AI and security for fiduciary and tax advisory firms
Client data, professional confidentiality and a closing season in which nothing can stand still. Where we start in fiduciary firms. And which recurring work can go first.
The situation
A fiduciary firm manages what clients least like to hand over: payroll, taxes, accounting, bank access. Much of it runs through email, portals and accounting software, and almost all of it passes through a few hands.
That is exactly what makes the industry a target for payment fraud. A forged payment instruction in a client's name, a payroll run with a changed account number, an attachment in an email that looks like any other. The damage hits not only the firm but the client's trust.
Then there is professional confidentiality. It applies regardless of which tool is in use, and today it also covers the question of which data flows into which cloud and which AI tool. Auditors and larger clients now ask about it specifically.
A fiduciary firm with twelve or thirty people is too small for a dedicated security position. The role is still needed. We take it on a mandate basis, start with what prevents the greatest damage, and stay until it works day to day.
What we find in this industry
- Payment runs and bank access in a few handsWhoever approves payments for clients is the most rewarding target in the firm. Without a four-eyes principle and clean access, one well-made email is enough.
- Email is the main channel, and email is the main attack routeReceipts, payroll, tax returns: almost everything comes in and goes out by email. In this industry, phishing looks like everyday work.
- Client data spread across software, portals and storageAccounting, payroll, document storage, bank portals, the cantonal tax portals. Who has access to what has grown over time and is rarely documented.
- Professional confidentiality applies to cloud and AI tooStaff copy client data into translators and chat tools because it is faster. Without a rule and an approved alternative, it keeps happening.
- The closing season cannot afford an outageAn encrypted server in February is a different matter from one in August. Whether the backup can be restored shows at the worst moment.
- Auditors and clients ask for evidenceLarger clients and auditors want to see proof of how data is protected. Every request is answered individually, because nothing is ready.
Where the time goes in fiduciary firms, and what we build there
These are the workflows we ask about in the first conversation, because we find them in fiduciary and tax advisory firms again and again.
Where the time goes
- Chasing documents, every yearThe same clients, the same paperwork, the same chain of reminders.
- Month-end closing prepared by handReconciling, coding, asking follow-up questions. Every month, for every client, by people who are too expensive for that work.
- Client knowledge held by one personWhoever looks after the client knows the history. Nobody else does.
- Deadlines tracked by handEvery firm has its list. And every firm has come close to missing one.
- The same question answered againThe same information for the fifth time, because the answer is filed nowhere.
- Reports built on requestThe client asks, somebody builds the report. Every time from scratch.
What we build
- Document request with a statusWho delivered what, what is missing, who was reminded when. Visible to everyone on the team.
- Month-end closing preparationOpen items, missing documents and questions for the client are prepared and waiting. Your people review and post instead of searching.
- Client dossierBefore every meeting: history, open items, last decisions. Readable for the stand-in too.
- Draft answers for standard questionsBuilt from your earlier answers and your own documents. You review and send.
Where we would start: Start with the month-end closing preparation. The effect is measurable at the next closing, and you have the baseline from the last one. Client data and professional confidentiality set the frame: we settle before the start which data which model may see, and we put it in writing.
Typical trigger
A forged payment instruction almost gets through. Or a large client sends a security questionnaire before renewing the mandate, and the answers first have to be worked out.
The ODCUS difference
No selling of additional tools. The first step is always: what do you already have, what of it works, and what can we cut? Most mandates start by reducing cost and improving protection at the same time.
Why these services fit
First close the places where money is lost
At a fixed price we assess the current state: payment approvals, email protection, access, backup. Prioritised by what does the greatest damage in a fiduciary firm, not by a product catalogue.
The duplicate tools and unused licences found along the way often pay for part of the measures.
Access, email and approvals under control, without disrupting the season
We put accounts and permissions in order, harden Microsoft 365, introduce the four-eyes principle for payments and define which data may go into which tools. Implemented outside peak periods.
Your people stay with the clients. We work through the backlog and hand over so that it does not build up again.
An answer for auditors and clients that is ready
A lean ISMS documents once how client data is protected, and so answers auditor and client questions without searching from scratch every time.
Where a client requires ISO 27001, we support you through to the certificate. In most cases the provable state is enough.
A responsible person you do not have to hire
One to two days a month: set priorities, steer the IT provider, build staff awareness, report to management. The role that is almost always missing in fiduciary firms.
The mandate can be adjusted once the program is in place. No position, no long-term commitment.
Who it is for
- Fiduciary, tax and accounting firms from around ten employees without an in-house IT role
- Firms that execute payments and payroll runs for clients
- Fiduciaries who want to use client data with AI tools too, without breaching professional confidentiality
- Firms whose auditors or large clients ask for evidence
Related engagements
- Microsoft 365 hardening: email protection and access at a services company
- Privileged access put in order: who may do what, traceably
- Ransomware recovery after full encryption
Anonymised looks at real engagements. Not all of them come from this industry, but the task is the same.
FAQ
We are twelve people. Is that not too small for security leadership?
For a full-time position, yes. You still need the role, because you carry the full risk with client money and professional confidentiality. One day a month is often enough to close the most important gaps and steer the provider.
May we put client data into AI tools at all?
Only with rules that fit professional confidentiality: which data, which tool, which data location, which contract. We define that before the first use. For particularly sensitive data there is the option to run it in house.
What is the first thing we should do?
Payment approvals with a four-eyes principle, and a second factor on every account that can reach client data. Both are done in days and prevent the incidents that most often cost real money in this industry.
Let us talk about your situation
Thirty minutes, free and without obligation. We tell you honestly whether and where we can help.