Connect with us

Accounting

Firms to disable Windows Recall, but third parties remain a risk

Published

1 year ago

on

Despite security enhancements from Microsoft, CPA firms are likely to disable the controversial Recall feature in Windows 11, which uses AI to create a precise record of user activity, but leaders concede there is little they can do about potential indirect tracking via third parties that still have it enabled. 

Recall, debuted by Microsoft about a year ago, works by taking a screenshot of a user’s desktop every few seconds and then uses on-device large language models to allow a user to retrieve items and information that had previously been on their screen. Following a major public backlash on privacy and security grounds, the company delayed the feature’s implementation to address people’s concerns. 

Last September, Microsoft said that Recall will now encrypt snapshots and other associated information, and will only be able to be used within a Virtualization-based Security Enclave (essentially, a way to isolate a specific program inside the processor so that whatever happens inside stays inside, even if the rest of the machine is compromised, comparable to a panic room but digital) At the end of last month, after testing the feature for select users, Microsoft rolled it out for general availability for Windows 11. Microsoft has been urging people to upgrade from previous versions and said it would be shutting down support for Windows 10 in October. 

Robot Eye AI
High-tech computer digital technology, global surveillance

valerybrozhinsky – stock.adobe.c

Cory Wolf, director of offensive security with cybersecurity consulting firm risk3sixty, said these new changes have allayed many concerns about the Recall feature between when it was first launched and now. He noted that the initial release was indeed a major security challenge, adding that Microsoft rushed it without going through the typical insider preview process and so did not account for the security issues, but has improved the solution since then. 

“That was why everyone was freaking out, it was clear they did not do any security around it, did not go through previews and at the time it was a real security risk. Now it is going through the proper channels of Windows preview, they added content filtering, they added the virtual machine component … at least from a cybersecurity perspective, it’s really worked out and they’ve improved it quite a bit,” he said. 

Despite these changes, however, some firms are still opting to disable recall on their devices, such as California-based Navolio & Tallman LLP. Though they intend to soon get laptops specifically optimized for AI solutions, IT partner Stephanie Ringrose said that, for now at least, they’re going to disable the feature. 

“We started with the hardware that has the new processor, so that as technology comes out that has more AI in it, we’re set up for success. … So we’re open to new technology. Another part is we like to be on the leading edge, but we’re not necessarily on the bleeding edge, so initially [Recall] does not seem like something we need right away, so our plan currently is to disable it,” she said in an interview. 

Top 50 firm LBMC will also be disabling Recall, according to chief digital and technology officer David Maynard. He raised concerns about the security implications, such as the inadvertent storing of sensitive data via screenshot captures, the use of LLM-powered indexing opening up the possibility for prompt injection attacks, insider threat risks of administrative access being misused, as well as compliance and legal exposure under data protection laws. 

“With specific regard to Microsoft’s Windows 11 Recall feature, we are closely monitoring its development and capabilities as we do all other tools. Microsoft is a trusted partner and delivers some of the most powerful enterprise tools. That said, all evolving technology tools present unique challenges that merit thorough scrutiny, especially for professional services firms handling high volumes of confidential and regulated data. … We are currently disabling Recall by policy across all internal devices, even though it remains in preview. Our experts are also considering the broader implications of using LLMs in enterprise settings and continuing to test the Recall functionality in non-production environments to inform both internal and client-facing recommendations,” he said in an email. 

Still, while firms can take action for themselves, the indirect third party risk remains. While one user might disable Recall, anything shared with someone who has enabled it will be saved to their device, which could still result in data leakage and cyber incidents. Imagine someone from a firm with Recall disabled talking about sensitive matters with a vendor who does have it enabled; now imagine that vendor getting hacked and the attackers getting that sensitive data despite the firm itself protecting on their end. 

Ringrose said that while there are measures a firm can take, there are limits to how much they can control third parties. The firm can have open communications and be vigilant about their data but there is only so much one can do. 

“This [applies to] almost all technology when communicating with outside parties, that you cannot really control what every third party uses on their side. I think there’s a couple different things we can do on the client side, [like] more education as you communicate with them… you have open discussions with them on how they intend to use it and help be an advisor if [the risks] come up,” she said. 

LBMC took a similar position, saying that it can’t really control what other parties do, so they need to be careful about what they, themselves, disclose to outside parties. 

“LBMC can control only its devices, not third-party assets. Management and understanding of Recall’s implications are necessary before sharing information,” said Maynard. 

But at the same time, the two said it’s not that much different than any other communications technology. Yes, third parties might capture sensitive data through Recall, but the same thing could happen with irresponsible emails or file shares too. In this respect, while the firms intend to have controls over the use of the feature, they would be no different than the controls they would require for any other new technology.

“It’s like email, you know? It’s like any form of communication—you’re putting something out there. And so it’s a little bit open to what that third party is using,” said Ringrose. 

Maynard raised a similar point: while LBMC will be thoroughly evaluating Recall for safety, it does so for every new piece of technology it potentially could adopt. At a high level, every new tool under consideration—whether developed internally, by a third party, or as part of a widely used platform—is assessed using a phased model. The evaluation model encompasses infrastructure and compatibility review, security review, privacy and data governance review, legal and regulatory risk assessment, ethical and professional standards alignment, cybersecurity and AI committee input, governance and approvals process, a test phase with controlled rollouts, then training, usage, policies and compliance integration. 

