The Control You Think You Have Might Not Hold Up
You're doing what responsible firms do.
You have backups.
You have security tools.
You have processes in place.
On paper, everything looks fine.
But here's the gap most firms don't see:
The difference between a control that exists…
and a control that has been proven to work under pressure.
That's where problems show up.
Where the Breakdown Usually Happens
Firms don't ignore risk. They assume controls are working.
What we see in many CPA environments is consistent:
- Backups are
running, but no full restore has been tested
- Microsoft 365
email or SharePoint isn't included in backup scope
- Permissions are
set, but haven't been validated after a restore
- Success reports
are trusted, but never verified
It all looks stable.
Until you try to use it.
What Firms Assume vs Reality
This is where the disconnect becomes clear.
Assumption | Reality
Backups = protected | Scope gaps are common
Restore = fast | Often hours, not minutes
Permissions persist | Frequently break after restore
"Successful" alerts = reliable | Doesn't prove usability
Most firms aren't wrong.
They just haven't tested the system the way it actually fails.
A Real Scenario Most Firms Recognize
March deadline week.
Your team is deep in UltraTax.
A key return file becomes corrupted.
You go to restore.
What should take 20 minutes stretches into half a day.
Then longer.
Because:
- The working tax
directory wasn't included in the backup
- Related client
documents from SharePoint weren't covered
- Permissions had
to be rebuilt before anyone could access the files
Now your team is recreating work under pressure.
Clients are waiting.
And the issue isn't technical.
It's whether the firm can deliver.
What We Typically Find
Across CPA firms, the patterns are consistent:
- Backup jobs
missing pieces of the environment (email, SharePoint, client portals)
- Local-only
backups without an offsite or immutable copy
- Restore times
far longer than leadership expects
- Permissions
breaking during recovery
- No audit trail
for sensitive file access
This shows up often enough that it should be assumed—not treated as an
exception.
What a Successful Restore Actually Looks Like
This is where firms need clarity.
A restore is only successful if it meets specific criteria.
Pass / Fail Criteria
✅ All files restore completely —
nothing missing
✅ Restore completes within a defined
time window
✅ Permissions remain intact — no manual
fixes needed
✅ End users can log in and continue
working immediately
❌ Missing data or folders = failure
❌ Restore takes more than 2 hours for a
critical system = unacceptable
❌ Permissions require rebuilding =
operational risk
❌ No documented process = not a real
control
If you can't clearly mark a restore as pass, it's not something you can
rely on.
Recovery Benchmarks That Matter
Strong firms don't guess recovery time.
They define it.
- Critical
systems (tax software, shared drives): under 60 minutes
- File-level
restore (single return or folder): under 15 minutes
- Full
environment recovery: under 4 hours
These aren't IT targets.
They're operational expectations.
Anything slower directly impacts deadlines and client trust.
How to Test a Backup (15-Min Version)
You don't need a full audit to get clarity.
Do this with one system:
- Pick a critical
system
- UltraTax data,
shared drive, or client document storage
- Restore it to a
separate location
- Never test in
the live environment
- Verify:
- File
completeness
- Timestamps
- User access
- Measure total
recovery time
- Mark the
result:
- Pass or fail
That one test gives you a real answer.
What to Fix First
When gaps show up, don't try to fix everything.
Prioritize this way:
- Backup coverage
gaps
Missing systems create the highest risk - Restore time
issues
Slow recovery breaks operations - Permission
integrity problems
Data without access doesn't help - Audit logging
gaps
No visibility means no accountability
This is how you reduce risk quickly without overcomplicating it.
What Happens When a Test Fails
This is where most firms get stuck.
They identify a gap—but don't act with urgency.
When a test fails:
- Expand backup
scope immediately if data is missing
- Re-run the test
within 48 hours
- Document the
failure and the fix
- Escalate if
recovery time exceeds your defined thresholds
A failed test is not a problem.
An unaddressed failure is.
How Often This Should Be Tested
Testing once doesn't change much.
Consistency does.
- Monthly:
file-level restore
- Quarterly: full
system restore
- Annually: full
environment simulation
That cadence turns this into a real control.
The External Lens: What Auditors and Clients Expect
When an external party evaluates your firm, they aren't asking if
controls exist.
They're looking for proof.
They expect to see:
- Documented
restore tests
- Defined
recovery time targets
- Evidence of
repeatability
- Clear ownership
This level of validation aligns with the expectations firms are held to
during audits and data security reviews.
What Documentation Should Actually Look Like
Most firms intend to document.
Very few make it usable.
Here's the minimum:
System: UltraTax shared drive
Last test: [date]
Result: Pass / Fail
Recovery time: [minutes]
Issues: [list]
Owner: [name]
Next test: [date]
If you can't pull this up quickly, the control isn't defensible.
Who Owns This
This only works if someone owns it.
Not a department. A person.
- IT provider
supports the system
- Internal owner
validates the result
- Partner holds
accountability
Without clear ownership, this doesn't get done consistently.
What to Do Next Week
Keep this simple and real:
- Choose one
critical system
- Schedule 30
minutes
- Assign a single
owner
- Run a restore
test
- Record:
- Time to
recovery
- Pass/fail
result
- Any gaps
- Fix the first
issue immediately
That's enough to move from assumption to control.
Closing Thought
You've already built something your clients rely on.
This isn't about adding more tools.
It's about proving what you already have will hold when it matters.
That's what actually protects the firm.
CTA
Schedule your 10 minute discovery call to validate whether your current
controls actually hold up under scrutiny. We'll test one point together so you
can see where you stand before this turns into a bigger problem. 911 IT
