Accounting
Firms to disable Windows Recall, but third parties remain a risk
Despite security enhancements from Microsoft, CPA firms are likely to disable the controversial Recall feature in Windows 11, which
Last September,
valerybrozhinsky – stock.adobe.c
Cory Wolf, director of offensive security with cybersecurity consulting firm risk3sixty, said these new changes have allayed many concerns about the Recall feature between when it was first launched and now. He noted that the initial release was indeed a major security challenge, adding that Microsoft rushed it without going through the typical insider preview process and so did not account for the security issues, but has improved the solution since then.
“That was why everyone was freaking out, it was clear they did not do any security around it, did not go through previews and at the time it was a real security risk. Now it is going through the proper channels of Windows preview, they added content filtering, they added the virtual machine component … at least from a cybersecurity perspective, it’s really worked out and they’ve improved it quite a bit,” he said.
Despite these changes, however, some firms are still opting to disable recall on their devices, such as California-based Navolio & Tallman LLP. Though they intend to soon get laptops specifically optimized for AI solutions, IT partner Stephanie Ringrose said that, for now at least, they’re going to disable the feature.
“We started with the hardware that has the new processor, so that as technology comes out that has more AI in it, we’re set up for success. … So we’re open to new technology. Another part is we like to be on the leading edge, but we’re not necessarily on the bleeding edge, so initially [Recall] does not seem like something we need right away, so our plan currently is to disable it,” she said in an interview.
Top 50 firm LBMC will also be disabling Recall, according to chief digital and technology officer David Maynard. He raised concerns about the security implications, such as the inadvertent storing of sensitive data via screenshot captures, the use of LLM-powered indexing opening up the possibility for prompt injection attacks, insider threat risks of administrative access being misused, as well as compliance and legal exposure under data protection laws.
“With specific regard to Microsoft’s Windows 11 Recall feature, we are closely monitoring its development and capabilities as we do all other tools. Microsoft is a trusted partner and delivers some of the most powerful enterprise tools. That said, all evolving technology tools present unique challenges that merit thorough scrutiny, especially for professional services firms handling high volumes of confidential and regulated data. … We are currently disabling Recall by policy across all internal devices, even though it remains in preview. Our experts are also considering the broader implications of using LLMs in enterprise settings and continuing to test the Recall functionality in non-production environments to inform both internal and client-facing recommendations,” he said in an email.
Still, while firms can take action for themselves, the indirect third party risk remains. While one user might disable Recall, anything shared with someone who has enabled it will be saved to their device, which could still result in data leakage and cyber incidents. Imagine someone from a firm with Recall disabled talking about sensitive matters with a vendor who does have it enabled; now imagine that vendor getting hacked and the attackers getting that sensitive data despite the firm itself protecting on their end.
Ringrose said that while there are measures a firm can take, there are limits to how much they can control third parties. The firm can have open communications and be vigilant about their data but there is only so much one can do.
“This [applies to] almost all technology when communicating with outside parties, that you cannot really control what every third party uses on their side. I think there’s a couple different things we can do on the client side, [like] more education as you communicate with them… you have open discussions with them on how they intend to use it and help be an advisor if [the risks] come up,” she said.
LBMC took a similar position, saying that it can’t really control what other parties do, so they need to be careful about what they, themselves, disclose to outside parties.
“LBMC can control only its devices, not third-party assets. Management and understanding of Recall’s implications are necessary before sharing information,” said Maynard.
But at the same time, the two said it’s not that much different than any other communications technology. Yes, third parties might capture sensitive data through Recall, but the same thing could happen with irresponsible emails or file shares too. In this respect, while the firms intend to have controls over the use of the feature, they would be no different than the controls they would require for any other new technology.
“It’s like email, you know? It’s like any form of communication—you’re putting something out there. And so it’s a little bit open to what that third party is using,” said Ringrose.
Maynard raised a similar point: while LBMC will be thoroughly evaluating Recall for safety, it does so for every new piece of technology it potentially could adopt. At a high level, every new tool under consideration—whether developed internally, by a third party, or as part of a widely used platform—is assessed using a phased model. The evaluation model encompasses infrastructure and compatibility review, security review, privacy and data governance review, legal and regulatory risk assessment, ethical and professional standards alignment, cybersecurity and AI committee input, governance and approvals process, a test phase with controlled rollouts, then training, usage, policies and compliance integration.
