What Confidentiality Requires Once the Data Leaves the Office
Twenty years ago, confidentiality at a small firm was largely a question of who had keys. The sensitive material sat in a cabinet, and a locked door was most of the answer.
That is no longer where the data is. It is on a partner’s laptop at a client site. It is in an email thread. It is in acloud folder shared with a contractor who finished a project in March. It is on a phone that goes to a conference. The obligation has not changed at all. The surface it applies to has changed completely.
What your clients assume you are doing
Nobody hiring an accounting, valuation, advisory, or consulting firm asks about encryption. They assume it. What they are actually assuming is broader than that and worth stating plainly.
That only the people working on their matter can see their material.
That when somebody leaves the firm, their access goes with them.
That a lost laptop is an inconvenience rather than a disclosure.
That the firm could describe, if asked, how any of this works.
Most of the firms I meet are doing better on the first two than they think, and worse on the last one. The gap is usually documentation rather than practice.
Four things worth checking this quarter
Who still has access that should not
Departures are the common failure. Not through carelessness, but because removing access is nobody’s job in particular, and the person who would notice is the person who left. A list of every account with access to client material, reviewed twice a year, resolves most of this.
Where material sits when somebody is working away from the office
Partners work from client sites, from home, and from wherever a deal happens to be. That is normal and it is not the problem. The problem is when the only way to make that work was for somebody to copy a folder onto a personal machine, and nobody ever deleted it.
What happens when a contractor or a temporary hire finishes
Seasonal capacity is a fact of life in accounting. Every additional person is an additional set of credentials, and the end of the season is the moment to close them, not the following year.
What you would hand somebody who asked
Increasingly, a client’s own auditor or insurer will ask your firm to describe its controls. Having ashort written account of what is protected, how access is granted and removed, and what happens if something is lost turns a stressful request into a five minute one. This is also what aclient security review tends to ask for.
The unglamorous controls that do most of the work
Multifactor authentication on everything that touches client data, with no exception for anybody senior. Email and cloud tools configured deliberately rather than left at their defaults, which is much of whatMicrosoft 365 hygiene covers.Endpoint detection on the machines people actually use. Backups that somebody hasrestored from at least once.Access removed the week somebody leaves.
None of that is impressive. All of it is what actually holds.
On what I will and will not claim
I providecompliance support and I will help your firm meet what your industry and your clients require of it. I am not going to tell you that hiring me makes your firm certified under any particular standard, because that is not how certification works and you would be right to distrust anybody who said otherwise.
What I will do is tell you plainly what is in place, what is not, and what I think is worth fixing first. If you want to go through it, call me at (617) 221-4100.
Frequently Asked Questions
1. How has confidentiality changed for small firms? +
The obligation to protect confidential information has not changed, but the way firms store and access data has. Client information now lives across laptops, phones, email accounts, cloud platforms, and shared folders, so confidentiality depends on controlling access across all of those environments.
2. What do clients assume about how their information is handled? +
Clients generally expect that only authorized people can see their information, that access is removed when someone leaves, that lost devices do not automatically expose their data, and that the firm can clearly explain how those protections work.
3. Do clients expect firms to discuss encryption? +
Usually not in technical detail. Clients tend to assume appropriate protections such as encryption are already in place. What matters most is that their information stays private and the firm can explain how access, devices, and data are protected.
4. Where do most firms fall short on confidentiality? +
Many firms have reasonable security practices but lack written documentation. The gap often appears when a client, auditor, insurer, or partner asks the firm to describe its access controls, offboarding process, backups, and security procedures.
5. Does a small firm owe the same confidentiality as a large one? +
Yes. The responsibility to protect confidential client information does not become smaller simply because a firm has fewer employees. Small firms still need appropriate safeguards, access controls, and security practices.
6. Why do former employees often keep access? +
Access can remain active when nobody clearly owns the offboarding process. Without a defined checklist and responsible person, old email accounts, cloud access, shared folders, or application permissions may remain open longer than intended.
7. How often should access to client material be reviewed? +
A formal access review at least twice a year is a practical starting point for many firms. Additional reviews should follow staffing changes, seasonal hiring, role changes, or major technology updates.
8. What should happen when a contractor or temporary employee finishes? +
Their accounts and access should be disabled promptly at the end of the engagement. Temporary and seasonal workers should be included in the same offboarding process as permanent employees.
9. How should access be handled when someone leaves the firm? +
Access should be removed as part of the employee’s departure process. This should include email, cloud storage, shared drives, business applications, remote access, and any other system containing confidential information.
10. Is it a problem when partners work from client sites or home? +
Remote work is not automatically a problem. The risk appears when employees copy confidential files to personal or unmanaged devices, use insecure connections, or store client information in places the firm cannot monitor or control.
11. Why are copies of client files on personal devices risky? +
Personal devices can reduce the firm’s visibility and control over confidential information. If the device is lost, shared, sold, compromised, or improperly backed up, the firm may have difficulty determining what data was exposed.
12. What happens if a laptop is lost or stolen? +
The impact depends on the security controls in place. Encryption, endpoint protection, multi-factor authentication, device management, and strong access controls can significantly reduce the risk that a lost device becomes a data exposure incident.
13. Why might a client’s auditor or insurer ask about our security controls? +
Auditors, insurers, and clients increasingly want evidence that firms handling sensitive information have appropriate safeguards in place. Clear answers can influence vendor approval, client relationships, contracts, and insurance terms.
14. What should a short written account of our security controls include? +
It should explain what information the firm protects, how access is granted and removed, how devices and accounts are secured, how backups work, and what happens if a device or account is lost or compromised.
15. How does written documentation help during a security review? +
Documentation makes it easier to answer client questionnaires, insurance applications, and security reviews without rebuilding the same information each time. It also helps the firm identify gaps before someone else asks about them.
16. Which controls do the most to protect client data? +
Important protections include multi-factor authentication, properly configured email and cloud systems, endpoint detection, device encryption, tested backups, access controls, and prompt removal of accounts when employees or contractors leave.
17. Should multi-factor authentication apply to senior staff too? +
Yes. Senior staff and partners often have access to highly sensitive information, so making exceptions can create additional risk. MFA should be applied consistently across accounts that access confidential data.
18. Why do backups need to be restored, not just run? +
A backup report only shows that a backup process completed. Performing a restore confirms that the data is usable and that the firm can actually recover information when a real disruption occurs.
19. Can an IT provider make my firm certified under a security standard? +
An IT provider can help a firm improve security controls, documentation, and readiness for specific requirements, but formal certification usually involves a separate assessment or audit process. Be cautious of providers that promise certification simply through their services.
20. What is a good first step toward better confidentiality? +
Start by reviewing who currently has access to client information and documenting the controls already in place. To discuss what is working, what may be missing, and what to prioritize first, call (617) 221-4100.
