Cybersecurity Experts Reveals How Accounting Firms Automate Safely

How does AI coming into the conversation change those practices that firms should follow?

Yeah, I would say that's the biggest question right now is being asked at the moment since ChatGPT came out with the connectors from our clients. What I would say to anybody, you know, listening to this, I would say if you're a tech-forward accounting firm, you know, don't stay behind. Don't feel afraid to use these tools, ChatGPT connectors. Just be mindful of, you know, what type of information you're providing to the system. Vulnerabilities there is, right, privacy, or, you know, you're Exposing information that you're— you weren't supposed to expose.

So he owns T Squared IT. He's an IT and cybersecurity firm that works exclusively for accounting firms and that has been around for more than a decade, and he's ready to share with us all. Hey everyone, this is Isaac from oster.co, and today I brought in the cybersecurity expert for accounting firms to talk us through whether automation is secure, what risks to consider, And how to keep your workforce efficient, but also safe. Thanks for coming in, Daniel.

Thank you, Isaac. Thanks for having me.

All right. Is there anything else you'd like to tell people about your firm and your experience that makes you a credible source and qualified to answer the questions you want to talk about today?

Yeah, I think you did a good introduction. I think one of, um, I guess out of that, I'm CISSP certified, so there's about like 96,000 CISSPs around the world, and I'm one of those lucky ones. And that's, if you think about it, that's kind of like a CPA for the US, but for cybersecurity in general, a certification. So besides that, we've been working with accounting firms for over 10 years, understanding their processes, how they do things. As I tell my clients, like accounting firms are one of those big fish for any bad actor because If you try to attack, you know, just a personal, you know, somebody in general, they might not get as much information. An accounting firm has a lot of information. So we've been kind of helping them navigate through cybersecurity these past few years.

Yeah, kind of mitigate that risk.

Yeah, exactly.

Perfect. Well, I'll say this, we live in the automation space and even we get a lot of questions about safety, security, how do we make sure nothing happens to our data? So Open-ended question for you, but would you say automating and automation in general is a safe thing to do?

Of course, of course. Uh, think, think of it this way, right? Like, we as humans make— could make more mistakes than, you know, automating something. So in a way, it could be safer, right? If you, if you're doing it the right way, it could be safer.

Nice. So it could be safer, but it could also lead to certain vulnerabilities, right?

That's right. So I would say, you know, if we're getting into that, I would say if you have an expert, right, just like you, Isaac, that understand the cycle of how to develop, you know, an automation, making sure that you have the documentation, making sure that, you know, you know how to protect those things, you're in a good spot. But sometimes, right, like with the new technologies out there, we try to play around with things, which is great, right? We have things that are there to help us generate things from us not really knowing automation. And that's maybe where we, you know, and I've seen like firms get into trouble where, hey, I'm trying to do something myself, but we're not going through a whole lifecycle of, hey, these are the best practices to make sure that we're automating the right way.

Yeah.

Okay.

So those are, there's documentation, that's a big part of it. And just like using some best practices there to ensure that the access you're providing to the tool or the automation, it's just as secure, if not more secure, than the access you would have provided to a human being.

Yeah. I've seen a particular example, you know, accounting firm, right? Like, uh, they're trying to build their automation team internally. They kind of, you know, had somebody that understood automation. They, you know, gave them the position to, hey, let's see if we can automate some things with Excel, with, uh, with Google Sheets. They built some Python scripts and things like that. But the thing is, you know, the person that's an expert in going through that cycle of documentation, you start getting into like, for example, hey, I'm providing the API key of a certain thing that maybe it's already on the source code. And, you know, from that aspect, right, we wanna make sure that we're not making it easy for the bad actors to be able to get through our, our systems and things like that.

Yeah, yeah, definitely. I love that you mentioned that cuz we've seen that definitely where we've gone to a piece of code and their API key is just like hardcoded there where it's— I like to tell clients that an API key is just like a password. Right? You are effectively giving another program access to all of your stuff, and that should be protected, encrypted, and managed, you know, just like you would a password. Could you talk about like what other vulnerabilities are people or firms could expose themselves to when they dive into this world of trying to automate and especially like trying to do it on their own?

