WorkAuditor Blog

Employee monitoring for accounting firms is best understood as an internal control: a mechanism that protects client financial data, documents who saw what, and gives the firm evidence that its people are working where and when they should be. I am the operations and IT director for a 40-person firm that runs tax, audit, and advisory practices, and in twelve years of tax seasons I have learned that monitoring in this industry has less to do with catching anyone and more to do with what an auditor, a regulator, or a client's security questionnaire will ask you to prove about your own environment.

Why a CPA firm cannot afford blind spots

Everything we touch is someone else's confidential financial data — payroll files, bank statements, business tax returns, and internal management accounts of firms that would be damaged competitively if that material moved. Our firm is subject to professional standards that expect reasonable internal controls over client information, and our audit clients increasingly send us their own vendor assessments, asking pointed questions about who can access their data, how access is logged, and what happens on the endpoints those people use.

A monitoring program answers those questions in a way a trust-based policy cannot. When a client asks whether we can demonstrate that only the assigned engagement team saw their trial balance, we want to say "yes, and here is the access log," not "we assume so." Monitoring is the evidence-gathering function of the firm's data security program.

Monitoring as an internal control

We structure our monitoring around four controls that map directly to what regulators and clients care about:

• Access logging on client data. Every open, export, download, and print of a client file is recorded against the licensed user who did it, with matter and client identifiers.
• Workstation activity tracking. Application and website usage during the workday, so personal activity is visible and the firm can demonstrate reasonable supervision of the work environment.
• Time and activity verification. Billable time capture tied to the work log, so the productivity story matches the security story on the same data.
• File movement control. Policies and flags around USB transfers, cloud uploads to personal accounts, and email forwarding of client data outside the firm's domains.

The design principle is that none of this captures the substance of client records. We track that a file was accessed, not what it contains — the same boundary that keeps our monitoring defensible both to employees and to professional standard reviewers.

Scenario: tax season file handling

The scenario that validated our design happened in the middle of the busiest week of the season — April 8, with 214 returns still in process and the extended-deadline pile building. A manager in our tax group noticed that an associate was repeatedly downloading entire client workpapers from the shared engagement folder to a personal OneDrive account "to work on them from home." The file movement logs flagged the behavior automatically: 23 files, including two full client binders, moved to an external cloud destination within 48 hours.

We approached it as a data security issue, not a trust accusation. The associate turned out to have taken the files to prepare extensions on her home computer, a workflow she had used for years without anyone noticing because the old policy had no visibility. We gave her a firm-issued encrypted drive and a VPN-enabled remote desktop session instead, and added a standing rule that client data moves only through approved channels. The monitoring did not just detect a risk; it converted an undocumented habit into a documented, secure one. That is the best outcome this kind of control can produce: the person was doing legitimate work the wrong way, and the system made the right way easy.

Time tracking that doubles as billing evidence

The second scenario is about the productivity half of the same system. Public accounting runs on billable hours, and our firm reconciles time entries against monitoring data at the engagement level. During a summer audit engagement last year, the audit team's weekly time summary showed one senior associate charging 31 hours to the engagement while the activity logs showed a consistent 22 hours of substantive work on the client's systems. The gap was not dishonesty — it was meeting time, internal reviews, and training time coded to the engagement because the real codes were obscure.

The fix was classification, not confrontation: we rebuilt the activity codes, added a "non-client admin" bucket, and started running a weekly variance report between charged hours and monitored activity. Variances above a threshold trigger a code review rather than a conversation about honesty. Since then, our billed-hour accuracy improved noticeably, and one client's fee dispute — which had dragged on over "how many hours did this really take" — settled from the monitoring data alone. In a profession where the product is time, monitoring is the instrumentation behind the invoice.

What the engagement file shows auditors

There is one more reason we keep the monitoring disciplined and documented: professional standards and client audits ask for control evidence, and a haphazard monitoring setup is worse than none. We maintain a control document that describes what is collected, why, who has access to the data, and the review calendar — and we treat it as part of the firm's internal control file that gets refreshed each year. When a client's internal audit team requested evidence of our data access controls last year, the control document plus a sample access log closed the request in one exchange.

The balanced setup

If you are designing monitoring for an accounting firm, remember the seasonal reality: your tool must handle tax season spikes without becoming a performance drag, and it must be configurable so that client-file handling is watched more closely than routine email. We run WorkAuditor, a cloud-based employee monitoring software for Windows and Mac, with its application and file activity reporting wired to our engagement and time systems. The monitoring layer stays deliberately thin — the point is evidence, not surveillance theater.

What would your firm's file movement logs show about last busy season — and could you defend every one of those transfers to a client's security team?