls exist, but exceptions pile up
Logs are collected, but never examined
On paper, everything looks fine. In practice, leadership is trusting assumptions.
Assumptions feel safe… until they’re tested.
How Visibility Slowly Slips Away
Loss of visibility isn’t caused by a single decision. It’s the result of many reasonable ones. here are 3 key factors.
1. Tools Are Added, Not Integrated
As firms grow, tools accumulate:
Tax software
Document management
Cloud storage
Remote access tools
Security products
Each solves a problem. Few are connected into a single, coherent view. Visibility fragments across platforms.
2. Exceptions Become Normal
Busy season creates exceptions, exceptions become habits, and habits become invisible. Access granted “temporarily” isn’t revisited, shared folders remain shared, and accounts aren’t fully cleaned up after staff changes.
Leadership doesn’t see this drift because nothing breaks immediately.
3. Ownership Gets Blurry
Who owns visibility:
IT?
Operations?
Partners?
Vendors?
When responsibility is unclear, visibility becomes nobody’s primary job. Each group assumes someone else has eyes on it. Leading to no one has eyes on it.
Strategy starts with a plan. Every CPA should have a BCP
For CPA's, a proper Business Continuity Plan can lead to a healthy environment. We wrote a book to help you build the plan.
The “Who Touched This File?” Problem
One of the most common audit questions is also one of the hardest to answer without visibility:
“Who accessed this data, and when?”
In firms with degraded visibility:
Logs exist, but aren’t centralized
Access paths aren’t documented
Shared credentials erase attribution
Data lives in multiple locations
Leadership isn’t hiding anything. They simply don’t have a clean story to tell.
And in compliance contexts, an incomplete story is treated as noncompliance.
Why Dashboards Don’t Solve This
Dashboards promise clarity. In reality, they often provide false comfort.
Why?
They show activity, not intent
They highlight alerts, not gaps
They require interpretation
They assume someone is reviewing them
Visibility isn’t passive, It requires:
Regular review
Context
Follow-up
Documentation
Without process, dashboards become background noise.
The Audit Wake-Up Call
Visibility gaps often surface during audits or insurance reviews.
Leadership is asked:
Show proof of training
Show access reviews
Show incident response steps
Show backup testing records
The scramble begins, screenshots are gathered, emails are searched, and old folders are opened. The firm may be doing the right things. But they can’t provide the needed proof, at least not in a timely manner. For a busy CPA time is just too valuable. So you miss audits, pay fines, and apply for extensions.
That scramble is not a failure of effort. It’s a failure of visibility.
Visibility Loss peaks Anxiety
This is where compliance anxiety becomes real.
Leadership senses:
Exposure
Uncertainty
Risk they can’t quantify
Not because something is broken, but because they don’t know what they’d say if asked. That constant low-level stress is exhausting.
Why This Is a Leadership Problem (Not an IT One)
IT teams manage systems; they don’t define accountability.
Leadership decides:
What must be provable?
How often is it reviewed?
Who owns evidence?
What “good enough” means.
Without leadership clarity, IT works tactically. To have visibility requires a strategy; a good strategy begins with active leaders.
Now Let's pivot back to a few key points.
Up to this point, we’ve covered:
Why do good people create risk?
How Shadow IT forms
Why busy season accelerate it
How visibility quietly disappears
Most firms respond to these issues by locking things down. Next, we’ll explore why that instinct backfires, how over-restriction creates more Shadow IT, and why guardrails beat lockdowns every time.
Why Locking Everything Down Backfires
When leadership finally sees risk, the response is almost always the same. Lock it down, tighten permissions, block tools, add approval steps, restrict access, and send policy reminders.
On paper, this looks responsible. In reality, it often creates the very conditions that cause Shadow IT to explode or resurface. We are not arguing against control. It’s explaining why control without empathy fails in CPA firms.
The Lockdown Reflex
Security incidents, audits, or insurance questionnaires tend to trigger urgency.
Leadership thinks:
“We need to reduce exposure.”
“We can’t let this happen again.”
“We need stricter rules.”
So they implement:
Blanket restrictions
One-size-fits-all controls
Additional approval layers
Tighter deadlines for compliance
These measures feel decisive, but they rarely address the root cause. If we simply close open gaps without a proper strategy, it would be encouraging your users to break the rules.
Why Restrictions Feel Logical to Leadership
From a leadership perspective:
Restrictions reduce options
Fewer options feel safer
Safer feels compliant
There’s also an emotional component. Lockdowns offer a sense of control amid uncertainty; they can also foster a sense of accomplishment.
