Co-managed IT for accounting firms with internal IT.
Co-managed IT for accounting firms means VJNetworks works alongside the IT person you already employ instead of replacing them, covering the security, compliance and filing-season depth one internal hire cannot carry alone.
with no firm-size floor
One person can run a firm’s IT. One person cannot also be a security program.
The IT person at a twenty-seat CPA firm is usually very good and completely buried. They know which partner still keeps a mapped drive, why the scanner in the file room needs a reboot every other Tuesday, and how long the tax software takes to push an update across the office. That knowledge is worth real money and none of it is written down. Then February arrives, the queue triples, and everything that isn’t a broken workstation quietly stops.
What stops first is almost always the compliance work. Not because anybody decided to skip it. It just has no deadline that shouts, so it loses every argument with a partner who can’t print. Our co-managed IT services exist for exactly that shape of problem, and this page is the accounting version of it, sitting alongside our broader IT for accounting and CPA firms work.
Firms tend to assume the fix is a second hire. Sometimes it is. More often the gap isn’t hours, it’s range, because the missing pieces are a written security program, identity configuration across half a dozen platforms, a recovery plan somebody has actually tested, and coverage on the weekend before a deadline. That’s four specialties and one salary. We wrote up the seasonal side of this separately in our tax season IT checklist for accounting firms.
Federal law puts a named person on the hook. Usually it’s your IT person.
Tax preparation firms are financial institutions under Gramm-Leach-Bliley, which is why the FTC Safeguards Rule lands on a fifteen-person practice the same way it lands on a lender. Separately, the IRS restated in August 2026 that federal law requires tax and accounting professionals to create and maintain a Written Information Security Plan. There’s no return-count threshold under it. Small firm, same plan.
The Qualified Individual
Section 314.4(a) says the person overseeing your program may be employed by you, an affiliate, or a service provider. So it can be your IT person, or ours, or both in a split. Three duties stay with the firm no matter which way you go. You keep responsibility for compliance, you name a senior person to direct and oversee, and you require the provider to run a security program of its own.
What the small-firm exception drops
Four paragraphs, and only four. If you hold customer information on fewer than five thousand consumers, section 314.6 lifts the written risk assessment at 314.4(b)(1), the continuous monitoring or testing regime at (d)(2), the written incident response plan at (h), and the annual written report at (i). Count your 1040 clients before you assume you’re under it.
What survives regardless
Everything an attacker actually touches. Multi-factor authentication for any individual reaching any information system under 314.4(c)(5), access controls, encryption of customer information in transit and at rest, secure disposal, staff security awareness training, written vendor selection and periodic vendor assessment, and the thirty-day notice to the FTC when an event reaches five hundred consumers. None of that has a small-firm carve-out.
Where a one-person IT function runs out of road.
The March single point of failure
Ask your managing partner what happens if the IT person gets the flu on March 10th. Watch the pause. A firm can absorb a sick preparer because work reassigns, but the person who holds every admin password and every vendor relationship doesn’t reassign to anyone. That’s not a criticism of the hire. It’s arithmetic, and it’s the single most common reason accounting firms call us in the first place.
MFA that stops at the Microsoft 365 door
Most firms we assess have multi-factor turned on for email and nowhere else. The rule at 314.4(c)(5) reads any individual accessing any information system, which in a CPA office means the tax software, the client upload portal, the payroll platform, the bank feeds, and whatever document management system the firm bought in 2019. Every one of those is a separate login with its own settings page. Somebody has to open all of them.
OneDrive doing SharePoint’s job
This one is nearly universal and almost never deliberate. Client work ends up living in individual OneDrive folders because that’s the path of least resistance during a busy season, and a personal library is a user-shaped container, not a firm-shaped one. Permissions follow the person. Retention follows the person. When a senior leaves in June, three years of client working papers leave with the account unless somebody planned for it.
A vendor list nobody owns
Section 314.4(f) wants reasonable steps to select service providers, contract terms requiring safeguards, and a periodic assessment based on risk. Your internal IT person cannot credibly assess the vendors they chose, and they definitely cannot assess themselves. That’s a governance gap, not a skills gap, and it’s the cleanest argument for having a second set of eyes under contract.
Six places we plug in, around whatever your IT person already covers.
The written plan, kept current
A WISP that describes your actual environment rather than a template with the firm name typed in, plus the evidence trail behind each control so a reviewer can follow it.
Identity across the whole stack
Microsoft Entra ID configured properly, multi-factor enforced on every path we can reach including the third-party portals, and the information protection tooling switched on where your licence tier actually carries it. Licensing decides a lot of this, so we check it before promising it.
Recovery you have tested
Backups are easy. Restores are the thing nobody rehearses. Our backup and disaster recovery work includes proving a restore before you need one, ideally in a quiet week in August.
Escalation and a second opinion
Somewhere to send the ticket that has eaten a whole afternoon. Firewall behavior, Azure, a switch doing something strange. Mike Stoveken spent years in data centers, airport networks and large ISPs before this, so the odd ones are the fun part.
