Sector
IT support for accountants, built around deadlines you cannot move
An accountancy practice has a workload shaped like a saw. For most of the year the technology is unremarkable; for six weeks around each filing deadline it is load-bearing, and a two-day outage in the third week of January is not an inconvenience. It is a professional problem with client consequences.
The software a practice runs
Practices typically run a compliance suite, IRIS, TaxCalc, CCH or similar, alongside cloud bookkeeping in Xero, QuickBooks or Sage, a payroll package such as BrightPay, document capture through Dext or similar, and increasingly a practice management layer holding the deadline schedule. Add business email, HMRC gateway access, and client portals, and the estate is larger than most firms of the same headcount.
The interesting problem is that the compliance suite is often the last thing still tied to a local server, while everything else has moved to the cloud. That hybrid state is where most of the fragility sits, and it is worth being deliberate about rather than drifting through.
Where a local server is still in play, that falls under server support and business backups.
Deadline resilience
The practical requirement is that nothing scheduled and preventable happens in a busy period. Patching, upgrades, migrations and hardware refreshes all belong in the quiet months, planned around your calendar rather than a generic maintenance window. That sounds obvious and it is routinely got wrong, usually by providers who do not know when your deadlines are.
The second requirement is that a failure during a busy period is recoverable in hours. That means backups tested rather than assumed, a documented build for the machines that run the compliance suite, and knowing in advance who to ring at the software vendor rather than finding out at the point of crisis.
Client data and what your professional body expects
A practice holds an unusually concentrated set of personal and financial data, which makes it a more attractive target than its size suggests and makes a breach considerably more damaging. Invoice redirection fraud in particular targets exactly this profile, and the defence is unglamorous: multi-factor authentication everywhere, email filtering that catches domain impersonation, and a process for verifying bank detail changes that does not rely on an email being genuine.
Cyber Essentials is increasingly raised by professional indemnity insurers and by larger clients. It is achievable for a practice of any size, and the five controls it checks are the ones worth having anyway.
There is a full write-up in the small business guide to Cyber Essentials.
What we would look at in the first month
The audit for a practice follows a predictable shape, because the same four things turn up almost every time.
First, where the compliance suite actually lives and what would happen if that machine or server failed in the third week of January. A documented build and a tested restore turn that from the worst week of your year into a morning, and most practices have neither.
Second, the accounts belonging to people who have left, plus any shared logins used for HMRC or bookkeeping platforms. In a practice holding client financial data, that is the single highest-value tidy-up available.
Third, the multi-factor coverage, not whether it is on, but whether it is on everywhere including the administrator accounts and the platform logins nobody thinks of as email.
Fourth, the calendar. We ask for your filing deadlines before we ask for anything technical, because every maintenance decision for the next twelve months hangs off them.
All of that comes out of the free process review.
Get in touch
Tell us how your accountants business runs
A few lines is enough. We will tell you straight whether we can help, what it would cost and how quickly we can be there. No hard sell, and no follow-up sequence if you decide against it.
- We reply within one working day
- A straight answer, including when it is no
- Free process review available, before any money changes hands
Would rather just ring? 01623 354250, Mon–Fri, 9am–5:30pm.
Questions we get from accountants
If the answer is not here, ask us. You will get a straight one, from someone who does the work.
Mon–Fri, 9am–5:30pm
Can you work around our filing deadlines?
That is the central requirement in this sector. Patching, upgrades, migrations and hardware refreshes get planned into your quiet months around your calendar, not a generic maintenance window, and we ask for those dates before anything else.
Do you support IRIS, TaxCalc and CCH?
We support the servers, machines, accounts and network those suites run on, and we deal with the vendor directly when a problem is inside the application. You should not be the one relaying messages between two suppliers.
We are half cloud and half local server. Is that a problem?
It is the most common state we find in practices, and it is manageable, but it should be a decision rather than a drift. We will map what is where, tell you what the fragile points are, and give you the honest cost comparison of consolidating either way.
How do we protect against invoice redirection fraud?
Multi-factor authentication everywhere, email filtering that catches impersonation of your own domain, and a verification process for bank detail changes that does not depend on an email being genuine. That last one is a process change rather than a technical one and it is the part that actually works.
Does our professional indemnity insurer care about Cyber Essentials?
Increasingly, yes, and larger clients are starting to ask as well. The Complete plan includes preparation: gap analysis, remediation and the evidence gathering that makes the assessment straightforward.
What happens if a machine dies in the third week of January?
With a documented build and a tested backup, it is a morning. Without either, it is the worst week of your year. Getting those two things in place is the first work we do with a practice.