The Engagement Interview Has Changed: Prospective Clients Are Quietly Grading Your Remote-Access Security

Twenty years ago, an engagement interview in accounting ran on a fairly predictable script. The prospect asked about experience, industry familiarity, turnaround time, and price. Nobody asked where the firm's data lived or how its staff connected to it.

That script has changed. In conversations we've had with practitioners across the past year — from solo CPAs in Ohio to a twelve-person firm in the Carolinas — a recurring theme emerged: prospective clients, particularly business owners who have themselves been through cyber insurance renewals or vendor onboarding questionnaires, now open the security conversation earlier and more directly than ever. One Kansas City-based bookkeeping firm told us a prospect asked, in the first meeting, whether staff working from home used "a company VPN or just their own Wi-Fi."

The question is not going away. And how a firm answers it — or fails to — says more than most practitioners realize.

Security Posture as a First Impression

There is a reason our site is named what it is: for finance professionals, the virtual private network is no longer plumbing. It is a statement. When a prospect asks how your team accesses client files remotely, your answer effectively communicates three things at once — whether you take confidentiality seriously, whether you understand the regulatory environment you operate in, and whether you've invested in your practice the way you'd advise a client to invest in theirs.

Consider the asymmetry. A firm that cannot describe its remote-access setup in plain language is asking a prospect to extend trust it cannot itself articulate. Worse, a firm that dismisses the question — "we've never had a problem" — signals the same complacency it would flag as a control deficiency if it appeared on a client's internal audit report.

None of this means a small firm needs enterprise-grade infrastructure to be credible. It means the firm needs a coherent, truthful narrative about what it does have.

What a Good Answer Sounds Like

The strongest answers we've observed share a structure. They are specific, brief, and proportionate. A workable formulation for a small firm might sound like:

"All remote connections to client data run through a business-grade VPN with multi-factor authentication. Staff can't reach client files without it. We review that setup annually, and we can walk you through it if it becomes relevant to your own compliance requirements."

Notice what this does. It names concrete controls rather than vague assurances. It draws a boundary — the offer to elaborate "if relevant" — without either oversharing technical detail that could itself become a security liability or stonewalling in a way that reads as evasion. It treats the prospect as a sophisticated counterparty rather than either a threat or a bystander.

What it avoids is equally important. It does not name the VPN vendor, list server locations, or describe authentication architecture in depth. That level of detail belongs in a formal security questionnaire or a signed NDA context, not a sales conversation.

The Two Failure Modes

In our view, small firms tend to fail this moment in one of two directions.

The first is oversharing. Enthusiastic practitioners sometimes recite their entire security stack, from router models to endpoint software, in an effort to impress. Beyond consuming meeting time, this creates genuine risk: details disclosed in a pitch deck have a way of ending up in email threads and shared drives.

The second failure is vagueness. "We take security very seriously" is the accounting equivalent of a qualified opinion with no findings — technically present, substantively empty. Prospects who have recently completed SOC 2 questionnaires or lender due diligence recognize deflection immediately, and they discount for it.

The middle path — specific controls, stated briefly, with an offer to go deeper through proper channels — requires preparation. We'd suggest firms script it the way they'd script a response to a fee objection, and rehearse it.

Why This Matters More for Small Firms

There is a fair objection here: large firms have marketing departments, security pages on their websites, and formal third-party risk programs. Isn't this bar unfair to a two-partner practice?

Perhaps. But the practical reality runs the other way. A small firm's prospect has fewer external signals to evaluate — no brand, no security microsite, no annual report. The conversation itself carries nearly all the evidentiary weight. That makes the fifty seconds spent describing your remote-access posture disproportionately valuable. It is one of the few moments where a small firm can compete with a national brand on something other than price.

And there is a defensive argument as well. As cyber insurers and, increasingly, peer review processes pull VPN and remote-access practices into their questionnaires, the firms that have already articulated these controls to clients will find the formal versions of those questions far easier to answer.

An Uncomfortable but Useful Test

Before your next prospect meeting, try this exercise: imagine the prospect's CFO asks, point blank, "How do your people get into my files when they're not in the office?" If your honest answer takes longer than a minute, rambles, or includes the phrase "we really should look into that," the gap isn't in your communication. It's in your setup.

In that case, the VPN review is the place to start — not the pitch. Prospective clients are watching. The firms that thrive in this environment won't be the ones with the most sophisticated tunnels, but the ones that can explain, calmly and specifically, why the tunnel they have is the right one.