“Window 11 Recall is just one of many emerging technologies that highlights the need for organizations, especially those in regulated industries like accounting to have a structured enterprise-wide process for evaluating new tools. At LBMC we view every innovation through a multidimensional lens balancing potential benefits with security, privacy, regulatory and ethical considerations. Our approach is part of a broader, proactive framework that involves cross functional expertise from cybersecurity, AI, legal, compliance and operational leadership. This is how we ensure new technology aligns not only with our internal standards, but with the expectations of the clients and industries we serve,” he said.
Wolf, from risk3sixty, said that while the risks from improper use are real, at this point they are not dramatically greater than other solutions. He noted that many CPA firms already have third party risk management programs and it wouldn’t be difficult to work Recall into these already existing controls. However, he said it might be more of a lift for those who do not already have these programs in place.
“So when doing vendor questionnaires and audits they should bake in Recall, things like doing security awareness training around Recall, that should be baked into that, but it definitely needs adjustment … for smaller firms that do not have one. Contractual obligation is their best recourse. It’s no different than sending something to a noncompany email for example, the risks are still the same,” he said.
There was similar thinking regarding remote work and bring-you-own-device policies. Many firms already have specific security policies in these areas, and while Recall is a factor in both cases, there appears to be little need to carve out an entire new set of policies specifically for this feature. Firms should be diligent with their cybersecurity overall, said Maynard, which includes accounting for Recall but no more than other tools.
“For accounting and advisory firms, any tool that touches client data must be evaluated not just on features—but on trust, integrity, and compliance. We believe that by embedding subject matter expertise into every phase of the evaluation process, firms can strike the right balance between innovation and responsibility,” he said.
Al Drago/Bloomberg
President Donald Trump called on members of his party to unite behind his economic agenda in Congress, putting pressure on factions of lawmakers who are calling for last-minute changes to the legislation to drop their demands.
“We don’t need ‘GRANDSTANDERS’ in the Republican Party,” Trump said in a social media post on Friday. “STOP TALKING, AND GET IT DONE! It is time to fix the MESS that Biden and the Democrats gave us. Thank you for your attention to this matter!”
Trump sent the post from Air Force One after departing the Middle East as the House Budget Committee was meeting to approve the legislation, one of the final steps before the bill can move to the House floor for a vote.
House Speaker Mike Johnson has set a goal to pass the bill next week before the House recesses for its Memorial Day break.
However, the the bill
Narrow majorities in the House mean that a small group of Republicans can block the bill. Factions pushing for steeper Medicaid cuts and for an increase to the SALT write-off have both threatened to defeat the bill unless their demands are met.
“No one group gets to decide all this stuff in either direction,” Representative Chip Roy, an ultraconservative Texas Republican advocating for bigger spending cuts, said in a brief interview on Friday. “There are key issues that we think have this budget falling short.”
Trump’s social media muscle and calls to lawmakers have previously been crucial to advancing his priorities and come as competing constituencies have threatened to tank the measure.
But shortly after Trump’s Friday post, Roy and fellow hardliner Ralph Norman of South Carolina appeared unmoved — at least for the moment. Both men urged continued negotiations and significant changes to the bill that could in turn jeopardize support among moderates.
“I’m a hard no until we get this ironed out,” Norman said. “I think we can. We’ve made progress but it just takes time”
While CPA firms far and wide have made major technology investments over the years, the vast majority of accountants say they’re not being used to their full potential.
This finding comes from a recent survey undertaken by
“We see employees make workarounds with tech stacks, which makes headaches that I think align with this 43%. We train people on new things, we ask them to use them, and they keep doing what they were doing before and only use the technology as much as they have to [in order to] move things along while you have people well trained on the software keeping up,” she said in a webcast on Thursday about the survey.
Ariege Misherghi—senior vice president and general manager of accounts payable, accounts receivable and the accountant channel—said the issue isn’t just because of firms but also vendors that don’t provide enough support, and may not necessarily understand the profession in the first place.
