Accounting
Firms to disable Windows Recall, but third parties remain a risk
Despite security enhancements from Microsoft, CPA firms are likely to disable the controversial Recall feature in Windows 11, which
Last September,
valerybrozhinsky – stock.adobe.c
Cory Wolf, director of offensive security with cybersecurity consulting firm risk3sixty, said these new changes have allayed many concerns about the Recall feature between when it was first launched and now. He noted that the initial release was indeed a major security challenge, adding that Microsoft rushed it without going through the typical insider preview process and so did not account for the security issues, but has improved the solution since then.
“That was why everyone was freaking out, it was clear they did not do any security around it, did not go through previews and at the time it was a real security risk. Now it is going through the proper channels of Windows preview, they added content filtering, they added the virtual machine component … at least from a cybersecurity perspective, it’s really worked out and they’ve improved it quite a bit,” he said.
Despite these changes, however, some firms are still opting to disable recall on their devices, such as California-based Navolio & Tallman LLP. Though they intend to soon get laptops specifically optimized for AI solutions, IT partner Stephanie Ringrose said that, for now at least, they’re going to disable the feature.
“We started with the hardware that has the new processor, so that as technology comes out that has more AI in it, we’re set up for success. … So we’re open to new technology. Another part is we like to be on the leading edge, but we’re not necessarily on the bleeding edge, so initially [Recall] does not seem like something we need right away, so our plan currently is to disable it,” she said in an interview.
Top 50 firm LBMC will also be disabling Recall, according to chief digital and technology officer David Maynard. He raised concerns about the security implications, such as the inadvertent storing of sensitive data via screenshot captures, the use of LLM-powered indexing opening up the possibility for prompt injection attacks, insider threat risks of administrative access being misused, as well as compliance and legal exposure under data protection laws.
“With specific regard to Microsoft’s Windows 11 Recall feature, we are closely monitoring its development and capabilities as we do all other tools. Microsoft is a trusted partner and delivers some of the most powerful enterprise tools. That said, all evolving technology tools present unique challenges that merit thorough scrutiny, especially for professional services firms handling high volumes of confidential and regulated data. … We are currently disabling Recall by policy across all internal devices, even though it remains in preview. Our experts are also considering the broader implications of using LLMs in enterprise settings and continuing to test the Recall functionality in non-production environments to inform both internal and client-facing recommendations,” he said in an email.
Still, while firms can take action for themselves, the indirect third party risk remains. While one user might disable Recall, anything shared with someone who has enabled it will be saved to their device, which could still result in data leakage and cyber incidents. Imagine someone from a firm with Recall disabled talking about sensitive matters with a vendor who does have it enabled; now imagine that vendor getting hacked and the attackers getting that sensitive data despite the firm itself protecting on their end.
Ringrose said that while there are measures a firm can take, there are limits to how much they can control third parties. The firm can have open communications and be vigilant about their data but there is only so much one can do.
“This [applies to] almost all technology when communicating with outside parties, that you cannot really control what every third party uses on their side. I think there’s a couple different things we can do on the client side, [like] more education as you communicate with them… you have open discussions with them on how they intend to use it and help be an advisor if [the risks] come up,” she said.
LBMC took a similar position, saying that it can’t really control what other parties do, so they need to be careful about what they, themselves, disclose to outside parties.
“LBMC can control only its devices, not third-party assets. Management and understanding of Recall’s implications are necessary before sharing information,” said Maynard.
But at the same time, the two said it’s not that much different than any other communications technology. Yes, third parties might capture sensitive data through Recall, but the same thing could happen with irresponsible emails or file shares too. In this respect, while the firms intend to have controls over the use of the feature, they would be no different than the controls they would require for any other new technology.
“It’s like email, you know? It’s like any form of communication—you’re putting something out there. And so it’s a little bit open to what that third party is using,” said Ringrose.
Maynard raised a similar point: while LBMC will be thoroughly evaluating Recall for safety, it does so for every new piece of technology it potentially could adopt. At a high level, every new tool under consideration—whether developed internally, by a third party, or as part of a widely used platform—is assessed using a phased model. The evaluation model encompasses infrastructure and compatibility review, security review, privacy and data governance review, legal and regulatory risk assessment, ethical and professional standards alignment, cybersecurity and AI committee input, governance and approvals process, a test phase with controlled rollouts, then training, usage, policies and compliance integration.
“Window 11 Recall is just one of many emerging technologies that highlights the need for organizations, especially those in regulated industries like accounting to have a structured enterprise-wide process for evaluating new tools. At LBMC we view every innovation through a multidimensional lens balancing potential benefits with security, privacy, regulatory and ethical considerations. Our approach is part of a broader, proactive framework that involves cross functional expertise from cybersecurity, AI, legal, compliance and operational leadership. This is how we ensure new technology aligns not only with our internal standards, but with the expectations of the clients and industries we serve,” he said.