“Window 11 Recall is just one of many emerging technologies that highlights the need for organizations, especially those in regulated industries like accounting to have a structured enterprise-wide process for evaluating new tools. At LBMC we view every innovation through a multidimensional lens balancing potential benefits with security, privacy, regulatory and ethical considerations. Our approach is part of a broader, proactive framework that involves cross functional expertise from cybersecurity, AI, legal, compliance and operational leadership. This is how we ensure new technology aligns not only with our internal standards, but with the expectations of the clients and industries we serve,” he said. 

Wolf, from risk3sixty, said that while the risks from improper use are real, at this point they are not dramatically greater than other solutions. He noted that many CPA firms already have third party risk management programs and it wouldn’t be difficult to work Recall into these already existing controls. However, he said it might be more of a lift for those who do not already have these programs in place. 

“So when doing vendor questionnaires and audits they should bake in Recall, things like doing security awareness training around Recall, that should be baked into that, but it definitely needs adjustment … for smaller firms that do not have one. Contractual obligation is their best recourse. It’s no different than sending something to a noncompany email for example, the risks are still the same,” he said. 

There was similar thinking regarding remote work and bring-you-own-device policies. Many firms already have specific security policies in these areas, and while Recall is a factor in both cases, there appears to be little need to carve out an entire new set of policies specifically for this feature. Firms should be diligent with their cybersecurity overall, said Maynard, which includes accounting for Recall but no more than other tools. 

“For accounting and advisory firms, any tool that touches client data must be evaluated not just on features—but on trust, integrity, and compliance. We believe that by embedding subject matter expertise into every phase of the evaluation process, firms can strike the right balance between innovation and responsibility,” he said.

Related Topics:
Continue Reading

Accounting

SEC’s Semiannual Reporting Proposal Faces Investor Pushback: What CFOs Need to Know

Published

1 day ago

on

August 25, 2026

By

U.S. Securities and Exchange Commission (SEC)

A proposal from the U.S. Securities and Exchange Commission to potentially shift some public companies away from quarterly financial reporting toward a semiannual model is drawing significant pushback from investors, even as it continues moving through the regulatory process. The debate has direct implications for corporate finance teams, auditors, and the broader transparency of U.S. capital markets.

What the SEC Proposed

According to a summary published by accounting advisory firm Cohen & Co., the SEC issued a proposed rule on May 19, 2026, aimed at simplifying financial reporting requirements for many U.S. public companies. The proposal would potentially reduce the frequency of certain mandatory disclosures from quarterly to semiannual, a structural change that has not been made to core U.S. reporting requirements in decades.

The proposal follows an extended debate within U.S. policy circles, with proponents arguing that reduced reporting frequency could lower compliance costs and free up management time for longer-term strategic planning rather than quarter-to-quarter results management.

Why Investors Are Pushing Back

Comment letters submitted in response to the proposal have been extensive, and according to Cohen & Co.’s review of the public record, investors “appear to be largely opposed” to the shift, viewing frequent interim reporting as a core benefit of U.S. capital markets relative to other jurisdictions.

Accounting and law firms have taken a more measured position, generally urging any changes to remain aligned with the Financial Accounting Standards Board (FASB), whose existing disclosure requirements and guidance are built around a quarterly reporting cadence. A shift to semiannual reporting without corresponding changes to FASB guidance could create friction between SEC filing requirements and GAAP-based disclosure expectations.

Lessons From the U.K. Experience

The debate is not without precedent. The United Kingdom moved away from mandatory quarterly reporting for listed companies in 2014, returning to a semiannual disclosure requirement. According to Cohen & Co.’s analysis, that experience offers a cautionary data point: there was no measurable increase in capital expenditure or R&D investment following the change, while analyst coverage of affected companies declined as reliable interim information became less available — a particular risk for smaller and newly public companies that rely on analyst coverage to maintain investor visibility.

Practical Implications for Finance Teams

Beyond the debate over disclosure philosophy, the proposal carries practical complications. Many companies have debt covenants and credit agreements structured around quarterly financial delivery; a shift to semiannual reporting could require renegotiating those terms. Reduced reporting frequency would also extend the “window of market silence” between disclosures, a factor that governance and investor-relations teams would need to manage carefully to avoid information asymmetry.

Separately, and unrelated to the reporting-frequency debate, the SEC and FASB have continued finalizing more routine updates this year. New Accounting Standards Updates are taking effect for December 31, 2026, fiscal year-ends covering income tax disclosures, credit loss measurement, induced debt conversions, and stock compensation, according to Eide Bailly’s review of 2026 ASU activity. Additional guidance on paid-in-kind dividends and environmental credits is also on the near-term horizon.

What to Watch Next

The semiannual reporting proposal remains in the comment and review phase, and no final rule has been adopted as of this writing. Finance leaders should monitor the SEC’s regulatory agenda for further movement, while treating the current quarterly reporting requirement as the operative standard until any final rule is issued and an effective date is set.

