The Accounting Technology Lab

Episode Summary: ATL271 - Why Your WISP Is Essential in 2026
Podcast Page/Subscription Links: https://podcast.cpate.ch
Wiki Page: ATL271 - CPA Tech Wiki

In ATL271, “Why Your WISP Is Essential in 2026,” Randy Johnston and Brian Tankersley explain why a written information security plan is no longer a compliance document that can sit on a shelf. Accounting firms hold concentrated stores of tax, financial, identity, and sometimes health information, making them attractive targets for phishing, credential theft, ransomware, fraudulent wire instructions, and AI-enhanced attacks. The hosts walk through the overlapping expectations of the IRS, FTC Safeguards Rule, and HIPAA, including written policies, multi-factor authentication, encryption, logging, incident response, training, governance, vendor oversight, and regular risk assessment. They emphasize that penalties can be severe, but the larger business risk may be client loss, reputational damage, litigation, and disruption during tax season. The episode also highlights practical governance: assign accountability, review the WISP regularly, connect security spending to risk, and report results to leadership. Randy and Brian close with five high-impact controls—MFA, full-disk encryption, tested backups, a written incident response plan, and vendor security questionnaires—plus a recurring calendar for log reviews, backup restores, phishing simulations, vulnerability scans, training, patching, and annual WISP updates. Their message: security is an operating discipline, not paperwork. For firms of every size, preparation now is cheaper than recovery.
Key Takeaways
A WISP should be an operating system for security—not shelfware. It needs ownership, periodic review, documented changes, and executive oversight.
Accounting firms are unusually attractive targets because they aggregate tax, financial, identity, payroll, and other confidential information.
Credential theft and phishing remain central risks, while AI is making fraudulent messages and attacks more convincing.
Vendor management belongs inside the security program. Cloud applications, hosting companies, MSPs, AI services, and other third parties expand the firm's attack surface.
Incident response must be planned before the incident. Firms should understand regulatory notification obligations, internal responsibilities, legal resources, and PR response.
Security has a recurring calendar. Log reviews, backup restores, phishing tests, vulnerability scanning, access reviews, training, patching, and WISP updates need assigned frequencies and owners.
Catchy Quotes
Approx. TimeSpeakerQuote
02:04 | Brian Tankersley | “The firms get hit because you and I are the Fort Knox of confidential data.”
03:33 | Brian Tankersley | “The bad guys are getting better faster than the good guys are getting better.”
07:40 | Brian Tankersley | “Anything that touches client data is a death sentence for a hard drive in my office.”
12:10 | Brian Tankersley | “If you don't have an adequate WISP, you're in violation of the FTC safeguards rule.”
18:20 | Randy Johnston | “You've got risk on any provider.”
18:42 | Brian Tankersley | “As soon as you know something's happened, the clock is ticking.”
23:11 | Brian Tankersley | “Multi-factor authentication, full disk encryption, tested backup strategies, written incident response plans, vendor security questionnaires.”
24:55 | Randy Johnston | “Make sure that you've got your WISP … pulled out, dusted off, and updated for this year's regulations.”

Note: Timestamps are approximate where the quote occurs inside a longer timestamped speaker segment in the transcript.

Social Media Posts

ATL270: Hardware Hullabaloo - Episode Summary
Hardware is once again a strategic business issue—not merely an IT purchasing decision. In ATL270, Randy Johnston and Brian Tankersley examine how cybersecurity concerns, new processor families, and extraordinary component-price increases are reshaping technology plans for accounting firms and home offices. They begin with aging consumer routers, warning that an inexpensive or unsupported gateway can become the weak link for business data, remote access, and connected devices. Network segmentation, managed security hardware, and renewed use of VPNs are presented as practical safeguards. The conversation then surveys emerging hardware from Intel, AMD, Apple, Google, NVIDIA, and major PC manufacturers, with special attention to neural processing units and locally executed AI workloads. Brian shares his early experience with a TCL NXTPAPER tablet, while both hosts caution buyers against underpowered back-to-school systems. The sharpest lesson comes from current upgrade economics: Brian reports that the same 64 GB memory kit he bought for about $210 was listed near $979, while Randy describes a previously $18,000 server configuration approaching $74,000. Their advice is deliberately pragmatic: extend maintenance where sensible, scrutinize cloud operating costs, match purchases to measurable productivity, and avoid spending premium dollars merely to own the newest hardware. In a volatile market, disciplined technology governance matters more than specifications alone.