Wolf, from risk3sixty, said that while the risks from improper use are real, at this point they are not dramatically greater than other solutions. He noted that many CPA firms already have third party risk management programs and it wouldn’t be difficult to work Recall into these already existing controls. However, he said it might be more of a lift for those who do not already have these programs in place.
“So when doing vendor questionnaires and audits they should bake in Recall, things like doing security awareness training around Recall, that should be baked into that, but it definitely needs adjustment … for smaller firms that do not have one. Contractual obligation is their best recourse. It’s no different than sending something to a noncompany email for example, the risks are still the same,” he said.
There was similar thinking regarding remote work and bring-you-own-device policies. Many firms already have specific security policies in these areas, and while Recall is a factor in both cases, there appears to be little need to carve out an entire new set of policies specifically for this feature. Firms should be diligent with their cybersecurity overall, said Maynard, which includes accounting for Recall but no more than other tools.
“For accounting and advisory firms, any tool that touches client data must be evaluated not just on features—but on trust, integrity, and compliance. We believe that by embedding subject matter expertise into every phase of the evaluation process, firms can strike the right balance between innovation and responsibility,” he said.
Jody Padar, an author and speaker known as “The Radical CPA,” and Katie Tolin, a growth strategist for CPAs, together launched a training and technology platform called XcelLabs.
XcelLabs provides solutions to help accountants use artificial technology fluently and strategically. The Pennsylvania Institute of CPAs and CPA Crossings joined with Padar and Tolin as strategic partners and investors.
“To reinvent the profession, we must start by training the professional who can then transform their firms,” Padar said in a statement. “By equipping people with data and insights that help them see things differently, they can provide better advice to their clients and firm.”
The platform includes XcelLabs Academy, a series of educational online courses on the basics of AI, being a better advisor, leadership and practice management; Navi, a proprietary tool that uses AI to help accountants turn unstructured data like emails, phone calls and meetings into insights; and training and consulting services. These offerings are currently in beta testing.
“Accountants know they need to be more advisory, but not everyone can figure out how to do it,” Tolin said in a statement. “Couple that with the fact that AI will be doing a lot of the lower-level work accountants do today, and we need to create that next level advisor now. By showing accountants how to unlock patterns in their actions and turn client conversations into emotionally intelligent advice, we can create the accounting professional of the future.”
“AI is transforming how CPAs work, and XcelLabs is focused on helping the profession evolve with it,” PICPA CEO Jennifer Cryder said in a statement. “At PICPA, we’re proud to support a mission that aligns so closely with ours: empowering firms to use AI not just for efficiency, but to drive growth, value and long-term relevance.”
The accountant the world urgently needs has evolved far beyond the traditional role we recognized just a few years ago.
The transformation of the accounting profession is not merely an anticipated change; it is a pressing reality that is currently shaping business decisions, academic programs and the expected contributions of professionals. Yet, in many areas, accounting education stubbornly clings to outdated, overly technical models that fail to connect with the actual demands of the market. We must confront a critical question: If we continue to train accountants solely to file tax reports, are we truly equipping them for the challenges of today’s world?
This shift in mindset extends beyond individual countries or educational systems; it is a global movement. The recent announcement of the
The CIMA/CGMA proposal for 2026 is not just a curriculum update; it is a powerful manifesto. This new program positions analytical thinking, strategic business partnering and technology application at the core of accounting education. It unequivocally highlights sustainability, aligning with IFRS S1 and S2, and expands the accountant’s responsibilities beyond mere numbers to encompass conscious leadership, environmental impact and corporate governance.
The current changes in the accounting profession underscore an urgent shift in expectations from both educators and employers. Today, companies of all sizes and industries demand accountants who can do far more than interpret balance sheets. They expect professionals who grasp the deeper context behind the numbers, identify inconsistencies, anticipate potential issues before they escalate into losses, and act decisively as a bridge between data and decision making.
To meet these expectations, a radical mindset shift is essential. There are firms still operating on autopilot, mindlessly repeating tasks with minimal critical analysis. Likewise, many academic programs continue to treat accounting as purely a technical discipline, disregarding the vital elements of reflection, strategy and behavioral insight. This outdated approach creates a significant mismatch. While the world forges ahead, parts of the accounting profession remain stuck in the past.
The consequences of this shift are already becoming evident. The demand for compliance, transparency and sustainability now applies not only to large corporations but also to small and mid-sized businesses. Many of these organizations rely on professionals ill-equipped to drive the necessary changes, putting both business performance and the reputation of the profession at risk.
