The short answer: IT management for an accounting firm must protect accounting and payroll data while respecting closing periods, filing deadlines, and statutory software updates. Decide in advance who manages the application and database, when changes must not be made, how much work may be lost in an incident, and who will verify the accuracy of accounting processes after an intervention.
Start with workflows, not a list of computers
Keeping an inventory of laptops, monitors, and printers is useful, but it does not reveal what could actually bring the firm to a standstill. The IT administrator must first understand how a document moves from receipt through posting and archiving to delivery to the client.
Map at least:
- where the accounting and payroll application runs;
- where its database is located and who has administrative access to it;
- where documents come from and where they are stored;
- who works with data boxes, banking services, and client portals;
- how tax returns, reports, payslips, and payment orders are submitted;
- which activities depend on a particular computer, certificate, or person;
- what can be done during an internet, server, or accounting software outage.
For every important process, appoint a process owner and a technical administrator. The process owner can determine whether the result is substantively correct. The administrator is responsible for technical operation. These roles must not be confused: successfully installing an update does not confirm that payroll calculations, reports, or bank exports work correctly.
Define data loss and recovery time for every process
Saying that „the data is backed up" is too vague. The firm needs to decide two practical matters:
- how much completed work may be lost in an incident;
- how long the process may remain unavailable.
If the database is copied only after the working day ends, an afternoon failure could mean re-entering an entire day’s documents. A shorter interval, however, requires the accounting application and database to support consistent backups while running. Simply copying an open database file may not produce a usable backup.
Record the following for each system:
| Process | What must be restored | What determines priority |
|---|---|---|
| Accounting system | Application, database, licences, users, and related files | The nearest closing or filing deadline |
| Payroll | Database, statutory software version, certificates, and exports | Processing and payment deadlines |
| Mailboxes, contacts, rules, and delegated permissions | Client communication and retrieval of instructions | |
| Documents | Files, version history, and access rights | Availability of supporting documents and the audit trail |
| Data boxes | Personal permissions and backup access | Filing and receipt of messages |
| Banking portals | Roles, approvals, and trusted devices | Sending and checking payments |
Priorities change throughout the year. Payroll may be more important than routine invoicing during a particular week. The recovery plan must therefore be more than the administrator’s technical document; it must reflect the firm’s actual calendar.
A backup must survive mistakes, attacks, and provider outages
A green backup-job status confirms only that a particular process ran. It does not tell you whether the backup contains the correct database, whether it can be read, or whether the necessary passwords, encryption keys, and installation files are available.
For an accounting environment, require:
- automated backups at intervals based on the acceptable amount of lost work;
- a copy separated from ordinary user and administrator accounts;
- backup history that a compromised account cannot easily delete in full;
- a documented procedure for restoring the application, database, and permissions;
- monitoring of errors and storage capacity;
- regular practical recovery tests in an isolated environment.
A test does not end when a file has been downloaded from the backup. The restored database must be opened in the corresponding application version, an ordinary user must sign in, and a selected process, report, and related document must be verified. The test record should include the date, the backup used, the result, and any identified deficiencies. The article Backup recovery testing: how to perform and document it explains the detailed procedure.
A synchronised folder is not a backup by itself. Accidental overwriting, bulk deletion, or file encryption may be synchronised to other devices. Protection requires separate version history, segregated permissions, and verified recovery.
Someone must approve and verify every accounting system update
The accounting software vendor may release a statutory or corrective update, but that does not settle responsibility for deploying it in a particular firm. Decide in advance:
- who monitors new releases and vendor instructions;
- who decides when an update will be installed;
- who creates and verifies the backup before the change;
- who checks the technical installation process;
- who performs a substantive test of the accounting process;
- how the system will be returned to its previous state if the checks fail.
Confirming that the application starts is not enough. The checks must cover the firm’s actual operations: user sign-in, opening a selected company and accounting period, working with a document, generating reports, printing or creating a PDF, and using the relevant export. A test payment file must not accidentally be sent to the bank, and a filing test must not result in a real submission.
The change may also involve the database server, operating system, payroll module, electronic signature, printers, antivirus protection, or a third-party add-on. Exact dependencies vary by product, edition, and installation method. The administrator must therefore not assume that a procedure used for one firm will work unchanged for another.
The change calendar must respect closing deadlines
A fixed maintenance evening is not enough. The same intervention may be routine during a quiet week but unacceptable immediately before a closing deadline.
| Situation | Appropriate IT procedure | What to postpone unless essential |
|---|---|---|
| Before closing or filing | Verify system availability, backups, certificates, and free capacity | Migrations, server replacement, and major network changes |
| Before payroll processing | Check the application version, access, and related exports | Unverified database and permission changes |
| After a statutory update is released | Agree on the backup, timing, responsible people, and functional testing | Automatic deployment without a rollback option |
| During a quieter period | Test recovery, replace devices, and review accounts | Work performed without an accountant available to verify the result |
| After an employee leaves | Terminate sessions, remove accounts, and transfer data ownership | Retaining an account „just in case" |
Security updates cannot automatically be postponed until a period with no work. The administrator must assess the severity of the fix, the system’s exposure to the internet, the possibility of exploitation, and the impact of downtime. The result should be a specific decision, not a permanent rule that „nothing changes during the busy season."
Remote work must not rely on public RDP
Do not expose a Remote Desktop service port directly to the internet. Route remote access through a managed VPN or ZTNA service, enable multi-factor authentication, and give each person an individual account. The practical differences are explained in this comparison of RDP, VPN, and ZTNA for businesses.
