then follow up every few years.
by roman h. kepczyk
quantum of paperless
going “paperless” means that all firm files and client data will be digitally stored on the firm’s network, which is almost always accessible to firm personnel via internal workstations and remotely via the internet.
more: ‘learning culture’ requires standardized processes | centralize contact administration | how digital a/p processing boosts productivity | how an ‘owner’s drawer’ boosts security | the top portable monitors for auditors | why scanning procedures matter
exclusively for pro members. log in here or 2022世界杯足球排名 today.
the firm has a fiduciary responsibility to protect this data from anyone not specifically authorized to view it.
proper security is very difficult for any internal network administrator to guarantee as few have the experience and have participated in ongoing training to implement security settings optimally the first time. therefore, all “one-shot” implementations of firewalls, wireless routers, virtual private networks and other security settings should be outsourced to an organization that has experienced personnel dedicated to security.
in many cases, these providers can also deliver ongoing monitoring and maintenance of the firm’s firewall and internet connectivity, and provide security guidance and personnel training. we recommend all firms conduct annual security training for all staff on today’s most common cybersecurity threats including phishing, ransomware and social engineering, which can put the firm at risk.
the firm’s security infrastructure can then be verified by an independent security consultant every few years, or whenever a major change in the firm’s network infrastructure takes place. if there is not a security consultant locally, two vendors with accounting firm experience in north america are mcmillen group (eric mcmillen) and withum (joe riccie).
recommended action:
- have an independent security consultant/network integrator review firewall, antivirus, spam and physical security at least every three years or whenever a major change is made to the firm’s infrastructure.
- mandate annual cybersecurity training for all firm personnel.