Given the extent of investor opposition documented in the comment file, a full shift to mandatory semiannual reporting appears more likely to result in either a scaled-back compromise or continued study rather than swift adoption — though the SEC’s ultimate direction remains uncertain.

 

Continue Reading

Accounting

AI-Driven Automation and Continuous Accounting Frameworks

Published

2 weeks ago

on

August 15, 2026

By

The accounting profession is undergoing a fundamental structural transition as enterprise finance departments shift from periodic month-end closes toward automated continuous accounting models. By integrating specialized machine learning algorithms directly into enterprise resource planning (ERP) platforms, chief accounting officers are transforming financial reporting from a retrospective exercise into a real-time operational asset.

The Shift from Periodic Close to Continuous Financial Reporting
Traditional accounting workflows heavily relied on manual data reconciliation, spreadsheet calculations, and multi-week closing cycles at the end of each fiscal period. In contrast, continuous accounting frameworks utilize automated software agents to process, validate, and post transactional data in real time as business activities occur.

Automated bank reconciliation tools cross-reference incoming bank feeds, invoice records, and purchase orders automatically. By resolving transactional variances instantly throughout the month, corporate accounting teams eliminate the traditional workload spikes associated with quarterly and annual closes.

Machine Learning in Audit Trails and Anomaly Detection
Advanced natural language processing (NLP) and machine learning tools are redefining internal audit and financial control environments. Automated systems analyze 100% of general ledger entries, identifying anomalous transactions, duplicate payments, and unauthorized journal entries in real time.

Rather than relying on random statistical sampling, corporate internal auditors can focus their attention on high-risk flags automatically surfaced by algorithmic monitoring platforms. This continuous risk assessment strengthens internal controls over financial reporting (ICFR) and significantly reduces fraud risk.

Evolving Roles for Accounting Professionals
As routine data entry and manual reconciliation tasks become fully automated, the skill set required for accounting professionals is shifting toward data analysis, system design, and strategic business advisory.
– Systems Governance: Accountants are increasingly responsible for monitoring algorithmic accuracy and managing data integration pipelines.
– Business Partnership: Finance professionals leverage real-time financial dashboards to advise operational leaders on margin management and working capital allocation.
– Regulatory Compliance Management: Accounting teams utilize automated platforms to ensure compliance with dynamic tax codes and international accounting standards.

Core Implementation Recommendations
1. Deploy Automated Reconciliation Tools: Integrate continuous transaction processing modules into existing enterprise ERP architectures.
2. Establish Algorithmic Governance Controls: Implement strict internal testing protocols to ensure automated accounting rules comply with GAAP/IFRS standards.
3. Reskill Accounting Teams: Invest in training finance staff on data analytics, workflow automation, and predictive financial modeling.

Continue Reading

Accounting

Global ESG Reporting Standards and Double Materiality Compliance

Published

2 weeks ago

on

August 9, 2026

By

Corporate accounting departments face expanding reporting expectations as international sustainability disclosure standards achieve regulatory enforcement across major global jurisdictions. Chief Accounting Officers (CAOs) and corporate controllers are establishing rigorous internal accounting controls to treat Environmental, Social, and Governance (ESG) metrics with the same data precision, auditability, and governance as traditional financial statements.

Regulatory Harmonization Under Global Sustainability Frameworks
The implementation of standardized sustainability reporting frameworks—notably rules established by international sustainability accounting boards—has created unified expectations for public and large private enterprises. Corporations must report standardized metrics covering greenhouse gas emissions (Scope 1, 2, and material Scope 3), energy utilization, workforce demographics, and supply chain governance.

In Europe and other participating international jurisdictions, double materiality principles are mandatory. Under double materiality, organizations must report both how external sustainability risks impact corporate financial performance, and how internal corporate operations affect surrounding environmental and social structures.

Integrating Sustainability Metrics into Core ERP Systems
To provide auditable non-financial data, enterprise organizations are integrating specialized carbon accounting and ESG management platforms directly into core ERP systems. Automated data collectors capture energy utility invoices, logistics fuel consumption metrics, and vendor compliance records in real time.

Establishing automated, traceable data pipelines ensures that non-financial reporting is supported by clear audit trails. This structured approach allows external financial auditors to provide reasonable assurance on sustainability disclosures during annual corporate reporting cycles.

Financial Impacts and Capital Market Disclosure
Accurate ESG reporting directly influences corporate cost of capital and institutional credit ratings. Commercial lenders and institutional asset managers systematically incorporate sustainability metrics into risk pricing models. Companies that demonstrate transparent, verifiable progress in operational energy efficiency and climate risk mitigation benefit from expanded access to green bond markets and lower debt pricing.

Action Steps for Accounting Leadership
1. Implement Double Materiality Frameworks: Conduct comprehensive assessments to identify material financial and operational sustainability metrics.
2. Build Auditable Non-Financial Data Pipelines: Automate ESG data collection within core accounting software to ensure data integrity.
3. Align Sustainability with Annual Financial Filings: Prepare non-financial disclosures concurrently with financial statements to satisfy regulatory audit expectations.

Continue Reading

Trending