FTC Safeguards Rule Compliance for a Multi-Location CPA Firm

When the FTC finalized its updated Safeguards Rule in 2023, the requirements caught many financial services firms off guard. CPA firms, tax preparers, financial planners, and insurance agencies suddenly faced specific technical mandates that had not existed before: designate a Qualified Individual, conduct documented risk assessments, implement MFA, encrypt customer financial information, and report to management annually.

This multi-location CPA firm recognized the gap quickly. They handled sensitive financial data for hundreds of clients across multiple offices. Some of those clients, particularly institutional and corporate accounts, were beginning to ask about the firm's security posture and compliance status. The firm needed to get ahead of the requirement before it became a business risk.

NorthStar started with a risk assessment across all locations. We examined how client financial data moved through the firm's systems: from intake and document upload through processing, storage, and eventual archiving. We identified where data was encrypted and where it was not, who had access and whether that access was appropriate, and what would happen if a laptop was stolen, a phishing email was successful, or a vendor was compromised.

From the risk assessment, we built the Written Information Security Program (WISP), the core document the FTC Safeguards Rule requires. The WISP was not a template. It was written specifically for this firm's operations, technology stack, and risk profile. It covered access controls, encryption standards, vendor management, incident response, employee training requirements, and the Qualified Individual's responsibilities.

We established the QI program, defining who within the firm holds the Qualified Individual role, what their responsibilities are, and how they report to firm leadership. The updated Safeguards Rule requires the QI to provide an annual written report to the board (or equivalent) covering the security program's status, risk assessment findings, and security events. We built the reporting template and process so the firm could deliver this requirement consistently every year.

Vendor oversight was a significant piece of the work. CPA firms rely on numerous third-party tools: tax preparation software, document management systems, client portals, cloud storage, and practice management platforms. The Safeguards Rule requires documented oversight of every service provider with access to customer financial information. We cataloged every vendor, assessed their security practices, and created the oversight documentation the rule demands.

The firm now operates with a compliance program that satisfies the FTC Safeguards Rule and gives their clients confidence that sensitive financial data is being handled with the level of care they expect from their CPA firm.