Yeah, I would say it has to do a lot with making sure that you have your foundation in place, like understanding how your data is flowing through the accounting firm's process. A lot of the times where we kind of get into trouble is we don't fully understand how that data is going to different systems. So vulnerabilities there is, right, privacy, or, you know, you're exposing information that you weren't supposed to expose. So I don't know, through like API calls or through add-ons from different systems, maybe you're exposing information that you shouldn't be exposing. So those are like major vulnerabilities that it's not planned correctly. Again, going back to like having a policy internally that you're going through like a development lifecycle and you're documenting things the right way, you know, we can start getting into trouble.

Makes sense. And overall, in what other ways would you say automation affects the security of accounting data? I know you mentioned that if done well, it could improve it, it could make it safer, but what other ways, in what other way does it impact or affect the security?

Yeah, so nowadays, like for example, with, you know, ChatGPT, now we're exposing you know, if we have the connectors, we're exposing internal information. So that's a big area where there's an unknown, right? Like we're all in this world right now, all trying to live it together. There's a lot of questions around privacy.

Yeah.

So like how extensive does it get where like privacy now, it doesn't exist anymore right now, but imagine now with AI, like, okay, now it's like a, you know, an extra level of like, okay, Where's my privacy anymore? Yeah, I would say in terms of that, I would say how extensive it can get into your systems and now seeing your internal knowledge and with accounting firms, right? Maybe with you and I, Isaac, like we're not hosting like, you know, Social Security numbers, birthdays and things like that. But for accounting firms, they might have all that knowledge internally. So like at some point you might expose that information.

Yeah. Yeah. So definitely they have a lot of information that other people might want, not only about themselves, but about all of their clients. And that kind of exponentially increases the, you know, the risks and the stakes, so to speak.

Exactly. Yep.

Yeah. Let's expand a little bit more on AI and ChatGPT because this is, of course, the buzzword of the last few years. It still, you know, hasn't really slowed down at all. If anything, it has continued to expand In people's minds, in people's conversations. It's definitely on everybody's, you know, head these days. As it relates to the use of ChatGPT and everything that that connects to, whether it is, you know, their own GPTs they use, or if you want to use ChatGPT's API to automate certain things, how does AI coming into the conversation change those practices that firms should follow?

Yeah, I would say that's the biggest question right now that is being asked at the moment since ChatGPT came out with the connectors from our clients. Because they don't know how to, you know, start going about this. The biggest thing is firms don't want to stay behind, so they don't want to just, you know, wait for a few accounting firms to test it out to make sure that it's safe. So we're kind of like in this world where we don't know what to do, right? And what I would say to anybody, you know, listening to this, I would say if you're a tech-forward accounting firm, you know, don't stay behind. Don't feel afraid to use these tools, ChatGPT connectors, Just be mindful of you know what type of information you're providing to the system. That discussion, I would say, make sure that if you start using Gen AI like ChatGPT, make sure that you have some type of language on the engagement letters from your for your clients that now you're using AI in some way to help you maybe make better decisions on the you know the tax returns or evaluate some of the financials because maybe you might already have some language in there in regards to maybe. The client portal and things like that. But now we're utilizing the intelligence with through AI to make some decisions there. So making sure that you're updating those engagement letters, but at the end of the day, right, don't rely fully on AI to give you that output or that, you know, solution. You still want the CPA to review whatever is coming out of that because that's how you, you know, keep that trust with your clients, make sure that they know that it's not robots, you know, working together to give you a solution. So.

Yeah. Kind of like keeping the human in the loop. That's kind of like a common term that's used in automation, keeping the human in the loop.

Yeah. I was listening to Jason Stasz the other day and that's kind of like what he was mentioning. It was like, it's going to become maybe less of the, it's not like it's going to replace us, right? It's not going to replace CPAs. Maybe it's going to make it easier for us in so many ways with, you know, the agents and the things working behind the scenes. But it's now going to be more about the interaction with clients, right? Like the person to person, just like we're talking, less than, you know, whatever happens on the backend.

Yeah, definitely. Okay. Well, let's talk about applications. Of course, cybersecurity really becomes a thing once we start. The more we store in the cloud, right? The more things we have available out there in the world of the internet. And one of the things that has come across for us is that there's specific certifications, regulatory requirements, International Standard Organization, and there's the ISCPA and the SOC. Like, there's a lot of terms that for the untrained person, they, you know, they don't really know which ones are actually useful. Could you talk to us a little bit about what are the certifications that matter when evaluating an app?