The positive news is that accountants who are ready to thrive in this new era do not necessarily need additional degrees. What they truly need is a commitment to awareness, a dedication to continuous learning, and the courage to step beyond their comfort zones. The future of accounting is here, and it is firmly rooted in analytical, strategic and human-oriented perspectives. The 2026 curriculum is a clear indication of the changes underway. Those who fail to think critically and holistically will be left behind.
In contrast, accountants who see the big picture, understand the ripple effects of their decisions, and actively contribute to the financial and ethical health of organizations will undeniably remain indispensable, anywhere in the world.
Congressional Republicans are siding with Donald Trump in the messy divorce between the president and Elon Musk, an optimistic sign for eventual passage of a tax cut bill at the root of the two billionaires’ public feud.
Lawmakers are largely taking their cues from Trump and sticking by the $3 trillion bill at the center of the White House’s economic agenda. Musk, the biggest political donor of the 2024 cycle, has threatened to help primary anyone who votes for the legislation, but lawmakers are betting that staying in the president’s good graces is the safer path to political survival.
“The tax bill is not in jeopardy. We are going to deliver on that,” House Speaker Mike Johnson told reporters on Friday.
“I’ll tell you what — do not doubt, don’t second guess and do not challenge the President of the United States Donald Trump,” he added. “He is the leader of the party. He’s the most consequential political figure of our time.”
A fight between Trump and Musk exploded into public view this week. The sparring started with the tech titan calling the president’s tax bill a “disgusting abomination,” but quickly escalated to more personal attacks and Trump threatening to cancel all federal contracts and subsidies to Musk’s companies, such as Tesla Inc. and SpaceX which have benefitted from government ties.
Republicans on Capitol Hill, who had — until recently — publicly embraced Musk, said they weren’t swayed by the billionaire’s criticism that the bill cost too much. Lawmakers have refuted official estimates of the package, saying that the tax cuts for households, small businesses and politically important groups — including hospitality and hourly workers — will generate enough economic growth to offset the price tag.
“I don’t tell my friend Elon, I don’t argue with him about how to build rockets, and I wish he wouldn’t argue with me about how to craft legislation and pass it,” Johnson told CNBC earlier Friday.
House Budget Committee Chair Jodey Arrington told reporters that House lawmakers are focused on working with the Senate as it revises the bill to make sure the legislation has the political support in both chambers to make it to Trump’s desk for his signature.
“We move past the drama and we get the substance of what is needed to make the modest improvements that can be made,” he said.
House fiscal hawks said that they hadn’t changed their prior positions on the legislation based on Musk’s statements. They also said they agree with GOP leaders that there will be other chances to make further spending cuts outside the tax bill.
Representative Tom McClintock, a fiscal conservative, said “the bill will pass because it has to pass,” adding that both Musk and Trump needed to calm down. “They both need to take a nap,” he said.
Even some of the House bill’s most vociferous critics appeared resigned to its passage. Kentucky Representative Thomas Massie, who voted against the House version, predicted that despite Musk’s objections, the Senate will make only small changes.
“The speaker is right about one thing. This barely passed the House. If they muck with it too much in the Senate, it may not pass the House again,” he said.
Trump is pressuring lawmakers to move at breakneck speed to pass the tax-cut bill, demanding they vote on the bill before the July 4 holiday. The president has been quick to blast critics of the bill — including calling Senator Rand Paul
As the legislation worked its way through the House last month, Trump took to social media to criticize holdouts and invited undecided members to the White House to compel them to support the package. It passed by one vote.
Senate Majority Leader John Thune — who is planning to unveil his chamber’s version of the bill as soon as next week — said his timeline is unmoved by Musk.
“We are already pretty far down the trail,” he said.
Forgotten 401(k) fees cost workers thousands in retirement savings
‘What’s the point’ of saving money
XcelLabs launches to help accountants use AI
New 2023 K-1 instructions stir the CAMT pot for partnerships and corporations
The Essential Practice of Bank and Credit Card Statement Reconciliation
Are American progressives making themselves sad?
-
Blog Post7 days agoCommon Bookkeeping Challenges and Solutions for Small Businesses
-
Economics1 week agoWhy the president must not be lexicographer-in-chief
-
Finance1 week agoThis is why Jamie Dimon is so gloomy on the economy
-
Economics1 week agoAmerica has found a new lever to squeeze foreigners for cash
-
Economics1 week agoWhy would Texas Republicans object to conservative, pro-family developers?
-
Finance1 week agoPalantir teams up with Fannie Mae in AI push to sniff out mortgage fraud
-
Personal Finance1 week agoU.S. birth rate drop outpaces policy response, raising future concerns
-
Accounting1 week agoCOSO, NACD propose corporate governance framework