That false sense "that we locked it down, now we are safe."
The problem is that they ignore how work actually happens inside a CPA firm. So all the lockdowns that happened on Friday night will make Monday morning a place no employee wants to work in.
How Lockdowns Look From the Staff Side
To staff, lockdowns often feel like:
Distrust
Friction
Punishment for being productive
Extra steps during already stressful periods
Staff don’t interpret new controls as “protection.”
They interpret them as:
“Leadership doesn’t understand our workload.”
“This makes my job harder.”
And their resolution? “I’ll have to find another way.” And they do.
The Friction Equation
Here’s a simple truth:
When the secure path takes longer than the insecure one, people choose speed.
Lockdowns increase friction; deadlines don’t move. So the staff have to adapt.
Then they:
Use personal devices
Share credentials quietly
Move data outside monitored systems
Stop reporting workarounds
Lockdowns don’t eliminate risky behavior; they push it out of sight.
The Rise of Underground Workflows
One of the most dangerous outcomes of over-restriction is the creation of underground workflows.
These are:
Unspoken
Unofficial
Widely used
Never documented
Everyone knows they exist. No one talks about them. Leadership believes controls are working. In reality, visibility has collapsed. This is worse than open Shadow IT, because it can’t be corrected. In most cases, by the time leadership notices, the bad habit is so embedded it takes double the effort to get things back on track.
When “No” Becomes the Default Answer
Another side effect of lockdowns is approval fatigue.
If staff must:
Ask permission repeatedly
Wait for access
Navigate unclear processes
They stop asking, they stop flagging issues. They stop requesting improvements.
Security becomes something to work around, not work with.
That silence is dangerous.
Lockdowns Create a False Sense of Safety
Leadership may feel relieved after locking systems down.
Policies are updated, tools are restricted, and checklists are checked.
But without adoption, none of that matters. Security controls that aren’t used correctly are theater.
They look good during meetings. They fail quietly during real work.
Why CPA Firms Are Especially Vulnerable to This?
CPA firms have unique characteristics:
Highly trusted staff
Client-driven urgency
Seasonal pressure
Professional autonomy
Heavy-handed controls clash with that culture. Unlike manufacturing or retail, CPA firms rely on judgment and discretion. When security treats professionals as liabilities rather than assets, it erodes culture.
Culture always wins. Bottom lines tend to suffer since your workforce is unintentionally working against the company and themselves.
Control vs Confidence
Here’s the core misunderstanding.
Leadership often seeks control. Staff need confidence.
Confidence that:
The secure way will work
Access won’t block deadlines
Asking for help won’t slow them down
Security supports productivity
When staff feel confident, compliance improves naturally. When they feel constrained, risk increases.
The Real Goal Was Never Lockdown
The goal was never to say “no.”The goal was to reduce risk. Lockdowns feel like progress, but true progress comes from alignment, not restriction.
That alignment comes from:
Understanding workflows
Reducing friction
Designing systems for busy season
Making the secure path the easy path
This is where guardrails enter the conversation.
Mindset Shift
Before we talk about solutions, leadership must accept this.
Security that works in calm conditions but fails under pressure is not real security.
If controls only function when people have time and energy, they are fragile.
CPA firms don’t need fragile security; they need resilient security.
Setting Up the Guardrails Conversation
Next, we’ll flip the script.
We’ll explore:
What guardrails actually mean.
How do they differ from restrictions?
Why do they respect professional judgment?
How do they reduce Shadow IT instead of hiding it?
This is where security stops being a blocker and starts becoming infrastructure.
Guardrails vs. Restrictions
Designing Security for Real CPA Work
If restrictions are about control, guardrails are about direction.
Restrictions say, “You can’t.”
Guardrails say, “Here’s the safe lane. Stay inside it, and you can move fast.”
That difference is everything inside a CPA firm.
Because your people are not reckless. They are responsible professionals under pressure.
They don’t need tighter cages. They need better lanes.
What Guardrails Actually Mean
Guardrails are boundaries that:
Prevent catastrophic mistakes
Allow normal workflow
Don’t require constant approval
Work under pressure
Still functions during the busy season
Think about driving. Highways don’t prevent you from moving quickly; they guide you so you don’t drive off a cliff.
CPA security should feel the same way.
Why Guardrails Work in Professional Firms
CPA firms are built on trust and autonomy.