Yeah, so I would say when you're looking at a software as a service, You kind of can tell right away how mature the software as a service or like the app is in, you know, in the business based on looking at the website and seeing the privacy, if they have any certifications. So what I would say for any firm trying to vet third-party provider, which is actually something that we should be doing as an accounting firm, part of the FTC safeguard rules is saying that we have to evaluate third-party providers and making sure that we're making the right decision so that we know that when we put our clients' private information somewhere else, like a client portal, that it's protected. Make sure that you are looking at that language because through marketing, you know, you can kind of get confused. Some, some firms say, hey, we're SOC 2 certified, but they don't really specify if they're SOC 2 Type 1 or Type 2. Just so you know, like the Type 2 is basically telling the, you know, the consumer that they are actually continuously going through compliance. And it's not something that they maybe just get, you know, they become compliant once and maybe things are not constantly being monitored. Type 2, they take it a step further and they're actually really handling compliance the right way. I'm not saying that SOC 2 Type 1 is not compliant. It's definitely better than not having anything, but you always want to make sure that it's Type 2 to have the best security compliance.

Would you say that just for the people that might not be, you know, super versed with this, would you say that Type 1 and Type 2 is like B and A, or is it like A and A+? Is it like good enough and then great, or is it just like great and amazing? The difference?

I would say like good enough and, uh, and great, right? They still went through compliance. A lot of firms don't even have any, right? They don't even have SOC 2. You have to go through a lot of controls to be SOC 2 compliant, but they kind of like Type 2 is like they take it a step further and say, hey, we're doing everything that we can, we're doing our diligence to make sure that our Our clients are safe. They feel safe that we're doing the right thing.

Let me ask you this, and this is a little bit off script, but you as a firm, me as a firm that serves the accounting firm market, we are not software as a service. Is there any of those certifications that still applies to us as vendors? And is there any of those that we should look into and make sure we have in place or explore?

Uh, yeah. So I would say, well, I guess first for the accounting industry, They want to make sure that they're aligning with FTC safeguard rules, which is part of GLBA compliance. It's just a little portion of it. So it's not that they have to have the whole GLBA compliance portion of it, which is a lot of controls, but they just have to meet a certain portion of it. And that's something that it's required for them to have. So what we're doing with our clients is that we're providing them with a compliance as a service. And what we're offering them is we're actually giving them a trust center so that when they go, you know, their clients go to their website, they can have like a trust center just like you see with softwares, right? Like TaxDome, Canopy, all of these softwares have some type of like trust center where you click on it and it brings you to like the compliance. So what we're doing for accounting firms is they're seeing that and they're saying, hey, we are FTC Safeguard Rules compliant and these are all the controls that we're meeting and these are all our policies and this is why you should trust us, right? So that's what we're providing to them. With that said, right, like nowadays what we hear is like, hey Danny, can you provide us with like a WISP policy? A WISP policy is just a little portion of compliance. It's just kind of like a business plan for an accounting firm in terms of security. But what we come to find out is like we just fill this WISP policy, we put it, you know, in our drawer, and then we don't look at it again. Compliance is more of like, hey, let's continue doing something to make sure that we're aligning with what we're saying that we're doing. With us, like vendors, I would say ISO 27000 is a really good standard to follow. And just so you know, like all of these things, and you probably are familiar with this from like a programming language, it's like, yeah, if you, if you know Python, you're gonna get programming language really fast. With compliance, it's the same way. Like once you go through like ISO 27000 or like a GLBA or like a SOC 2, all of these controls in some way align with each other. It's just a matter of like you either have more controls that you have to meet or you have less controls. So—

There's a lot of overlap.

Yeah. So there's— yeah. So as long as you kind of go through one, like a certain framework of compliance, if you want to take it a step further, like, hey, I want to, I want to have this compliance, but it's not as much as this other one, you can still build onto it because now you want to go to a different level. And that's how like compliance works.