The administrator must know which devices are allowed to access accounting data. For an approved laptop, check that it runs a supported operating system version and has current updates, disk encryption, endpoint protection, and automatic locking enabled. An unmanaged personal computer must not become an uncontrolled copy of the firm’s data.
When an employee leaves, changing the password in the accounting application is not enough. Active sessions must be terminated, remote access revoked, email tokens removed, file ownership transferred, and delegated permissions reviewed. Use personal identities and available roles for data boxes, banking services, and client portals instead of a single shared account.
Verify changes to bank details outside email
An email filter cannot determine whether the account number on an invoice is correct. A fraudulent message may come from a compromised legitimate mailbox and continue an existing conversation.
Introduce a simple operating procedure:
- An employee must not change bank details or follow unusual payment instructions based on an email alone.
- They must verify the information through a second channel using previously known contact details.
- They must not use a telephone number provided in the suspicious message.
- Another authorised person must review the change to payment details.
- The verification result must be recorded in accordance with the firm’s internal rules.
The same caution applies to telephone calls, voice messages, and video calls. A familiar voice alone does not confirm the caller’s identity; the article Deepfake executive voice and CEO fraud describes specific scenarios.
Technical safeguards should support this process. They include MFA, checks for automatic forwarding, alerts for risky sign-ins, and restrictions on changes to sensitive rules. Even a correctly configured email domain cannot verify the authenticity of payment details in a message sent from a compromised account.
Review the external administrator’s access as well
An external IT provider may have more extensive privileges than most of the firm’s employees. When selecting a provider or transferring IT management, require specific answers:
- Does every technician have an individual account and MFA?
- Do they use separate standard and administrator accounts?
- Can remote connections and completed changes be traced?
- How is access revoked when a technician leaves the provider?
- Who holds emergency access, and how is its use monitored?
- Will the firm receive an up-to-date list of services, devices, and responsibilities?
- Who communicates with the accounting software vendor’s support team if a database error occurs?
- How will the firm obtain the necessary documentation when changing providers?
Permanent full access is inappropriate where a limited role or temporary access for a specific intervention would be sufficient. An assurance that „everything is secure" is no substitute for a documented procedure and traceable records.
What an IT management proposal should include
Compare the scope of services by responsibilities and deliverables, not by the number of tool names listed. The following are particularly important for an accounting firm:
- an inventory of devices, accounts, licences, and managed services;
- workstation and server updates;
- protection of endpoints and email accounts;
- backup monitoring and recovery testing;
- identity, MFA, and remote-access management;
- procedures for employee onboarding, role changes, and departures;
- configuration and emergency-contact documentation;
- coordination with the accounting system vendor;
- incident reporting and escalation during critical periods.
Explicitly separate the IT administrator’s work from application support. The administrator may be able to restore the server and database but may not be qualified to assess whether a payroll calculation is correct. Conversely, application support may not manage the network, backup storage, or Microsoft 365 access.
If you want to assess a specific environment and transfer its management, we provide IT services for businesses, including accounts, devices, backups, and coordination with application vendors. Before proposing the scope, we need to know which systems you use, the number of workstations, how remote work is organised, and when the firm must not experience disruption. You can send the details through our no-obligation enquiry form.
What to prepare before transferring IT management
For the initial technical handover, prepare a list of people, devices, applications, providers, domains, email services, data storage systems, and known problems. Add a calendar of closing deadlines and the names of people authorised to approve changes and verify the accounting system.
The first priorities are unknown administrator accounts, remote access without MFA, unverified backups, and services that depend on a single person. Only after these have been secured does it make sense to standardise laptop models, redesign documentation, or introduce additional convenience tools.
Good IT management for an accounting firm is not a list of software. It is an agreement on who makes decisions, what is checked before a change, how a correct result is recognised, and how the firm continues working when part of the system fails.
Frequently asked questions
What should IT management for an accounting firm include?
At a minimum, it should include inventories of devices and accounts, updates, workstation protection, backups with recovery testing, MFA, secure remote access, documentation, and procedures for employee onboarding and departures. It must also clearly divide responsibilities between the IT administrator and accounting application support.
How often should an accounting database recovery be tested?
Set the interval according to the acceptable amount of lost work, the required recovery time, and the frequency of system changes. Another test is advisable after a change to the database, backup solution, encryption, infrastructure, or provider. A successful backup-job notification alone does not prove that recovery works.
Can an accounting system be used securely from home?
Yes, provided that access is routed through a managed VPN or ZTNA service, requires MFA, and uses an approved device with a supported operating system, current updates, and disk encryption. RDP exposed directly to the internet and a shared account used by several people are not suitable solutions.
Is a synchronised folder sufficient as a backup?
No. Synchronisation may propagate file deletion, overwriting, or encryption to other devices. You need separate version history, restricted permissions, and a recovery procedure that has been tested in practice.
How can you identify a reliable external IT administrator?
They can describe their responsibilities precisely, use individual administrator accounts with MFA, record interventions, and provide up-to-date documentation. At the same time, they will state clearly what the accounting application vendor must handle and how both providers will cooperate during an outage.
Where to find us
ITHOPE is a company based in Brno, Czechia: we do data recovery from disks, RAID and NAS, PC and laptop service and IT for business, all in our own lab at Viniční 3587/216, 615 00 Brno.
Phone +420 775 556 063 (24/7 line). You can bring the device in person, or send it by courier (Zásilkovna, PPL).