IT Security Audit Checklist

An annual IT security audit for an accounting or tax practice — covering network controls, access management, client-data protection, incident response, regulatory compliance with IRS Pub 4557 and the FTC Safeguards Rule, and physical safeguards. Run by the firm's IT lead with...

6 sections 22 steps Collects data
1

Network Security

  1. Verify firewall blocks unauthorized inbound traffic

    • Pull the current firewall ruleset and confirm only required ports are open to the internet — typically 443 outbound for client-portal sync and the VPN concentrator. Flag any legacy 'any/any' rules from prior tax seasons; they are the most common dismissal finding in a peer review.

  2. Patch routers, switches, and access points

    • Confirm every network device runs current firmware. Vendor-issued CVEs from the last 12 months are the priority; document any device left at an older version with a written exception and a planned replacement date.

  3. Run external vulnerability scan on firm IPs

    • Use Nessus, Qualys, or Rapid7 against your published static IPs and any cloud assets in scope. Save the full report to the audit folder; the WISP requires retained scan evidence for the IRS Pub 4557 self-assessment.

    Collects list Collects file
  4. Remediate critical and high vulnerabilities

    • Patch, reconfigure, or compensate for every critical and high finding from the scan. Re-scan after remediation and attach the clean report; partial remediation needs a written exception with the responsible owner and a target date.

2

Access Control

  1. Audit user accounts in tax and accounting software

    • Pull the active user list from UltraTax, Lacerte, ProConnect, or Drake; from QuickBooks Online and any client GL access; and from the client portal (TaxDome, SmartVault, Liscio). Match against the current staff roster — orphaned PTIN-bearing accounts are a common finding.

  2. Confirm MFA enrollment across staff

    • The FTC Safeguards Rule requires MFA on any system holding customer information, which for an accounting firm includes M365 / Google Workspace, the tax engine, the GL, the portal, and remote access. App-based authenticators or hardware keys only — SMS does not satisfy.

    Collects list
  3. Enforce MFA on remaining accounts

    • Set conditional access to require MFA at next sign-on for every gap identified. Coordinate with partners before flipping the switch on shared service accounts so a tax-season filing flow is not interrupted.

  4. Revoke access for departed and seasonal staff

    • Cross-check HR's termination list against every system from the prior step. Seasonal preparers from last filing season are the usual stragglers — their tax-software logins, portal accounts, and shared-mailbox delegations all need to be removed.

3

Client Data Protection

  1. Confirm full-disk encryption on firm laptops

    • Verify BitLocker (Windows) or FileVault (Mac) is enabled and keys are escrowed in your MDM. An unencrypted laptop with a single client's SSN triggers state breach-notification obligations in MA, NY, CA, TX, and most others.

  2. Verify TLS on client portal uploads

    • Test the upload flow end to end on TaxDome, SmartVault, ShareFile, or Liscio. Confirm TLS 1.2 or higher and that any legacy email-attachment workflow for source documents has been retired in favor of the portal.

  3. Test backup restore of tax and GL data

    • Restore a sample of last week's UltraTax / Lacerte data files and a QBO company file to a sandbox. A backup that has never been restored is not a backup; this is the single most common finding during a ransomware tabletop.

    Collects list
  4. Open priority ticket with backup vendor

    • If the restore failed, open a P1 with the vendor and pause any planned data-rotation that would overwrite recoverable backups. Notify the managing partner; do not close this audit until restore is verified clean.

  5. Document the client data retention schedule

    • Confirm the firm's retention policy — typically 7 years for income-tax workpapers and copies of returns — and that purge automation actually fires on the right schedule. Indefinite retention is its own breach risk.

4

Incident Response and Reporting

  1. Review the WISP incident response procedures

    • Walk the partner-in-charge through the response playbook — detection, containment, eradication, recovery, notification. Confirm the IRS Stakeholder Liaison phone number for the firm's region is current; reporting a data theft to the IRS is a Pub 4557 obligation.

  2. Run a phishing simulation across staff

    • Use KnowBe4, Hoxhunt, or your M365 Attack Simulation tooling. Lures should mirror real tax-season pressure: fake e-file rejections, fake client K-1 attachments, fake e-Services password resets. Track click rate and route repeat clickers to remediation training.

  3. Document the breach notification timeline by state

    • List every state where the firm has clients with PII and the corresponding notification clock — MA is 'as soon as practicable', CA is no later than 60 days, NY SHIELD requires 'in the most expedient time'. The clock starts on discovery, not confirmation.

5

Compliance and Risk Management

  1. Update the WISP per IRS Pub 4557

    • Refresh the Written Information Security Plan against the current Pub 4557 and Pub 5708 templates. Every paid preparer with a PTIN is required to have a WISP, and the IRS now asks for confirmation on the PTIN renewal — a missing or stale WISP is a real finding.

    Collects file
  2. Collect SOC 2 reports from key vendors

    • Request current SOC 2 Type II reports from the tax-software vendor, the document portal, the payroll provider, and the cloud-hosting partner. Note any qualifications or carve-outs that touch client data; the FTC Safeguards Rule requires documented vendor oversight.

  3. Conduct an annual risk assessment of client data flows

    • Map where client SSNs, EINs, and bank info live: portal, tax engine, GL, email, archives, paper. Score each flow for likelihood and impact. The Safeguards Rule requires this in writing and a refresh on material change.

6

Physical Security

  1. Inspect locks on file rooms and the server closet

    • Walk every space holding paper returns, prior-year archives, or network equipment. Cipher-lock codes should be unique per role and rotated when staff depart; a shared code from three tax seasons ago is the typical finding.

  2. Verify shredder logs for paper returns and source documents

    • Confirm certificates of destruction from the shred vendor for every pickup in the last 12 months. Loose 1040 source docs in a recycling bin during the April rush is the single highest-likelihood physical-security incident at most firms.

  3. Check environmental controls in the server closet

    • Confirm the UPS battery passes its self-test, the AC unit holds the room under spec, and any water sensor under the rack still alarms. A flooded closet during a long-weekend filing deadline can take the firm offline through Tax Day.

Use this template

Copy it to your account, customize the steps, and run it with your team in minutes.

Use this workflow Start free trial
Sections 6
Steps 22
Category Accounting
Price Free to start
Need a different process

Browse hundreds of free templates across every team and industry.

Back to template library

Related templates

More workflows your team can run.

Accounting

M&A Synergy Realization Checklist

View
Accounting

New Vendor Onboarding Checklist

View
Accounting

New Employee Onboarding Checklist

View
Accounting

Payroll Year-End Checklist

View

Run IT Security Audit Checklist with your team

Customize the steps, assign roles, set a schedule, and keep a complete record for every run.

Use this workflow Start free trial