The software vendor
Forms, calculations, yearly versions and functional support. The vendor answers for a return that will not transmit.
Accounting firms
IT for accounting firms in Quebec
An accounting firm runs on a calendar everyone knows. From February to the end of April, every hour of downtime is made up in the evening or on the weekend. The rest of the year, client files sit on your systems, and professional secrecy does not take time off.
An accounting firm expects four things from its IT: workstations and tax software that hold up through tax season, a way to exchange documents with clients other than plain email, access to client files that is controlled and logged, and a backup that has been restored for real before January.
What kind of IT does an accounting firm need?
An accounting firm needs IT that protects confidential information all year and does not give out between February and the end of April. Tax returns, payroll files and financial statements are exactly what a client expects to stay private. OKTO Solutions, whose office is in Trois-Rivières, offers accounting firms in Quebec patching for Windows and installed software, multi-factor authentication, Microsoft 365 management, fleet monitoring and a daily backup with an off-site copy. The Code of ethics of chartered professional accountants asks a CPA to take reasonable measures to protect confidential information at every stage: preparation, storage and transmission. OKTO’s services are technical measures that support that obligation; they do not replace it. There are three plans: Base, Standard and Complet. Employee support starts with the Standard plan, and the 24/7 emergency line is included in the Complet plan. By default, data at rest stays in Canada.
Professional secrecy
What does professional secrecy require from a firm’s systems?
The Code of ethics of chartered professional accountants, in the version in force since May 9, 2024, says it in two sections. Section 39 states that a CPA is bound by professional secrecy. Section 40 adds that at every stage of preparing, storing and transmitting information, the CPA takes reasonable measures to protect it, in particular with regard to the persons who work with them.
An IT provider is one of those persons. It sees your servers, your mailboxes, your backups. The guide to good IT practices published in French by the Ordre des CPA du Québec includes a self-assessment, and three of its questions are aimed at that provider. Has the consultant who can reach your clients’ data signed a confidentiality undertaking? Is the data hosted on Canadian soil, and is the provider Canadian-owned? Are the backup copies encrypted or protected by an adequate password? On the second one, let us be precise: with OKTO, data at rest stays in Canada by default, but Microsoft 365 and Azure belong to Microsoft, an American company.
On the technical side, that translates into familiar measures: one account per person, multi-factor authentication everywhere, permissions limited to the files each person needs, encrypted laptops, and a log that says who opened what. The day a client asks what happened to their file, you answer with a log, not with guesses.
Law 25 comes on top of the Code for any personal information, and our managed cybersecurity puts these measures in place. OKTO is not a law firm, and not an auditor either: we install the protections, you answer for your obligations.
An unusual sign-in is revoked, and the log establishes what was viewed, copied or changed.
Tax season
How do you get a firm’s IT ready before tax season?
For the 2025 tax year, the Canada Revenue Agency sets the filing deadline at April 30, 2026 for most individuals and June 15, 2026 for the self-employed. Since January 1, 2024, a preparer paid to prepare more than five returns in a year must file them electronically. Without a network or software, a firm produces nothing.
| Period | At the firm | What gets settled then |
|---|---|---|
| October to December | A quieter stretch, seasonal hires coming up | End-of-life workstations replaced, a restore test, a review of who can open which files |
| January | New versions of the tax software, temporary staff arriving | Updates installed and checked, accounts created with the right permissions, workstations prepared |
| February to April | Long days, work from home in the evening | No change that can wait; monitoring, support and security patches only |
| May and June | Self-employed clients, seasonal contracts ending | Accounts of departed staff closed the same day, laptops collected |
| Summer | Vacations, few deadlines | Projects: a migration, a new server, a cleanup of shared folders |
This is the calendar we suggest; it adjusts to your year-ends and to your assurance engagements. Day-to-day follow-up is described on the managed IT services page.
Client documents
How do you exchange documents with clients without emailing everything?
Slips, statements, notices of assessment, financial statements: in March, all of it arrives as attachments, often from a personal address. The Ordre’s guide is blunt about it: without encryption, email does not ensure the confidentiality of the information exchanged.
The same guide offers two routes. Protect the attachment with a password sent by another channel, or use a secure delivery platform. It also asks the CPA to agree with the client on the use of email, and to obtain express consent before documents covered by professional secrecy travel that way.