That's perfect. Okay. I guess as a last piece of advice, if an accounting firm owner is looking at this and thinking to themselves, perfect, Looks like I can automate. There's just some things I have to keep in mind. I'm aware of the risks, but I am also aware of the disadvantages of not using automations and AI technologies at all because, right, you don't want to be on either extreme. What are some steps that accounting firms can take to start, you know, getting a hold of cybersecurity?

Of like just data security in general, or?

Yeah, data security in general and also in the context of like Ensuring that whatever automation solutions, applications, integrations are secure as well.

I would say, you know, work with somebody like you, Isaac, or somebody that can help them take it, you know, zoom out a little bit and analyze the business and the processes for the organization, right? Like security, security is all about like really understanding how things are working in the organization. for example, like data flow, how the data flow is working in the organization, how do we know how to protect it? So I would say a quick and simple like exercise, and I'm sure you probably do some of this with your clients, is, hey, what are the processes that you're doing in the organization? Where's your data, right? Because from your perspective, like automating things, you want to know like where's data in the organization? How can I make this more efficient? So going through that process of like really listing down Different processes that the accounting firm is going through from like prospect to a client. What does that flow look like? Where does private information start coming into the organization? I would say that's— you don't need to really know security to be able to like go through this exercise. The business owner already knows this because, you know, it's their baby. So they know how their business works. It's just documenting that because eventually when they start working with you, Isaac, or they start working with me in the cybersecurity side of things, you're probably going to ask them the same questions. What, you know, do you have SOPs? Do you know how, you know, your data is flowing in the organization and things like that? So.

Yeah, no, I really like that. Typically we like to think about it as like process mapping and like, but really the way the workflows is the same way the data flows anyway. Right. So I think there's definitely a lot of overlap there. Um, okay. Tell us a little bit more about, um, how you help firms and where can people find you?

Yeah. So, um, anybody can find us on our, you know, on our website, tsquared.it. You can also find me on LinkedIn. My first and last name. So D as in David, Tobon, T-O-B-O-N. That's how I can connect with people. The way that we help accounting firms, we're a tech advisor for them. So we look at their systems, how things are working, and then based off of that, we can kind of come up with service plan for them. So it could be maybe they just want IT management, maybe they want reactive support, but then maybe accounting firms also is looking for more advanced cybersecurity or getting into the compliance journey, right? So I would say what I have found is when we start the firm, sometimes we don't have the foundations done in terms of compliance and cybersecurity. And the best way to go about this is really start diving into compliance. And I know you, that you work with EOS framework from like the business aspect of things. Think of it the same way with compliance. Like if we follow a framework, you know, although we might have like the shiny new object that comes in because there's a new app that come, you know, we're attracted to, or it's going to do this and that. With the compliance journey, it kind of keeps us on track of like, hey, this is what we should be going through. And if you need to evaluate an app, okay, here's the evaluation policy for this. So I would say start off with that, like the compliance journey. And then from there, you can start implementing technical controls. Because a lot of the times we get like the clients that are like, hey, we want mobile device management for our firm because I'm concerned that my employees or bad actors are taking information. But we come back to the question of like, okay, you want to enforce something technically, but we don't know what the policy is because the policy is not written down. So it's kind of like this mix of like there's no clarity there. But if you have the clarity with policies, the technical controls will come in play at some point.

Yeah, I think that's true about everything. To the degree that you can write down what are your thoughts, your policies, the way you do things, you know, coming in, plugging in a vendor who's going to help you out, they'll get that clarity on where you From the very beginning.

Exactly.

Yep. Perfect. Anything else that I didn't ask you that you would like to share?

No, I think we covered a lot. I appreciate you having me on. And this is a great topic. It's something that, you know, everybody currently concerned of. I would say with AI, right? Like right now we're just all living through this. We're all going through it. It's kind of like the internet. At some point we didn't know what to do with the internet, how to protect ourselves. We're still dealing with that right now. Like, hey Danny, can you help us protect ourselves with the internet? Now it's like AI and GenAI and like all these things. So like, uh, don't feel afraid to play around with it. And that way, like, you also don't stay behind because maybe another accounting firm starts utilizing these tools. So yeah.

Well, appreciate your time and thanks for sharing your wisdom with our audience.

Of course. Thank you. Thank you, Isaac.

All right.