Key Takeaways
- Treat home-office routers and remote-access hardware as part of the firm’s control environment.
- Segment business, household, and connected-device traffic so one compromise does not expose every system.
- Specify processors, memory, and storage around actual workloads—especially local AI—rather than marketing labels.
- Evaluate upgrades using measurable productivity and risk reduction, not hardware envy.
- When server replacement prices and lead times are extreme, compare extended maintenance, cloud economics, and deferral.
Wiki: https://wiki.cpate.ch/index.php/ATL270
Creators & Guests

Brian F. Tankersley - Host

Randy Johnston - Host

_________________________

ATL269 — Microsoft Agent 365
Program: Accounting Technology Lab
Hosts: Randy Johnston and Brian F. Tankersley, CPA.CITP, CGMA
Approximate runtime: 31 minutes
Resource: 100 Free AI Prompts for Accounting - https://cpate.ch/100-prompts-atl
Primary topic: Governed deployment, monitoring, security, and economics of enterprise AI agents
200-Word Episode Summary
In ATL269, Randy Johnston and Brian Tankersley examine Microsoft Agent 365 as a control plane for deploying, monitoring, governing, and securing AI agents. They frame the shift as a move from per-seat software licensing toward an AI token economy, where tokens function like staff time, prompts replace checklists, and agents perform repeatable work at speed. Practical examples include invoice extraction, email drafting, financial-statement analysis, and budgeting—tasks that may cost pennies in model usage while still requiring review and judgment. The hosts argue that Agent 365 gives accounting firms an alternative to “Wild West” experimentation by extending Microsoft 365 security, auditability, and governance over agents. They discuss Copilot, Agent Builder, Copilot Studio, Microsoft Foundry, Azure AI, Power BI, Defender, Purview, and the E7 licensing bundle. Privacy, records retention, e-discovery, intellectual property, and workflow ownership receive attention because firms may expose sensitive client data or proprietary processes when using public AI platforms. Their practical recommendation is measured experimentation: convert checklists into prompts, move tasks into agents, retain humans in the loop, establish token budgets, and evaluate results firsthand. The message is urgent but cautious: firms need not operate at the bleeding edge, but they must start learning before competitors pull ahead.
Key Takeaways
·        The economic unit of AI is shifting from a user license toward token consumption and task-level cost.
·        Tokens can be managed like staff time, prompts like procedures, and agents like digital staff assignments.
·        Agentic workflows depend on steps, loops, exception handling, context, permissions, and human review.
·        Agent 365’s differentiator is governance: visibility, monitoring, security, auditability, and centralized control.
·        Public AI tools create material concerns involving PII, PHI, client confidentiality, retention, e-discovery, and vendor training practices.
·        Proprietary workflows may be valuable intellectual property and should not be surrendered casually to a model provider.
·        Model selection should balance quality and cost with privacy, security, regulatory fit, and data ownership.
·        Accounting firms should begin with controlled experiments and measurable use cases rather than enterprise-wide autonomous deployment.
·        Human reviewers remain accountable for conclusions, professional judgment, client context, and exceptions.
·        Firms need AI governance policies, token budgets, approved-tool lists, monitoring, and documented escalation procedures.
Catchy Quotes and Video Locations
·        01:48–01:50 — Brian Tankersley: “Yeah, so it’s an F-150 and not a G-Wagon.”
·        04:22–04:30 — Brian Tankersley: “This is like sending it to staff first, and the staff costs three cents.”
·        09:35–09:51 — Brian Tankersley: “I’m seeing tokens as staff time on the schedule… We used to have checklists, and now we have prompts.”
·        10:09–10:22 — Brian Tankersley: “They get work done so fast that the human is now the logjam in the process.”
·        15:32–15:48 — Randy Johnston: “Microsoft Agent 365 is the control plane for agents… Is it perfect yet? No. Is it pretty doggone good? Yes.”
·        17:25–17:41 — Brian Tankersley: “We have the grown-ups in charge now, and we’re going to systematize this in a way that we can regulate and do the right way.”
·        28:02–28:13 — Brian Tankersley: “Take your checklists and turn them into prompts, and take tasks that are on the schedule and push them into agents.”
·        29:31–29:43 — Brian Tankersley: “The train is leaving the station… If you don’t get started on this stuff, you’re going to be behind, and so it’s time to go.”
·        30:19–30:30 — Brian Tankersley: “It is critical that you get your hands dirty with some of these things, because it’s the only way that you will be able to evaluate whether something really works or not.”

