IT Support for Accountants

Ten quiet months and one very loud one

Most businesses carry their IT risk evenly through the year. An accountancy practice does not. A laptop that takes four minutes to open a large workbook is a grumble in June. The same laptop in the last week of January — everyone working late, a stack of returns still to file — is a real cost, repeated for every user, every day, for a fortnight. Your risk is concentrated into a handful of dates: the 31 January self-assessment deadline, the clusters of company year-ends behind it, payroll runs that cannot move, and VAT quarters in between.

Almost every sensible decision about a practice’s IT follows from that. It is about doing the disruptive work when disruption is cheap.

Two modes: build season and freeze season

Treat the year as two operating modes and be explicit about which one you are in. It costs nothing but the discipline to hold the line.

• Quiet months are for change. Server replacements, migrations, Windows upgrades, a restructured file store — all between the peaks, where a bad day is recoverable.
• Peak weeks are for stability. Nothing optional, nothing new pushed to the practice on a Tuesday in January. Security patching carries on; discretionary change stops.
• Capacity gets checked before the season. Which machines are short of memory or disk, and whether remote access will hold everyone who actually uses it.
• Slow hardware gets dealt with in the trough. The machine that mildly annoys someone in August eats chargeable hours in January.

Half the estate is in a browser, half is on a box

Practices accumulate systems the way they accumulate clients. Xero, QuickBooks and Sage on the bookkeeping side; IRIS, TaxCalc and CCH on the tax and practice-management side; often two or three at once.

The trouble is the split. Some of what you run is cloud — a browser, an account, nothing local to break. Some is still installed: a tax package on a server in the back office, a data folder mapped to a drive letter, a licence pinned to one machine. The two fail differently. Cloud tools depend on identity, so account hygiene, enforced multi-factor authentication and same-day leaver removal do the work. Installed tools depend on the box underneath — patching, free disk space, a proven backup, and an honest answer to whether that server should still be a server at all. The cloud half goes unwatched because it is “in the cloud”; the installed half because it has always worked, until the drive fills in the week that matters.

Client data is the product

A practice holds a dense concentration of other people’s financial and personal information — tax references, bank details, salaries, valuations, the private affairs of every director you act for. That makes it a target rather than an afterthought: one break-in reaches many people’s data at once.

Two things follow. The first is access control — not everyone needs everything, and shared logins destroy any ability to say who saw what. The second is retention and retrieval: practice records outlive the engagement, and “we still have it somewhere” is only true if you can produce it when asked. Sensible security controls around client data — enforced multi-factor authentication, encrypted devices, current patching and a real list of who can reach which system — do most of that. Cyber Essentials, the UK government-backed scheme, gives it shape, and something concrete to point at when a corporate client asks how you protect their information.

Fraud aimed straight at the finance function

Invoice redirection is the pattern to know. An email arrives, apparently from a supplier or a partner, saying bank details have changed, or asking for a payment to go out quickly, ahead of a deadline. It works because it lands exactly when people are busy and inclined to be helpful. A practice is both a target and a route into its clients, because a client will believe an email from their accountant.

The defence is habit as much as technology. Bank detail changes get verified by telephone, on a number you held before the email arrived. Urgent, secretive requests get slowed down on purpose, and nobody is criticised for checking — including a partner. Training the team to recognise the pattern does more here than any filter.

Sending returns as attachments is the habit worth losing

Attach the return, email it, hope. Everybody does it, and it is the weakest link in an otherwise careful process. The attachment sits in two mailboxes indefinitely; if the client’s account is compromised a year later, the document goes with it, and a mistyped address is discovered by nobody. Sending a link from a portal changes that: access can be withdrawn, activity is logged, and the file lives in one place you control.

What January looks like if the server dies

Ask it in its most specific form. If the office server failed on 28 January, or the line went down for two days, what happens? Who can still work? Which files are reachable? How long does a restore take, and has anybody timed one?

The honest answers are usually worse than assumed. Backups exist but have never been restored. Microsoft 365 is treated as inherently safe, when it keeps deleted items only for a limited window by default and expects you to hold your own copy beyond that. Remote access works, but two people have ever used it. So we treat backup and continuity as a tested process: restores actually performed, and a written fallback for how the practice keeps filing while something is rebuilt. The plan assumes the failure lands on the worst possible date, because that is the date it costs most.

Working with us

Most practices are better served by ongoing managed IT support than by call-outs — somebody watching the machines, patching to a schedule, handling joiners and leavers, and holding the calendar so disruptive work lands in the trough rather than the peak. Most of it is remote. When something needs hands on hardware, our team travels across Streatham, South London, Croydon and Surrey; much of that on-site work is delivered by our sister company PC Macgicians.

We do not give accounting, tax or compliance advice, and no IT provider can make a practice compliant. What we can do is keep the systems your compliance rests on secure, backed up and available on the days you cannot afford to be without them. Tell us what you run and when your busy season starts.