Overflow through filing season
Our help desk takes the password resets, the printer queue and the Outlook profile rebuilds so your person keeps the work only they can do. Fifteen-minute response standard, same as everyone else gets.
vCIO strategy and roadmapping
Budget, renewal dates, what breaks in two years. Our vCIO work gives your IT person a partner to build the case with, which lands better with partners than one voice asking for money.
The accounting stack sets the rules, and we work inside it.
Whichever tax and practice management software your firm runs, the season moves through it, and controls that fight it get worked around by the second week. QuickBooks and Outlook generate more application trouble than anything else we support, so the plan has to account for that rather than pretend otherwise. Your IT person keeps the keys to the systems they own. We document what we touch, hand it back in a form they can read, and we don’t quietly become the only ones who know how something works.
Is co-managed right for your firm?
Built for
Accounting and CPA firms across Rockland, Westchester and Bergen running roughly 5 to 60 people, with one or two internal IT staff who are competent, stretched, and carrying compliance work they were never trained for.
It also fits a firm whose IT person is excellent on the desktop side and honest about not being a security specialist. That combination works well. Nobody has to pretend.
Probably not for
Firms with no internal IT at all. That’s a different arrangement, and our fully managed service is the better starting point.
National firms with a real security team and a compliance function that already owns the program. And any firm whose procurement requires vendors to hold SOC 2 certification. Better said now than three meetings in.
Numbers worth checking before you take our word for it.
Four steps to a split that holds.
Talk to the IT person first
Not the managing partner. The person doing the work knows where the bodies are buried, and starting anywhere else sets the whole thing off on the wrong foot.
Gap assessment
Free, and you keep it either way. We look at coverage hours, documentation, identity configuration across every platform holding client data, backup and restore, and where the firm stands against the Safeguards Rule sections that still apply after the small-firm exception, which is more of them than most partners expect.
A written split
Who owns what, in writing, before anything starts. Vague co-managed arrangements fail on the third escalation, always for the same reason.
Run it, then revisit
The split that made sense in September is rarely the right one after a filing season, so we look at it again once the firm has real data on what actually got escalated.
About co-managed IT for accounting firms.
How is this different from just hiring a second IT person?
A second hire buys you more of the same skill set. Co-managed buys range. The gaps at most accounting firms aren’t extra hours on the help desk, they’re a written security program, identity configuration across a dozen platforms, a tested restore, and someone to escalate a firewall problem to at nine on a Sunday in March. That’s four disciplines, and one more salary rarely covers all four.
Our IT guy will think we’re replacing him. How do you handle that?
We start the conversation with him, not around him. Every co-managed arrangement that’s gone badly for anyone in this industry went badly because the internal person found out late and reasonably assumed the worst. So he sits in the assessment, he sees the findings before the partners do, and he gets a say in which pieces move. If he wants to keep something, he keeps it.
Can VJNetworks be our Qualified Individual under the Safeguards Rule?
Yes. Section 314.4(a) expressly allows the Qualified Individual to be employed by a service provider. Three things stay with your firm though, and they’re not waivable. The firm keeps responsibility for compliance, the firm names a senior person to direct and oversee that individual, and the firm has to require us to maintain a security program of our own. We’d usually rather see your internal person hold the role with us behind them, because the knowledge stays in the building that way.
What does co-managed IT cost for a firm our size?
There’s no published figure for co-managed, and any number quoted before an assessment would be invented. Scope here is defined by subtraction, so the price follows whatever your IT person isn’t already covering, and that varies enormously between two firms of identical headcount. A practice with solid help desk coverage and nothing written down needs the opposite of one with a tidy WISP and no weekend cover. We look first, then quote.
Could we bring you in for filing season only?
Honestly, that one usually disappoints everyone. Ramping up in January means we’re learning your environment during the worst eight weeks of the year, which is when nobody has patience for questions. The firms that get real value out of seasonal overflow signed on in the fall, so by February we already know which partner uses the mapped drive and where the tax software update stalls.
We’re in Bergen County. Does the Safeguards Rule reach a New Jersey firm?
It does. The Safeguards Rule is federal, so it applies to a tax preparation practice in Paramus exactly as it applies to one in Nyack, and the IRS written plan requirement rides on your PTIN rather than your address. State law can add to that. It never subtracts.
What happens if our IT person leaves anyway?
Then you’ve already got half the knowledge documented and a team who has been inside the environment for months, which is a very different resignation letter to read. Firms without that arrangement spend the first six weeks reconstructing passwords and vendor contacts. We can hold the line while you hire, or take the whole thing on if the partners decide not to replace the role.
If you want the wider view first, our co-managed IT services page covers the model across every industry we serve, and we walked through how co-managed IT works for New York businesses in more depth on the blog. Firms weighing up a provider change should read what Bergen CPA firms should ask an IT provider, and if security is the pressing piece, start with a security risk and vulnerability assessment.
Find out what your IT person is carrying alone.
A free gap assessment maps your current coverage against the Safeguards Rule sections that still apply to your firm, tests the controls you believe are running, and hands back a ranked list. You keep the findings whether you hire us or not.