ATL268 — Scaling New Heights 2026, Part Two is an episode of the Accounting Technology Lab podcast hosted by Randy Johnston and Brian F. Tankersley, CPA.CITP, CGMA.
In Part Two of their Scaling New Heights 2026 recap, Randy Johnston and Brian Tankersley examine what the conference revealed about artificial intelligence, accounting platforms and the profession’s readiness for change. They describe an unusually divided AI adoption curve: a relatively small group is experimenting aggressively with agents and advanced workflows, while many accounting professionals have done little or nothing with the technology.
The hosts review keynote speakers, educational sessions and the conference’s AI-enabled general-ledger tour. Products discussed include Campfire, SoftLedger, Kick, Xero, Puzzle, Microsoft Dynamics 365 Business Central, Sage, Digits, Zoho and Acumatica. They also observe growing dissatisfaction with Intuit and uncertainty about replacements for QuickBooks Desktop.
A central lesson is that firms should not select technology merely to reproduce today’s processes. Instead, they should define how services, pricing and workflows should operate three to five years from now and choose platforms that support that future. Johnston and Tankersley also warn that an overcrowded accounting-technology market will produce additional vendor failures and discontinued products. Firms therefore need careful due diligence, realistic implementation plans, data-export procedures and a viable Plan B—even when buying from established publishers.
_________________________________
KEY THEMES
AI adoption is highly uneven - Brian estimates that approximately 10% of conference participants were actively working with agents and advanced AI, another 10% had experimented with prompts, and a much larger group appeared to have done little with the technology. Randy compares the pattern to a K-shaped economy rather than a traditional bell-shaped adoption curve.
Compliance still dominates - Despite years of discussion about client advisory services, many firms remain heavily dependent on compliance work. The transition to advisory, alternative pricing and technology-supported higher-value services continues more slowly than industry advocates expected.
Accounting platforms are entering a transition period - The exhibit floor showed renewed competition among traditional accounting systems, AI-native ledgers and broader ERP platforms. Several offerings emphasized automated transaction coding, reconciliations, close management, reporting and real-time financial information.
Firms must buy for their future operating model - A replacement platform should support the firm that management intends to operate in three to five years—not simply recreate existing workflows. Strategy concerning pricing, advisory services, staffing and automation should precede product selection.
Every firm needs a technology exit plan - Vendor shutdowns, acquisitions and product discontinuations affect both startups and established publishers. Firms should understand data ownership, export formats, contractual terms, conversion options and the operational consequences of replacing a core application.

Notable quotes
03:34 | Brian Tankersley | “The tool’s ready to be used… The challenge is pulling along those laggards that are out there.”
04:41 | Randy Johnston | “You’ve got the really early adopters, and you’ve got the other people that aren’t moving—and there’s a big gap in the middle.”
10:29 | Brian Tankersley | “It felt like there were a lot of people that were in the middle of a divorce with Intuit right now.”
17:43 | Randy Johnston | “There’s too doggone many products trying to get to too small of a market.”
20:58 | Brian Tankersley | “You need to have a Plan B in your workflow for what’s going to happen if your product is discontinued.”
21:41 | Brian Tankersley | “Pick the tools that are going to enable not how you run the firm today, but how the firm’s going to run in three years—five years.”
22:39 | Brian Tankersley | “We’re seeing an increasing rate of failures because they’re trying to buy products that solve the old workflow.”

Episode information
Episode: ATL268 — Scaling New Heights 2026, Part Two
Publication date: July 31, 2026
Recorded: July 2, 2026
Hosts: Randy Johnston and Brian F. Tankersley, CPA.CITP, CGMA
Program: Accounting Technology Lab
Presented by: CPA Practice Advisor
Approximate runtime: 23 minutes, 35 seconds
Primary topics: Scaling New Heights 2026, artificial intelligence, AI-enabled general ledgers, technology adoption, advisory services, software selection, vendor risk and accounting-platform migration