In practice, a firm has three options. The portal offered by its software vendor, when there is one. A sharing space in Microsoft 365, with one folder per client and a link reserved for the invited person. Or a portal built for the firm.
- Our Microsoft 365 management sets up external sharing and removes links open to anyone
- Email protection keeps someone from writing to your clients while spoofing your domain
- Our team develops custom client portals when off-the-shelf tools do not fit
In SharePoint, a link open to anyone is removed and the file goes back to the group that should see it.
Backup
How many hours of work can a firm afford to lose?
In August, losing a day of data entry is a nuisance. On April 27, it is a stack of returns to redo before the deadline. The same failure does not cost the same depending on the month.
That is why recovery objectives are set system by system, and reread in the fall. Two questions are enough. How many hours of work do you accept to redo? How long can the firm go without its tax software? The answers dictate how often copies are taken.
At OKTO, backups run daily in all three plans. On the Complet plan, critical systems are copied several times a day. One copy is kept off site and cannot be altered, which matters when ransomware goes after the backups first. Two restore tests a year come with the Standard and Complet plans. The right time for the first one is before January.
If your files live in Microsoft 365, the recycle bin is not enough: see our page on Microsoft 365 backup. The rest is described under backup and disaster recovery.
Accepted loss on the left, accepted downtime on the right: tightening the objective for accounting changes how often copies are taken.
Tax software
Taxprep, DT Max, Caseware: who looks after what?
Tax preparation and working paper software belongs to its vendors, who publish the versions for each tax year. OKTO sells none of it. The only software it sells is OKTO PSA, a Quebec-made ERP and CRM.
OKTO Solutions
Installation and updates on workstations, the server or the hosting of the databases, access rights, backup and printers.
The firm
The choice of software, licences in its own name, file retention rules and the decision on who sees which client.
Is a partner already looking after IT? That person can keep the practice software and leave monitoring, security and backups to us. That is the idea behind co-managed IT. And if nobody knows what state your environment is in, a cybersecurity audit covers it in six areas.
Questions and answers
Questions partners of a firm ask
Is an outside IT provider compatible with a CPA’s professional secrecy?
The Ordre’s guide allows for it: its self-assessment asks whether the consultant who can reach your clients’ data has signed a confidentiality undertaking. The Code of ethics, for its part, asks a CPA to take reasonable measures with regard to the persons who work with them. Ask any provider for a written confidentiality undertaking, named and logged access, and the place where your data is hosted. Professional secrecy itself remains your obligation.
Do our client files stay in Canada?
By default, yes. Microsoft 365 is deployed in the Canadian tenant, Azure resources sit in one of the two Canadian regions, and backups stay in the country. Any exception is documented in writing before it is applied. Microsoft remains an American company, though: the Ordre’s self-assessment also asks whether the provider is Canadian-owned, and that is for the firm to weigh. Finally, check where the vendor of your tax software hosts its online services: that part does not depend on us.
What happens if a workstation fails in the last week of April?
The request is ranked by impact. A firm that is completely stopped is handled first, with a target of 15 minutes; for a single person who is stuck, the target is 4 hours. These are targets, guaranteed by the service level agreement on the Complet plan. Most failures are fixed remotely.
Do you install and update our tax software?
Yes for installation and updates on your workstations, as with your other applications. Forms, calculations and functional support belong to the vendor. OKTO does not sell this software and is not a tax practice.
How do we handle staff hired only for tax season?
Like any arrival and departure, but planned ahead. The account is created from the role, with only the access that role needs, and everything is recorded. When the contract ends, access is closed everywhere the same day and the laptop comes back. The method is described on the employee onboarding and offboarding page.
Can we work from home in April without exposing client files?
Yes. What protects you is knowing who connects, from which device and which data they reach, and being able to shut that access off quickly. Multi-factor authentication and a firm-owned laptop, encrypted and managed, beat a family computer. See our page on secure remote work.
Is your firm ready for the next tax season?
Tell us how many people work at the firm in April, which software you use and when a restore was last done. We tell you what is left to settle before January.
Reviewed by Antonio Pazzi, president of OKTO Solutions · updated