“Too often I think tools aren’t fully aligned with the workflows they’re meant to support. In SaaS they talk about product-market fit, but in this profession it’s not just that but also product-firm fit, and maybe product-profession fit. Not every tool marketed to accountants was built by people who truly understand how this profession works: the rhythms, the regulations, the stakes, the relationships, all of that. And even the greatest tools can fall short if they’re not implemented with a deep understanding of how firms really operate,” she said.
And sometimes the inefficiencies come from both sides at once: the survey found that only 37% of firms require clients to use their tech stack, something that Munson said “breaks my heart” as “it is so low.” A streamlined, established tech stack is needed to achieve true economies of scale, but to get there firms need to standardize their data, and to do that firms need to make sure their clients’ data is also standardized, which usually means integrated tech stacks.
“If you have all these different clients with all these different technologies, even if your own tech stack is standardized the systems they use is different, so the kind of data you will get will be different, and the work you need to do to make it work with your data is different, and your team spends a lot of time spinning their wheels,” she said. “Once you get standardized, where everything back and forth from clients is the same, you get to see how well the teams can do their work.”
One source of inefficiencies is a rushed implementation. Munson said that, too many times, firms are so eager to get a solution working that they don’t pay attention to all its capacities, just the ones they need right now, but once the basics are down firms still don’t circle back on the rest of the features and how they can be used to drive efficiency.
“Most of us have been through an implementation, either in the practice or with a client, where you’re just like ‘anything to get it working. Forget about all the fancy things it does. We just needed to do the basics right,’ and then we never circle back on those better, more efficient processes. We get to sort of minimal viable, and then we forget to come back and give it an extra polish. And so what we see there is the processes get written for that basic piece, and we never update,” she said.
But this is part of what both speakers believed was the larger problem of firms getting lost in the details of their tech stacks and not taking a broader, more holistic approach, which would enable more efficiencies. The key component to managing technology effectively, Munson said, is looking not at individual solutions here and there but thinking of the system as a whole.
“Often, what happens is something’s wrong or something is troublesome in some way. And so [we say] what can we do to fix that one thing? And we don’t think about it holistically and get all the right folks in there so that we’re solving for the right pain points,” she said.
Misherghi agreed, and added that this holistic extends not only to the technology a firm already has but the solutions they plan to purchase in the future. When evaluating what technology they need, she said leaders need to think not in terms of specific point solutions to particular problems but things that can support the entire workflow—plus, the onboarding, training and ongoing support from the vendor.
“Don’t just look for features, right? Look for solutions that support your workflows from providers that understand you. For firms, onboarding and training and optimization can’t be an afterthought. They’re essential to realizing value. I think this is where vendor partnerships matter. Firms seeking the strongest results aren’t just using software, they’re collaborating with their providers, they’re staying educated, they’re making sure their tools evolve alongside their needs. The best outcomes happen when your technology partner acts like part of your team, not just part of your toolkit,” she said.
Misherghi said that the more successful firms she’s seen think less in terms of performing particular tasks but designing an entire system that, through automation, can do those tasks for them. It is less about plugging holes and more about developing a full infrastructure. The survey found that 74% of participants have a detailed plan to add new services in the next 12 month; Misherghi noted that, among these firms, 86% have a detailed technology roadmap, which is “a wonderful mark on the evolution of the profession we’re seeing.”
She said a good tech roadmap is more like a service design blueprint versus a shopping list. Successful firms, she said, are not just chasing features but designing intentional workflows and systems capable of scalable service delivery. Similarly, she stressed that the provider should be more than just a vendor but a strategic co-architect that can help with growing pains.
Misherghi said this approach will become especially relevant as AI becomes more common, as integrations will be key to their effective use, which means thinking in terms of the whole system to understand where those integrations should take place. Right now, she said, people think of AI in terms of analyzing data or extracting fields, but with the rise of AI agents will require firms to focus more on coordinating between them.
“I think the next big leap is when those systems don’t just talk to each other, they act on each other’s behalf. I think the next big inflection point will be moving from automated steps to autonomous workflows, where AI agents aren’t just analyzing data or extracting fields but actually orchestrating tasks across tools based on firm policies and context and that will change the role of the accounting profession: its less time doing the work and more time designing the system for how everything works together. So the firms that will be thriving are those who are building strong infrastructure now because that is what AI needs to deliver on its core value,” she said.