ATL267 – AI Is the Ultimate Accounting Assistant, Part Two
Guest: Sasha Orloff, Co-founder and CEO of Puzzle
Hosts: Randy Johnston and Brian F. Tankersley, CPA.CITP, CGMA
Program: Accounting Technology Lab, presented by CPA Practice Advisor
Episode length: Approximately 10 minutes
Episode Summary
In part two of the conversation with Puzzle co-founder and CEO Sasha Orloff, the Accounting Technology Lab examines how accounting professionals can begin adopting artificial intelligence without abandoning their existing knowledge, systems, or professional judgment.
Orloff recommends starting with a difficult but low-risk problem rather than using AI only for trivial experiments. Accountants should remove client-identifying information, use personal or anonymized data, and practice explaining a task as clearly as they would to a highly capable new employee who lacks accounting experience. A prompt, in this context, becomes much like a detailed checklist: it defines the expected steps, safeguards, and outcome.
The discussion also distinguishes helpful AI assistance from uncontrolled automation. Puzzle’s approach allows agents to prepare work while requiring human approval before anything is posted to the ledger. Randy Johnston emphasizes that the profession does not need technology that eliminates accountants; it needs technology that makes accountants more effective.
Orloff argues that firms creating a safe culture of experimentation will improve productivity, profitability, and client service. Brian Tankersley closes with a challenge to accounting leaders: become sufficiently familiar with AI to evaluate solutions intelligently, guide employees, and lead clients through change. The central message is simple—AI adoption does not require reckless transformation, but it does require action.
Key Episode Themes
Begin with meaningful work. Testing AI on an authentic, complicated problem reveals more than asking it to perform a novelty task.
Use low-risk information. Remove client names, confidential information, personally identifiable information, and other sensitive data before experimenting.
Treat prompts as process documentation. AI performs better when instructions describe each step, decision, constraint, and expected output.
Keep accountants in control. AI can draft transactions, reconciliations, analyses, and journal entries, but accountable professionals should review and approve the results.
Create a culture of experimentation. Firm leaders should give employees permission and guardrails to explore AI safely.
Leadership requires firsthand knowledge. Accountants do not have to adopt every AI product, but they need enough experience to distinguish practical capabilities from marketing claims.
Suggested Episode Highlights
Sasha Orloff explains why accountants should test AI on difficult, meaningful tasks.
Detailed prompts function like checklists for accounting processes.
Firms should experiment only with anonymized, nonconfidential information.
Puzzle’s agents require approval before posting changes to the ledger.
AI should enhance accountants rather than remove them from the process.
Accountants retain responsibility for judgment, review, and accountability.
Firm leaders must establish guardrails that make safe experimentation acceptable.
Practical AI productivity in accounting is beginning to move beyond novelty.
Professionals who learn now may gain improvements in margins, capacity, and service.
Accounting leaders must develop enough firsthand knowledge to evaluate AI vendors critically.

CPAFirm
ClientAccountingServices
CAS
MonthEndClose
ProfessionalJudgment
ResponsibleAI
HumanInTheLoop
DigitalTransformation
PracticeManagement
PromptEngineering
AccountingPodcast
Puzzle
Products, Services, and Companies Mentioned
Product, service, or companyContext in the episodeXFacebookLinkedInInstagramPuzzle | AI-native accounting platform and ledger discussed by Sasha Orloff; supports agent-assisted workflows with approval controls | @puzzlefin | No official account identified | Puzzle | No official account identified
ChatGPT | General-purpose AI assistant suggested for testing anonymized transactions and charts of accounts | @OpenAI | OpenAI | OpenAI | @openai
OpenAI | Developer and publisher of ChatGPT | @OpenAI | OpenAI | OpenAI | @openai
Gemini | Google AI assistant suggested for controlled accounting experiments | @GoogleGemini | Google | Google | @googlegemini
Google | Developer and publisher of Gemini | @Google | Google | Google | @google
Claude | Anthropic AI assistant suggested for controlled accounting experiments | Anthropic | No official product-specific account identified | Anthropic | No official product-specific account identified
Anthropic | Developer and publisher of Claude | @AnthropicAI | No official account identified | Anthropic | No official account identified
X, formerly Twitter | Social platform referenced as a source of AI news and discussion | @X | Not applicable | X | @x
CPA Practice Advisor | Presenter and sponsor of the Accounting Technology Lab | @CPAPracAdvisor | CPA Practice Advisor | CPA Practice Advisor | @cpapracticeadvisor

Verification note: Social-media availability and account names can change. Puzzle’s website links directly to its LinkedIn and X accounts.