An accounting firm holds personal data of people who have never set foot in its office: the employees of its client companies. Full name, ID number, bank account, salary, sick leave, dependent information — all of it moves through the accountant's system to calculate the right amount and report it to the government's payroll and hiring platform.
Brazil's data protection law (a rule governing how companies handle personal data) doesn't let that responsibility disappear just because the data belongs to another company's employee. According to Brazil's national data protection authority, when a security incident exposes personal data, whoever processes that data has 3 business days to notify the authority and the people affected — a deadline set by a resolution from April 2024 that regulates the law's incident-notification article.
Three business days is not much time to find out what leaked and who was affected if the firm doesn't already know, in advance, what it holds, where it lives, and who touched it. That's why, for whoever sets the IT budget of an accounting firm, the right question isn't just "can the system break?" — it's "what happens to the client, to the client's employee, and to the deadline, on the day it does?"
Someone else's data, the firm's own responsibility
Accounting work is already demanding before any incident happens. A survey by IOB with Brazil's federal accounting council and the national federation of accounting service firms, covering 393 accounting professionals across all regions of the country between April and May 2026, found that 34% name manual rework as their biggest daily challenge, and 17% cite the difficulty of integrating different systems.
It's in that kind of routine — already strained by rework and by systems that don't talk to each other — that closing week stacks the volume of every client at once: whoever calculates payroll, whoever issues a tax form, whoever files with the government, whoever checks a return, all hitting the same database, on the same day.
And the calendar for that work doesn't belong to the firm: it belongs to the tax authority, the government, and every labor agreement. According to the federal accounting council, companies that wanted their simplified tax regime choice to take effect from January 2027 had until September 30, 2026, to make that call through the official channel. Missing that window means not starting 2027 with the option the company wanted — the calendar doesn't hold the line for a firm whose system happened to fail that day.
Add the two together: data belonging to people who aren't the firm's own clients, and a deadline that won't bend to whatever day the system decided to go down. That combination is what changes the size of the risk a poorly run IT setup carries for an accounting firm, compared with a business that only handles its own data and its own calendar.
Why the usual approach doesn't survive closing week
The usual way of handling IT at an accounting firm is reactive: call someone when the system freezes, trust a backup nobody has tested, or leave the subject to whoever "knows more about computers" on the team. It works most of the year — when a problem can wait for the technician to show up.
That comfort disappears during closing week. That's when everyone in the office uses the same system at the same time, against the same deadline. A system that handles an ordinary Tuesday just fine can freeze on the exact Thursday when no one can afford to wait — and buying one more license or one more system doesn't fix that on its own, if nobody planned for capacity, access, and backup ahead of the crisis.
When it freezes, the problem isn't just the downtime: it's downtime on the exact day the filing window closes — and, as with the simplified tax regime, some of those windows don't reopen the following week. The firm only finds out where its own system's limit is at the worst possible moment to find out.
What has to be in place
A closing-week-ready IT setup is defined by concrete mechanisms, not good intentions.
Capacity that handles the peak of closing week. The system — and the internet connection behind it — need to support the whole office calculating, issuing, and filing at the same time, without slowing down or freezing right when volume is at its highest point of the year.
A copy that gets the firm back in hours, not days, during the critical week. Having a backup isn't enough: it needs to be tested with a real recovery, done outside the closing window, so nobody discovers the copy was incomplete exactly when it's needed.
Segregation of who can see which client's data. Each team member should only see the payroll and records of the clients they handle — not the firm's entire client base — because the employee exposed in an incident belongs to one specific client, and access beyond what's needed only widens who could have caused a leak.
Secure remote access for whoever logs in from home during the closing crunch. Much of closing-week work happens outside business hours, from home, to meet the deadline. That access needs to go through a protected channel — not a shortcut someone set up to save time.
A pre-agreed way to keep filing if the main system goes down on deadline day. An alternative planned ahead of time — another computer, another access path, another way to submit the filing — for the day the main system doesn't come back in time.
A record of who touched which data, and when. If an incident happens, reconstructing what occurred — what was accessed, by whom, at what moment — is what makes it possible to write the 3-business-day notice with facts, not guesswork.
This is how Skills IT works with accounting firms: managing system capacity ahead of the critical week, testing the backup with a real recovery drill, and keeping remote access under control, so the firm doesn't have to figure it out alone in the middle of closing.
The payoff of a closing week without surprises
The payoff of IT that's ready for closing week doesn't show up as a satisfaction score or a promised result — it shows up in the operation itself. It's the week when nobody waits for a screen to load, nobody redoes a calculation because the system crashed midway, and nobody spends the deadline day explaining to a client why a form is late.
On the financial side, the payoff is predictability: the firm knows, month after month, how much it will spend on the structure behind closing, instead of discovering the cost of a problem only after it happened — overtime, rework, or the strain of explaining a delay to a client who has a deadline of their own with the government.
And what's left over is exactly what closing week is short on: time to review before sending, not only after the deadline has passed. Accounting firms are among the industries Skills IT works with — because there, the deadline isn't just the firm's own: it belongs to the client waiting for the right form, on the right date.
Four questions for the closing-week meeting
Before the next meeting about closing, it's worth bringing these four questions to whoever handles the firm's IT:
- Who at the firm would still have access to this data if they left today? If the answer includes more people than makes sense, or someone who no longer works there, the problem isn't bad luck — it's access control.
- What happens if the system goes down on Thursday, right before Friday's deadline? If the answer is "we wait for it to come back," there's no pre-agreed way to keep filing through another channel.
- When was the last time someone actually tested restoring the backup? A copy that exists but was never restored is an assumption, not a guarantee — and closing week is no time to find that out.
- If an incident exposed a client's employee data tomorrow, would the firm know what was accessed and by whom? Without that record, the 3-business-day notice turns into a blind scramble instead of a fact-based response.