A key House committee on Friday failed to advance House Republicans’ massive tax-and-spending bill after hard-line conservatives bucked President Donald Trump and blocked the bill over cost concerns.
The House Budget Committee rejected
It’s incredibly rare for bills to fail at this step in the process, with the committee vote typically serving as a rubber-stamp to the bill before it moves to the House floor.
Stefani Reynolds/Photographer: Stefani Reynolds/B
The setback could be temporary and the panel can still approve the bill once the GOP differences are resolved.
Republican Lloyd Smucker, who switched his vote to “no” to allow the committee to bring it up again, told reporters the committee will hold another vote on Monday.
Trump, whose social media muscle and calls to lawmakers have previously been crucial to advancing his priorities, inserted himself in the debate less than two hours before the vote, berating dissidents and urging them to fall into line.
“We don’t need ‘GRANDSTANDERS’ in the Republican Party,” Trump said in a social media post on Friday. “STOP TALKING, AND GET IT DONE! It is time to fix the MESS that Biden and the Democrats gave us. Thank you for your attention to this matter!”
The bill’s failure exposes the power a small group of lawmakers can wield as Republicans seek to push Trump’s “one big, beautiful bill” through the House with very narrow margins. GOP infighting threatens to kill the bill, or at least significantly delay Republicans’ plans to pass the bill next week.
(Read more: “
Republican holdouts spelled out their demands during Friday’s committee meeting, including accelerating new work requirements for able-bodied adults on Medicaid to take effect immediately rather the 2029 deadline set in the legislation. The ultraconservatives also want a faster phase-out of clean energy tax credits.
It wasn’t immediately clear how House Republicans will re-group to address the divisions and advance the bill.
“I’ll let you know this weekend if we’re going to return first thing Monday. That’s the goal at this point,” Budget Chairman Jodey Arrington said after the vote.
House Majority Leader Steve Scalise, who is helping to broker a deal among Republicans, said party leaders are in touch with the Trump administration to address some of the changes demanded by hardliners.
“We are all in agreement on the reforms we want to make,” Scalise said. “We want to have work requirements. We want to phase out a lot of these green subsidies. How quickly can you get it done?”
House Speaker Mike Johnson on Thursday pledged he would work through the weekend to broker a compromise between moderates, who are seeking an increase in state and local tax deductions, and ultra-conservatives, who say they won’t support it without more spending cuts.
(Read more: “
Members from both factions — the SALT Republicans representing high-tax districts and the fiscal hawks who want steeper budget reductions — have threatened to block the bill if House leaders don’t acquiesce to their demands.
“No one group gets to decide all this stuff in either direction,” Roy, an ultraconservative Texas Republican advocating for bigger spending cuts, said in a brief interview on Friday. “There are key issues that we think have this budget falling short.”
Both Roy and Norman urged continued negotiations and significant changes to the bill that could in turn jeopardize support among moderates.
“I’m a hard no until we get this ironed out,” Norman said. “I think we can. We’ve made progress but it just takes time.”
If the legislation passes the House, it would then head to the Senate where it would likely undergo significant changes. Several members, including Senator Josh Hawley of Missouri, have stated opposition to the Medicaid cuts in the House bill.
Trump berates Republicans to ‘Stop talking,’ pass tax cuts
97% say CPA firms not using tech efficiently says survey
Trump tax bill fails in House panel
New 2023 K-1 instructions stir the CAMT pot for partnerships and corporations
The Essential Practice of Bank and Credit Card Statement Reconciliation
Are American progressives making themselves sad?
-
Personal Finance1 week agoHow consumers prepare for an economic hit
-
Personal Finance1 week agoI bonds investments and Trump’s tariff policy: What to know
-
Personal Finance1 week agoReal estate and gold vs. stocks: Best long-term investment
-
Economics1 week agoAndrew Bailey on why UK-U.S. trade deal won’t end uncertainty
-
Economics1 week agoThe president has deleted a key tenet of American civil-rights law
-
Economics1 week ago
Trump knocks down a controversial pillar of civil-rights law
-
Economics1 week agoA social history of America in a warehouse
-
Economics1 week agoOne of the most controversial executive orders will shortly land at SCOTUS