A former employee still has VPN access three weeks after their last day. A vendor’s staging environment gets breached, and credentials reused on your firm’s systems let someone poke around client files for a weekend before anyone notices. A client calls asking why a wire instruction changed. In every one of these scenarios, the question that determines how bad the outcome gets is the same: can the firm show, with a timestamp, exactly who did what?
That question is answered by audit logs, and for accounting and CPA firms, the stakes around it are higher than they might first appear. Client financial data is the core asset firms are trusted to protect. When that trust is tested by an incident, the firm’s ability to reconstruct events quickly and accurately shapes everything that follows: client confidence, regulatory exposure, and how long recovery takes.
Why audit logging is a firm-wide issue, not just an IT one
Firms that prepare tax returns or otherwise handle nonpublic client financial information generally qualify as financial institutions under the FTC Safeguards Rule. That rule requires monitoring and logging of authorized user activity on systems holding customer information, among other safeguards. Firm size can shape how the program is scaled, but the underlying expectation, knowing who accessed what and being able to show it, applies broadly across the profession.
Audit logs are also frequently the deciding factor in cyber insurance claims and client communications after an incident. A firm that can produce a clear, timestamped record of activity is in a fundamentally different position than one that can only offer a best guess.
What a functional audit logging program actually covers
A logging program worth relying on typically includes the following:
- Activity logging enabled on every system that touches client financial data, including practice management software, document management platforms, email, and any cloud storage or client portal.
- Both successful and failed login attempts tracked. A string of failed attempts followed by a success is one of the clearest early indicators of a compromised account.
- Privileged actions tracked separately from routine activity, including permission changes, access to the audit logs themselves, and data exports.
- A documented retention policy that firms actually follow. It’s common for a firm to assume logs go back further than they do, only to find that older records were purged automatically at a default 90-day setting.
- Access reviews conducted after every staff departure, confirming that access was actually revoked rather than simply requested.
- Logging expectations extended to any vendor or software integration with access to client data, documented in writing rather than assumed.
- A named individual responsible for reviewing logs on a set schedule. Reliance on someone eventually noticing an anomaly is not a control.
Where firms commonly fall short
In practice, the most frequent gap isn’t the absence of logging altogether. Most modern practice management and document platforms log activity by default. The gap is usually one of three things: retention periods shorter than the firm realizes, logs that exist but are never reviewed, or logging that stops at the primary software platform and doesn’t extend to email, cloud storage, or vendor-connected systems.
Retention deserves particular attention. A firm may need to answer a question about access to a specific file from eight months ago, only to discover the relevant logs were purged at 60 or 90 days under a default vendor setting. At minimum, retention should cover the firm’s busiest audit or investigation window, which for most practices means a year or more.
The client-trust dimension
Clients rarely ask directly about a firm’s audit logging practices, but they are the beneficiaries of it. A firm’s ability to answer “who accessed this” quickly and accurately, whether the question comes from a client, an examiner, or an insurance carrier, is part of what distinguishes a firm clients can rely on with sensitive financial information. Building that capability before it’s tested is far less costly, in both time and reputation, than trying to establish it after an incident is already underway.
Firms evaluating their current posture should start with a straightforward exercise: pick a client file and ask who could answer, with evidence, exactly who has accessed it over the past year. If the honest answer is uncertain, that uncertainty is the gap worth closing first.
Scott Carr, owner of Farmhouse Networking in Grants Pass, Oregon, is a veteran Network & Computer Systems Architect with over 30 years of IT experience. For over a decade, he’s led his team in delivering proactive, secure, and fully managed IT services to more than 80 businesses—including accounting and finance firms that rely on data security, compliance, and efficiency. Scott’s hands-on, jargon-free approach ensures every client understands their technology and gains confidence in their systems. His firm is known for fast, responsive support—most issues are resolved within 15 minutes—and deep expertise in cybersecurity, network design, and IT compliance. Learn more about how Farmhouse Networking supports the accounting industry at https://www.farmhousenetworking.com/finance-it-support/.
Sign in to get access to this free resource, and all of our whitepapers and reports.
Download this content today!
Register Now Already registered? Click here to Log In
Tags: data security, Firm Management, firm staff, firm technology, IT, Security, Technology, users