Your staff:
Exercise judgment daily
Interpret regulations
Make risk-based decisions
Handle sensitive financial data
Security that assumes incompetence will fail. Security that assumes professionalism will succeed.
Guardrails work because they:
Respect judgment
Reduce friction
Create clarity
Remove guesswork
They don’t eliminate flexibility. They eliminate chaos.
The “Secure Path Must Be the Easy Path” Rule
Here’s the single most important principle in modern firm security.
If the secure option is harder than the risky one, the risky one wins.
Guardrails fix this by redesigning the path.
For example:
Instead of banning file sharing:
Provide a fast, reliable, secure portal.
Make it easier than email.
Train clients on it.
Back staff publicly when they use it.
Instead of warning about password reuse:
Deploy a password manager firm-wide.
Make it simple.
Make it mandatory.
Remove the cognitive load.
Instead of punishing Shadow IT:
Identify the friction that caused it.
Replace the workaround with a better solution.
Security must compete with convenience. If it loses that battle, it loses entirely.
Guardrails in Action (Real CPA Examples)
Let’s make this tangible with a few examples.
1. Role-Based Access Done Right
Restriction mindset: “Limit everyone as much as possible.”
Guardrail mindset: “Give people exactly what they need, no more, no less, and review it quarterly.”
Why this works:
Staff aren’t blocked unnecessarily.
Leadership can prove least-privilege access.
Access creep is contained.
Visibility improves.
The guardrail is structured access, not an arbitrary limitation.
2. MFA Without Revolt
Restriction mindset: “Add MFA everywhere immediately.”
Guardrail mindset: “Roll out MFA with support, education, and workflow testing before busy season.”
Why this works:
Staff understand why.
Authentication methods are reliable.
Friction is anticipated.
Complaints drop dramatically.
Guardrails anticipate human reaction.Restrictions react to risk.
3. Secure File Movement
Restriction mindset: “No external tools allowed.”
Guardrail mindset: “Here is the one approved tool. It works on desktop and mobile. It handles large files. It’s faster than email.”
When the guardrail tool is:
Faster
Easier
Reliable
Shadow IT disappears naturally.
Guardrails Reduce Anxiety
One overlooked benefit of guardrails is psychological.
When staff know:
There’s a clear lane
It’s approved
It’s supported
Leadership backs it
Decision fatigue decreases. Instead of asking: “Is this allowed?” They know: “This is how we do it here.”
Clarity reduces risk.
The Guardrail Checklist for CPA Leaders
To build real guardrails, leadership must ask:
Where does friction consistently occur?
Are we designing for busy season reality?
Are secure tools as fast as insecure ones?
Are we reviewing access consistently?
Do we publicly support staff who follow secure processes?
Can we prove our systems work under pressure?
If the answers to most of these are unclear, the firm likely relies on restrictions rather than guardrails.
Guardrails Require Leadership Alignment
Guardrails only work when leadership is unified.
If:
One partner demands speed at all costs
Another insists on compliance
IT operates separately
Operations isn’t looped in
Staff receive mixed signals. Mixed signals produce improvisation. Improvisation produces risk.
Guardrails require:
Clear priorities
Consistent messaging
Shared accountability
Security cannot be an IT initiative. It must be a leadership design decision.
The Cultural Shift
When firms implement guardrails correctly, culture changes subtly but powerfully.
Staff stop saying: “I hope this is okay.”
They start saying: “This is the firm standard.”
Compliance becomes embedded. Not enforced. That’s when visibility improves, audits become calm, and insurance renewals stop being stressful.
How can Leadership take this to the next level?
We’ve now covered:
How risk forms
How pressure amplifies it
How visibility disappears
Why lockdowns fail
Why guardrails work
There’s one more critical shift. Because even with guardrails, none of this sticks unless leadership accepts one uncomfortable truth.
This is not an IT problem. It is a leadership design problem.
Next, we’ll examine:
How leadership unintentionally incentivizes risky behavior
How mixed priorities create security drift
And why ownership at the top determines everything below it
This Is a Leadership Design Problem
The phrase “leadership problem” can feel accusatory. That’s not what this is, this is about design.
Every CPA firm is perfectly designed to produce the results it currently produces.
If:
Shortcuts are common
Visibility is inconsistent
Busy season overrides policy
Security feels optional
That’s not random. It’s a design outcome.
Leadership Sets the Real Priorities
Every firm has two types of priorities:
Stated priorities
Observed priorities
Stated priorities are what appear in:
Policy manuals
Internal memos
Training sessions
IT meetings
Observed priorities are what staff see leadership reward.
