IT support for accounting firms through tax season
A change freeze through filing season, working papers and backups kept in Canada the way the CRA expects, and a recovery plan written for April 20. For CPA firms and bookkeeping practices running TaxCycle, CaseWare, Sage 50 and QuickBooks.
What breaks in an accounting firm, and when the firm cannot afford it
An accounting practice runs a calm business for nine months and a sprint for three. Between February and April 30 every partner, every preparer and every client portal has to work, and a Tuesday outage in March costs the firm what a week costs in August.
The failures we see are not exotic: a tax application that stops talking to its licence server after a Windows update, a shared drive that locks because someone opened a file from a laptop at home, a client portal that times out on upload day, email full of attachments that should never have been emailed, and a backup that has been reporting success for a year without anyone restoring a file from it.
We set accounting firms up around the calendar. Updates to TaxCycle, CaseWare and the operating system are staged in January and frozen through filing season, so nothing changes under a preparer in April. Monitoring thresholds tighten in February. On-site visits are scheduled before the rush rather than during it. And the recovery plan is written with one question in mind: if the server dies on April 20, what is the order of operations that gets the firm filing again by the afternoon.
CRA record rules, data residency and the question nobody asks their cloud provider
The Canada Revenue Agency requires business records to be kept for six years from the end of the tax year they relate to, and it requires them to be kept in Canada. The CRA’s own guidance adds a line that catches firms out: records stored outside Canada and accessed electronically from inside Canada do not count as records kept in Canada, unless the CRA has given written permission. For a firm that has moved its working papers to a cloud service with no idea where the data centre is, that is a problem that surfaces during an audit rather than before it.
We treat data residency as a procurement question and answer it in writing before anything is moved. For every storage and backup option we quote, we state where the data is physically held and whether a Canadian region is available. Microsoft 365 tenants can be homed in Canada; backups can be kept in Canadian data centres; a file server can stay in the office with an off-site copy that is also in Canada.
Where a vendor cannot say where your data lives, we tell you, and the firm decides with the facts in hand.
Beyond the CRA, a CPA firm answers to its provincial body’s rules on confidentiality and to PIPEDA, which requires that breaches creating a real risk of significant harm be reported to the Privacy Commissioner and to the people affected, with a record of every breach kept for 24 months. No regulator certifies IT providers, and we make no such claim. What we provide is the set of controls those obligations assume: encryption on every laptop that leaves the office, multi-factor sign-in on email and the portal, access that ends the day a staff member leaves, and the evidence to show an insurer or a client that the controls exist. Wolters Kluwer’s survey of Canadian firms found only about half use a proper document management system, which means half are running on shared drives and email attachments, and that is where most of the risk lives.
Accounting software and systems we support
The Canadian tax and assurance stack is specific and we support it as such: TaxCycle, ProFile and Cantax for returns; CaseWare Working Papers and CaseWare Cloud for assurance; Sage 50 Canadian Edition, QuickBooks Desktop and QuickBooks Online for bookkeeping clients; Xero and Dext for cloud bookkeeping; and a client portal such as CCH Axcess, TaxFolder, Karbon or a SharePoint-based exchange. Several of these still run as desktop applications against a shared database on a file server, which is why the server, the network and the backup matter more in an accounting firm than in most offices of the same size.
Around them sit Microsoft 365 for email and documents, a practice management tool, scanners feeding a document system, and the two or three legacy applications every established firm keeps for old clients. We hold vendor support contacts for the major applications, so a licence server fault or a database error goes to the vendor with the network, the server and the workstation already ruled out.
Where the firm is ready, we move the file server to a hosted or cloud model, keeping the data in Canada, and where it is not we keep the server healthy, patched and backed up with a replacement date on the calendar rather than a surprise. Windows 10 reached end of support in October 2025, and any preparer still working on it is a risk an insurer will ask about.
What the managed plan covers for an accounting firm
The managed IT plan is priced per user per month and covers unlimited remote help desk, on-site visits across the GTA, endpoint protection, email filtering, multi-factor setup and Microsoft 365 backup. For a practice that translates into a few specific outcomes.
- A change freeze through filing season, with updates staged in January and the help desk briefed on what the firm runs.
- Backups of the file server, the working papers database and Microsoft 365, kept in Canada, with a test restore each quarter and a written recovery order.
- Security controls that answer the cyber-insurance questionnaire and a client’s due diligence: MFA everywhere, monitored endpoint protection, email filtering and encrypted laptops.
