Busy Season Starts at Your Router: A Plain-English Home Network Audit for Accountants Working Remotely

Your firm's office network probably has a firewall, a managed switch, and an IT vendor on speed dial. Your home network — where an increasing share of tax returns, payroll files, and QuickBooks backups now actually live — likely has a router your internet provider shipped you three years ago and a password taped to the base of it.

That asymmetry is the quiet risk of the remote-work era in accounting. Below is a self-audit you can complete in under an hour, written for finance professionals, not network engineers.

Why the Home Network Deserves the Same Scrutiny as the Office

Client confidentiality obligations do not distinguish between a filing cabinet in your office and a laptop at your kitchen table. FTC Safeguards Rule obligations, state breach-notification laws, and IRS Publication 4557 guidance all follow the data, not the building. Yet when we speak with small-firm accountants, the home router is almost never part of their security conversation.

An attacker does not need to defeat your firm's defenses if your home network hands over the goods first. A default router password, an unpatched firmware version, or a neighbor borrowing your Wi-Fi can each undo years of careful compliance work.

Step 1: Identify What Is Actually Connected

Log into your router's admin page (typically 192.168.1.1 or 192.168.0.1 in a browser — the address is printed on most devices). Look for a section labeled "Attached Devices," "Device List," or "DHCP Clients."

Expect the usual suspects: laptops, phones, a smart TV. Also expect surprises — an old tablet, a video doorbell, a printer nobody has updated since 2019. Every device is a potential entry point. Anything unrecognizable should be investigated; anything unused should be disconnected and its access revoked.

If the device list looks like a yard sale of orphaned gadgets, that alone is a finding worth writing down.

Step 2: Fix the Four Router Settings That Matter Most

You do not need to master networking to close the biggest gaps. Focus on these four:

1. Admin credentials. If you still log in with "admin/admin," change it today. Use a unique password of at least 14 characters, stored in a password manager.

2. Encryption standard. In your wireless settings, select WPA3 if available; WPA2-AES is the acceptable fallback. If the router only offers WEP or WPA, it is effectively a revolving door — replace the hardware.

3. Firmware. Check for updates under an "Administration" or "System" tab. Enable automatic updates if the option exists. Router firmware patches fix exactly the vulnerabilities attackers scan for at scale.

4. Remote administration. Look for "Remote Management" or "WAN access" and make sure it is disabled. There is rarely a legitimate reason for your home router to be configurable from the open internet.

Step 3: Understand What Your ISP Can See

Here is the part that surprises most accountants. Even on a fully secured home network, your internet service provider observes every unencrypted connection — the tax software portals you visit, the cloud storage services you sync with, and the timing and volume of your traffic.

ISPs in the United States can legally monetize browsing data under certain conditions, and their retention practices are rarely documented in ways a CPA could rely on. When client files move across that pipe, your ISP becomes an unvetted third party in your engagement confidentiality chain.

Step 4: Where a VPN Fits — and Where It Doesn't

A VPN creates an encrypted tunnel between your home device and the wider internet, replacing your ISP's visibility with the VPN provider's. That is a meaningful improvement — if you choose a provider with a audited no-logs policy, a jurisdiction outside of intrusive surveillance alliances, and a track record with independent security assessments.

Be clear-eyed about limitations. A VPN does not patch your router, does not protect a device already compromised with malware, and does not substitute for firm-level controls like multi-factor authentication and endpoint encryption. It is one layer in a defense that should also include:

• Full-disk encryption on every device touching client data
• MFA on all tax and accounting software logins
• Automatic, encrypted backups stored off-network
• A written remote-work policy that covers home networks explicitly

The Printable Checklist

Copy this into your busy-season planning file:

• Router admin password changed from factory default
• WPA3 or WPA2-AES encryption enabled
• Firmware updated within the last 90 days
• Remote administration disabled
• Unknown devices removed from the network
• Guest network separated from work devices
• VPN installed, configured to launch at startup, with kill switch enabled
• ISP privacy settings reviewed; VPN chosen from an audited, no-logs provider

Make It an Annual Ritual

We recommend running this audit every January, before the first client document crosses your home network. Fifteen minutes of router maintenance and a properly configured VPN will never appear on a résumé — but they may be the reason a breach never appears on your engagement record.