If staff observe that:
Speed is praised
Revenue is celebrated
Client turnaround is sacred
Deadlines trump everything
Then security becomes conditional. Not because leadership said it directly, but because behavior communicates it.
People follow incentives. Not documentation.
The Mixed Message Trap
Here’s a common scenario inside CPA firms:
Leadership says: “Security and compliance are critical.”
Then the busy season hits. A partner says, “Just get it done.”
Those two statements cannot coexist.
When forced to choose between:
Immediate client satisfaction
Abstract compliance risk
Staff choose the client. Every time.
Because client service is visible. Compliance is theoretical.
Unless leadership consistently backs secure decisions, the signal becomes clear:
Security matters until it slows us down. This mindset can lead to an empty office, due to a data breach.
Incentives Shape Behavior
If staff are evaluated on:
Billable hours
Turnaround speed
Client responsiveness
But not evaluated on:
Secure process adherence
Documentation quality
Access discipline
Guess which behaviors dominate?
It’s not about morality. It’s about measurement. What gets measured gets prioritized. If security isn’t visible in performance discussions, it becomes background noise.
The Ownership Gap
Many firms assume IT “owns security.”
IT manages systems, IT installs tools, IT responds to issues.
But IT does not:
Set cultural tone
Define firm priorities
Control partner expectations
Design workflow incentives
When security ownership lives only inside IT, it becomes tactical.
Security must sit at the leadership table. Not as a technical topic. As a business continuity topic.
Why Compliance Anxiety Lives at the Top
Interestingly, the people who feel compliance anxiety most strongly are usually partners.
They worry about:
Insurance denial
Client loss
Reputational damage
Regulatory scrutiny
But they often don’t realize that anxiety is connected to system design.
They feel: “I hope we’re fine.”
Instead of: “I know how this is structured.”
Confidence doesn’t come from trust. It comes from clarity.
And clarity requires leadership ownership.
Leadership Design Questions That Change Everything
Here are uncomfortable but transformative questions:
If a staff member slows down to follow secure process, are they protected?
If a client resists secure portals, will leadership back the staff?
If busy season pressure conflicts with compliance, which wins?
Does leadership review security metrics with the same seriousness as financial ones?
Can we prove access discipline across the firm?
If those answers are uncertain, the design is incomplete.
Security as Operational Infrastructure
Many firms treat security as:
An IT layer
A compliance checkbox
An insurance requirement
It’s not. It’s operational infrastructure.
Just like:
Billing systems
Workflow software
Client management
If operational infrastructure breaks under stress, the firm is unstable.
Security must be designed to function under:
Peak workload
Staff turnover
Remote access
Growth
Vendor change
That’s not an IT project. That’s leadership architecture.
The Shift From Reaction to Architecture
Reactive firms:
Respond after incidents
Tighten after mistakes
Train after problems
Audit after pressure
Architectural firms:
Design before pressure
Anticipate busy season
Build guardrails in advance
Review consistently
The difference isn’t intelligence. It’s intentional design.
The Partner Conversation That Changes Culture
At some point, leadership must have a direct conversation:
“What behaviors are we truly rewarding?”
If the answer is:
Speed over structure
Revenue over resilience
Output over process
Then security will always struggle.
But if leadership explicitly aligns:
Client service with secure service
Productivity with process discipline
Growth with visibility
Everything downstream stabilizes.
You're not alone to solve this
Here at GCMSP, we help Chicago CPA's Ensure there IT strategy is within budjet and ready for modern day challenges
Security as a Leadership Identity
The most stable firms don’t treat security as a policy.
They treat it as identity. “This is how we operate.”
Not: “This is what IT requires.”
Identity-based cultures:
Self-correct
Surface issues early
Avoid underground workflows
Reduce compliance anxiety
That culture cannot be delegated. It must be modeled.
Now lets tie it all together.
We’ve now covered:
The human risk factor
Shadow IT
Busy season acceleration
Visibility erosion
Lockdown failure
Guardrail design
Leadership architecture
There’s one final piece left. What does a firm actually look like when this is done right?
as we close this blog, we’ll paint that picture:
The calm firm
The audit-ready firm
The busy-season-resilient firm
The firm that doesn’t operate on hope
What a Secure, High-Trust CPA Firm Actually Looks Like
There’s a misconception that a highly secure firm feels rigid, restrictive, or paranoid. It doesn’t.
