Episode Summary: ATL271 - Why Your WISP Is Essential in 2026

Podcast Page/Subscription Links: https://podcast.cpate.ch
Wiki Page: ATL271 - CPA Tech Wiki

In ATL271, “Why Your WISP Is Essential in 2026,” Randy Johnston and Brian Tankersley explain why a written information security plan is no longer a compliance document that can sit on a shelf. Accounting firms hold concentrated stores of tax, financial, identity, and sometimes health information, making them attractive targets for phishing, credential theft, ransomware, fraudulent wire instructions, and AI-enhanced attacks. The hosts walk through the overlapping expectations of the IRS, FTC Safeguards Rule, and HIPAA, including written policies, multi-factor authentication, encryption, logging, incident response, training, governance, vendor oversight, and regular risk assessment. They emphasize that penalties can be severe, but the larger business risk may be client loss, reputational damage, litigation, and disruption during tax season. The episode also highlights practical governance: assign accountability, review the WISP regularly, connect security spending to risk, and report results to leadership. Randy and Brian close with five high-impact controls—MFA, full-disk encryption, tested backups, a written incident response plan, and vendor security questionnaires—plus a recurring calendar for log reviews, backup restores, phishing simulations, vulnerability scans, training, patching, and annual WISP updates. Their message: security is an operating discipline, not paperwork. For firms of every size, preparation now is cheaper than recovery.

Key Takeaways

• A WISP should be an operating system for security—not shelfware. It needs ownership, periodic review, documented changes, and executive oversight.
• Accounting firms are unusually attractive targets because they aggregate tax, financial, identity, payroll, and other confidential information.
• Credential theft and phishing remain central risks, while AI is making fraudulent messages and attacks more convincing.
• Vendor management belongs inside the security program. Cloud applications, hosting companies, MSPs, AI services, and other third parties expand the firm's attack surface.
• Incident response must be planned before the incident. Firms should understand regulatory notification obligations, internal responsibilities, legal resources, and PR response.
• Security has a recurring calendar. Log reviews, backup restores, phishing tests, vulnerability scanning, access reviews, training, patching, and WISP updates need assigned frequencies and owners.

Catchy Quotes

Approx. TimeSpeakerQuote
02:04 | Brian Tankersley | “The firms get hit because you and I are the Fort Knox of confidential data.”
03:33 | Brian Tankersley | “The bad guys are getting better faster than the good guys are getting better.”
07:40 | Brian Tankersley | “Anything that touches client data is a death sentence for a hard drive in my office.”
12:10 | Brian Tankersley | “If you don't have an adequate WISP, you're in violation of the FTC safeguards rule.”
18:20 | Randy Johnston | “You've got risk on any provider.”
18:42 | Brian Tankersley | “As soon as you know something's happened, the clock is ticking.”
23:11 | Brian Tankersley | “Multi-factor authentication, full disk encryption, tested backup strategies, written incident response plans, vendor security questionnaires.”
24:55 | Randy Johnston | “Make sure that you've got your WISP … pulled out, dusted off, and updated for this year's regulations.”

Note: Timestamps are approximate where the quote occurs inside a longer timestamped speaker segment in the transcript.

Social Media Posts

ATL270: Hardware Hullabaloo - Episode Summary

Hardware is once again a strategic business issue—not merely an IT purchasing decision. In ATL270, Randy Johnston and Brian Tankersley examine how cybersecurity concerns, new processor families, and extraordinary component-price increases are reshaping technology plans for accounting firms and home offices. They begin with aging consumer routers, warning that an inexpensive or unsupported gateway can become the weak link for business data, remote access, and connected devices. Network segmentation, managed security hardware, and renewed use of VPNs are presented as practical safeguards. The conversation then surveys emerging hardware from Intel, AMD, Apple, Google, NVIDIA, and major PC manufacturers, with special attention to neural processing units and locally executed AI workloads. Brian shares his early experience with a TCL NXTPAPER tablet, while both hosts caution buyers against underpowered back-to-school systems. The sharpest lesson comes from current upgrade economics: Brian reports that the same 64 GB memory kit he bought for about $210 was listed near $979, while Randy describes a previously $18,000 server configuration approaching $74,000. Their advice is deliberately pragmatic: extend maintenance where sensible, scrutinize cloud operating costs, match purchases to measurable productivity, and avoid spending premium dollars merely to own the newest hardware. In a volatile market, disciplined technology governance matters more than specifications alone.

