On a first engagement with a firm of 20 to 100 staff, the work is built to surface defects of a shape self-assessment rarely catches. For example:
- 01A practice-management or ledger service account — Xero Practice Manager, MYOB Practice, CCH iFirm, or your equivalent — with broad read/write across client files, a password years old, and no place in the firm’s MFA, conditional-access or offboarding routine.
- 02A signed and paid backup contract with no documented restore test on file: the piece of evidence cyber-insurance underwriters ask for at renewal, and the record the firm would need after a ransomware event in tax season.
- 03Client-portal and document-exchange links that outlived the engagement or the staff member who created them, including shares on tax returns and financial statements that were never set to expire.
- 04Mailbox-forwarding rules and inbox delegations left in place after a staff departure, on accounts that receive clients’ bank statements and ATO correspondence.
The output is a written report a managing partner can table with the partners, with the MSP section forwardable to the account manager without an edit and the evidence kept for the next renewal.