When security is designed well, the firm feels calmer, not slower, not bureaucratic, calmer.
Because calm comes from certainty. certainty comes from structure.
The Calm Firm During Busy Season
In a secure, well-designed CPA firm, the busy season still feels intense.
Deadlines still loom, workloads still spike, and hours are still long.
But security doesn’t collapse.
Why?
Because the systems were built with the busy season in mind.
Remote access works reliably.
MFA is predictable, not disruptive.
File transfer tools are fast and standardized.
Staff know exactly where data belongs.
No one is improvising at 10:30 p.m.
There are no emergency access workarounds. No last-minute shared logins. No guessing which system to use.
The guardrails hold.
The High-Trust Culture
In a secure CPA firm, trust flows in both directions.
Leadership trusts staff to operate responsibly.Staff trust leadership to support secure decisions.
That means:
If a client pushes back on secure portals, leadership backs the staff.
If someone flags a risky workaround, they’re thanked, not blamed.
If a mistake happens, it’s examined structurally, not personally.
That culture eliminates underground workflows. Because people don’t hide what they’re not afraid to surface.
Visibility Is Normal, Not Scrambled
In a high-trust, secure firm. If someone asks, “Who has access to this client file?” The answer should be clear.
If an insurance carrier requests documentation, it’s already organized.
If an auditor requests evidence of backup testing, it’s logged and accessible.
To any level of audit or requirement to provide proof. There is no frantic email search, no assembling screenshots from memory, no more “we should have that somewhere.”
Visibility isn’t reactive. It’s built in.
Access Discipline Is Routine
In a secure firm:
Access is role-based.
Shared credentials don’t exist.
Offboarding is structured.
Access reviews happen quarterly.
Exceptions are documented and revisited.
No one feels restricted; it feels structured. Clear boundaries reduce anxiety.
Staff Don’t Debate Where Data Lives
One of the biggest signs of a well-designed firm is simplicity.
There isn’t confusion about:
Which platform to use
Where to upload documents
How to share files
What’s approved
There is one standard path. The secure path is also the easiest path.
When simplicity exists, Shadow IT disappears. Not because it’s banned,but because it’s unnecessary.
Busy Season Doesn’t Create Drift
In many firms, the busy season creates temporary chaos that lingers.
In secure firms, the busy season is anticipated.
Before peak workload:
Systems are tested.
Access is reviewed.
Tools are verified.
Staff are reminded of standards.
Guardrails are stress-tested before stress arrives. That preparation changes everything.
Leadership Reviews Security Like Financials
In resilient CPA firms, security isn’t a side topic.
It’s reviewed alongside:
Revenue
Profitability
Client growth
Not in technical language. In operational language.
Questions leadership regularly reviews:
Are access reviews current?
Have backups been tested?
Are we seeing policy exceptions?
Are we aligned with insurance requirements?
When security appears in the leadership rhythm, it stays visible. When it’s absent, it drifts.
Compliance Anxiety Disappears
In resilient firms, leadership feels: “I know how we’re structured.”
That shift eliminates the background anxiety that many CPA partners quietly carry.
Because they can answer:
Where data lives
Who can access it
What controls exist
What evidence is available
Confidence replaces uncertainty.
The Firm That Operates Without Hope
Hope is not a strategy.
Many firms operate on hope:
Hope no one clicks a phishing email.
Hope shared passwords don’t cause an issue.
Hope the insurance carrier doesn’t ask too many questions.
Hope busy season doesn’t expose cracks.
A structured firm doesn’t hope. It designs. It anticipates pressure. It aligns incentives. It builds guardrails. It maintains visibility. And it revisits the system regularly.
What This Really Protects
This blog hasn’t been about firewalls or software.
It’s about protecting:
Your reputation
Your client trust
Your insurance eligibility
Your operational continuity
Your leadership confidence
Good staff will always try to get work done. The question is whether the system supports them safely.
When it does, risk shrinks naturally.
Good People Deserve Better Systems
The silent risk inside CPA firms isn’t laziness, it isn’t ignorance, and It isn’t recklessness.
It’s good people operating inside systems that weren’t designed for pressure. When leadership accepts that, everything changes.
Security stops being about control; it becomes about infrastructure.
Infrastructure, when built correctly, fades into the background.
The firm runs, clients are served, deadlines are met, audits are calm, and insurance renewals are routine.
That’s what resilience looks like.
Not louder security, but quieter anxiety.