Risk assessment report
Findings rated Critical, High, Medium or Low, with a short "why it matters" for the serious ones. Short enough to read in 20 minutes.
security risk assessment
A CLEAR SECURITY RISK ASSESSMENT FOR YOUR ACCOUNTING OR TAX FIRM.
One interview. A plain-language report on where your firm stands and what to fix first. This is where your security plan begins, with an assessment of your firm's data security risks. Your written information security plan is included.
Please don't include client names or tax information. I use your details only to reply.
No payment to start. We talk first.
- $500 flat, launch price
- About an hour of your time
- Plan included
What I cover
Fourteen Areas, One Interview
- Business and information asset inventory
- Data handling and storage
- Administrative and technical safeguards
- Access control and authentication
- Endpoint and network security
- Backup and recovery
- Vendor and third-party risk
- Existing policies and procedures
- Regulatory requirements and identified gaps
- Incident readiness
- Security awareness and training
- Data retention and disposal
- Remote work, home office and physical setup
- Tax and accounting software and e-file handling
What a risk assessment is
A risk assessment answers three questions: what information you hold, what could go wrong with it, and what you already do about it. The result is a ranked list of gaps you can act on, plus a record that shows you took security seriously by addressing the gaps.
For firms that handle client tax and financial data, that record matters. The IRS expects tax professionals to have a written information security plan, and the FTC Safeguards Rule sets requirements for many financial businesses, including tax preparers. A plan is stronger when it rests on a real assessment of your firm.
Vendor compliance, included
For each vendor you rely on, I check what the vendor itself publishes about security and breach notice, record the source and the date, and compare it with how your firm has it set up, for example whether MFA is actually enforced. Gaps become findings with actions.
This is a check of published information, not an audit of the vendor.
What you receive
Four Deliverables, Written in Plain Language
Custom WISP
Written from your findings. Each finding points to the plan section that addresses it.
Implementation guide
What to do, in what order, and how you'll know it's done.
Walkthrough and one revision
We go through it together, and I update it once within 14 days.
How it works
Four Steps
- Step 1
Intro call
We talk about your firm and whether this fits. No payment yet.
- Step 2
Agreement and invoice
If we both want to go ahead, I send a short engagement agreement and an invoice.
- Step 3
Interview
60 to 90 minutes by phone or video. I fill in the questionnaire as we talk. No passwords, client names or return data.
- Step 4
Delivery
By encrypted email within five business days of the interview, followed by a walkthrough.
Pricing
$500
One time. Launch pricing.
One price, complete package
- Risk assessment, custom WISP, vendor check and implementation guide
- Walkthrough and one revision within 14 days
- Paid before the interview
- The assessment alone costs the same $500
- No subscription, no auto-renewal
Larger or multi-location firm? Ask me for a quote.
Request an Intro CallFAQ
Questions About the Risk Assessment
How long does it take?
About 60 to 90 minutes of your time for the interview, plus a short preparation sheet.
What do I need ready?
A list of the software and devices you use, who has access, and where client files go. The what-to-prepare sheet walks you through it.
Do you need access to our systems?
No. I look at a setting by screen share only if you agree, and I never receive passwords or client data.
How do I receive the report?
By encrypted email.
Can I buy it with an existing WISP?
Yes, for the same price. The assessment is the real work, and I’ll show where your plan matches your practice and where it doesn’t.
What if my firm changes?
New staff, a new office, or new software that holds client data are good reasons for a fresh look. Just ask me and I’ll review it with you.