Key Takeaways
- Treat home-office routers and remote-access hardware as part of the firm’s control environment.
- Segment business, household, and connected-device traffic so one compromise does not expose every system.
- Specify processors, memory, and storage around actual workloads—especially local AI—rather than marketing labels.
- Evaluate upgrades using measurable productivity and risk reduction, not hardware envy.
- When server replacement prices and lead times are extreme, compare extended maintenance, cloud economics, and deferral.

Wiki: https://wiki.cpate.ch/index.php/ATL270

Creators & Guests

• Brian F. Tankersley - Host
• Randy Johnston - Host

Title: ATL266 — AI Is the Ultimate Accounting Assistant
Wiki: ATL266 - CPA Tech Wiki
Guest: Sasha Orloff, CEO of Puzzle
Hosts: Randy Johnston and Brian F. Tankersley, CPA.CITP, CGMA
Publisher/Sponsor: CPA Practice Advisor

AI Is the Ultimate Accounting Assistant—But the Accountant Is Still Accountable

In ATL266, hosts Randy Johnston and Brian Tankersley speak with Sasha Orloff, CEO of Puzzle, about why artificial intelligence should be viewed as an accounting assistant rather than an autonomous replacement for accountants. Orloff argues that accounting is fundamentally an accountability profession: AI can prepare work, identify anomalies, execute firm-defined rules, and accelerate close processes, but a qualified human must review, approve, and remain responsible for the books.

The conversation contrasts probabilistic generative AI with deterministic accounting workflows. Puzzle’s approach lets firms describe policies in natural language, confirm the system’s interpretation, and preserve those instructions as repeatable agents. Examples include automatically preparing depreciation for computer purchases and recognizing annual prepaid rent according to a fixed schedule. These agents preserve firm knowledge, create audit trails, and reduce repetitive clicking without silently changing records.

The speakers also explore accuracy, trust, staffing shortages, and the limitations of legacy accounting platforms. Orloff says firms adopting governed automation can close faster, improve accuracy, scale without proportional hiring, and potentially give staff significant time back each month. The central message is optimistic but disciplined: firms that combine AI speed with human judgment, transparent controls, and explicit sign-off can deliver better client service, higher margins, and more rewarding accounting work.

Key Themes

· AI as an assistant and amplifier of professional judgment

· Accountability, review, approval, and auditability

· Deterministic agents versus probabilistic AI

· Preserving firm procedures and client-specific knowledge

· Faster monthly closes and improved consistency

· Staffing leverage, higher margins, and better work-life balance

· Gradual, opt-in adoption of AI-powered workflows

Catchy Quotes and Video Locations

00:33 — Sasha Orloff:
“AI is going to be one of the biggest booms for accounting, and accountants are going to make more money because of AI than ever before.”

06:49 — Sasha Orloff:
“The difference is an AI is going to sound really confident when it guesses the wrong way.”

09:09 — Sasha Orloff:
“Our customer is the accounting firm, and what does that mean? It means we defer to them as the experts.”

16:01 — Sasha Orloff:
“An agent is a piece of software that executes a very specific task.”

21:31 — Sasha Orloff:
“This can be designed…not to replace you, but to make you the best version.”

22:13 — Sasha Orloff:
“You define your month close process as a set of agents…and just let it prepare and help you become your best version.”

24:14 — Sasha Orloff:
“The accountant is the expert. You just need too many clicks to get that expertise implemented.”