- Microsoft 365 homed in Canada, with shared mailboxes per engagement, secure file sharing instead of attachments, and licences removed the day someone leaves.
- Server care for the application server most firms still depend on, with a replacement plan rather than an emergency.
- A firm network with a managed firewall, VPN for partners working from home, and Wi-Fi that keeps the boardroom off the working-papers segment.
Work with a clear start and finish is quoted as a project before anything begins. For accounting firms that is usually one of these.
- File server replacement or move to a Canadian-hosted server before filing seasonFixed quote
- Document management rollout to replace shared drives and email attachmentsFixed quote
- Client portal setup with secure upload and signature workflowFixed quote
- Windows 10 workstation replacement across the firmFixed quote
- Merger or acquisition of another practice: accounts, data and licences brought acrossFixed quote
What we set up for a typical 15-person CPA firm
Take a firm of three partners, nine staff and three seasonal preparers, running TaxCycle and CaseWare against a server in the office, QuickBooks Desktop for a dozen bookkeeping clients, and Microsoft 365 for everything else.
The server is kept on a supported Windows Server version with the application databases on it, backed up nightly to a local appliance and to a Canadian data centre, with the backup copy immutable for 30 days and a restore tested every quarter. Every laptop is encrypted, enrolled in device management and protected, so a partner’s machine left in a taxi is a nuisance rather than a breach report. Microsoft 365 is homed in Canada with multi-factor sign-in enforced, email filtering in front of it and the tenant backed up; client documents move through a portal or a secure share rather than as attachments. Seasonal preparers get accounts in January that expire on May 15. The firm’s firewall is managed, with VPN for the partners who review files from home, and the boardroom Wi-Fi cannot reach the server. Updates are staged in January and frozen from February 1 to May 1. The firm answers its insurer’s renewal questionnaire from a document we maintain, and if the server fails on April 20, the written recovery order has the preparers working from the previous night’s copy by early afternoon.
Where we support accounting firms
On-site visits are included in the managed plan across the GTA. Accounting practices we support are concentrated in Toronto, in the Financial District, midtown along Yonge and Eglinton, and the professional buildings of North York and Scarborough, in Mississauga around the City Centre and Dixie corridors, in Vaughan along Highway 7, and in Oakville. Markham, Richmond Hill, Brampton and Etobicoke firms are covered on the same terms, and partners working from home anywhere in Ontario are supported remotely under the same plan.
Questions people ask
Can you guarantee nothing changes during tax season?
We can commit to a change freeze. Operating system, application and firmware updates are staged in January and held from February 1 to May 1 unless a security fix cannot wait, in which case we tell the partners first and schedule it outside working hours. Monitoring runs throughout, and the help desk is briefed on the firm's applications before the season starts.
Where will our client data be stored?
Wherever you decide, with the location stated in writing for every option we quote. Microsoft 365 can be homed in Canada, backups can be kept in Canadian data centres, and a server can stay in your office with an off-site copy that is also in Canada. The CRA's position is that records stored abroad and accessed from Canada do not count as records kept in Canada, so we treat this as a decision the firm makes with the facts, not a default.
Do you support TaxCycle, CaseWare and ProFile?
Yes, along with Cantax, Sage 50 Canadian Edition, QuickBooks Desktop and Online, Xero, Dext and the common client portals. We support the server, network and workstations they run on and hold vendor contacts for the applications, so a licence or database fault reaches the vendor with everything else already ruled out.
What does managed IT cost for a 15-person firm?
The managed plan is $125 to $175 per user per month. Seasonal preparers who have an account for three months are billed for the months they are active. Servers, firewalls and other hardware are quoted separately, and a server replacement or document management rollout is a fixed-price project agreed before work starts.
Our insurer sent a cyber questionnaire. Can you answer it?
We answer the technical sections with you from a document we maintain about your controls: multi-factor sign-in, endpoint protection, backup immutability and testing, patching schedule, encryption and email authentication. Where a control is missing we say so and quote what it would take to add it before renewal.
We still have a server in the office. Should it move to the cloud?
Sometimes. Several Canadian tax and assurance applications still run best against a local server, and a well-kept server with a Canadian off-site backup is a sound setup. When the server reaches end of life we lay out both paths, a replacement server or a Canadian-hosted one, with costs and data location for each, and the firm chooses.
Tell us what’s going on
Pick how urgent it is and leave a way to reach you. The help desk replies by phone or email. If work has stopped, call 647-812-3775 instead.
Something broken, or something to plan?
For anything urgent, call. A technician answers the emergency line 24/7. For everything else, open a ticket and tell us what is going on.