30:41 — Sasha Orloff:
“Could you imagine having a week of vacation every month and making the same amount of money?”

In this episode of the Accounting Technology Lab, Randy Johnston and Brian Tankersley discuss Scaling New Heights 2026 from Orlando and unpack why this year’s theme, "Strange New World," feels especially relevant for accountants. Randy shares observations from the conference floor, including strong attendance, a large exhibitor presence, sessions on AI, data cleanup, SOPs written with AI, and main stage presentations featuring technology, magic, and thought leadership.

The conversation moves from conference recap to practical implications for the profession. Randy and Brian explore how AI is changing advisory services, why clean data remains essential, and why accountants need to understand the difference between deterministic accounting systems and probabilistic AI systems. They also discuss AI governance, privacy policies, EULAs, subprocessors, Microsoft’s compliance posture, and why professional standards require accountants to be more careful with client data than many other business functions.

This episode is ideal for accounting professionals who want a grounded perspective on AI’s role in the profession, what was being discussed at one of the year’s major accounting technology conferences, and how firm leaders should think about education, governance, and responsible adoption.

Show Notes:

• Scaling New Heights 2026 used the theme "Strange New World," reflecting the rapid and sometimes unsettling changes created by AI.
• Randy reported solid attendance of about 2,000 attendees and approximately 133 exhibitors.
• AI-powered general ledgers and AI-enabled accounting workflows were prominent conference topics.
• Clean data remains a prerequisite for useful AI output.
• Sessions emphasized practical AI use, including advisory services, growth strategies, and SOP development.
• Daniel Susskind’s main stage presentation explored work, professions, education, AI, and artificial general intelligence.
• Education and change management are becoming central to AI adoption in accounting firms.
• AI governance is becoming more important than a simple AI policy.
• Privacy policies, EULAs, subprocessors, and data use for model training require careful review.
• Microsoft’s compliance and governance approach was discussed as especially relevant for the accounting profession.
• Accountants must understand that traditional accounting systems are deterministic, while many AI systems are probabilistic.
• Brian used the vending machine vs. slot machine analogy to explain why AI outputs require review and professional judgment.

Pull Quotes

• "There’s just a lot of things that are strange with AI." - Randy Johnston
• "You can’t make filet mignon out of hamburger." - Brian Tankersley
• "Education is the response to AI." - Randy Johnston, discussing themes from Daniel Susskind’s presentation
• "It is very ish." - Brian Tankersley, on the probabilistic nature of AI
• "We have to be grown-ups all the time." - Brian Tankersley, on professional obligations around private client data
• "Last year we said you always start with a policy, but now you’ve got to restrict things with governance." - Randy Johnston

Randy Johnston and Brian Tankersley record on-site in Orlando to debrief a packed week around AICPA ENGAGE 2026 and the annual Thought Leader/40 Under 40 mashup. They open with the Rise 2040 vision project, highlighting mega-trends like the profession’s “great identity shift,” AI as a strategic force multiplier, globalization, and the emerging “trust paradox” created by artificial intelligence. The hosts describe intense roundtable discussions among young tech-enabled CPAs and seasoned thought leaders on associations, evolving business models, and how state societies must reimagine member engagement in a digital, AI-driven world.

The conversation then tackles AI and private equity—“AIPE”—and how late-career partners, unfunded buyouts, and underinvestment in technology are driving firms toward PE ownership and forced modernization. They explore return-to-office realities, cybersecurity and AI-powered threats, including federal actions around advanced AI models, and the profession’s persistent self-confidence gap with technology. Randy shares ENGAGE highlights, including his 40th year speaking, a standing-room-only Tech Update and AI prompting session, and a 200-vendor exhibit hall featuring every major publisher and cloud platform. They close with reflections on AI’s ubiquity at ENGAGE, main-stage guests like Ryan Reynolds, and why networking at these events still moves the profession forward.