| IT for professional services is the technology, security and support that firms doing confidential client work rely on to protect client information, run their practice software and meet their professional and legal obligations. It covers identity and access, document handling, email and payment security, backup and recovery, and support that is clear about where the firm’s software vendors fit. |
Law firms, accounting practices, insurance brokers, engineering and architecture practices and consultancies do different work, but their IT carries a similar load. Staff need to reach the right client information quickly, the practice software has to be available when a deadline arrives, and the firm has to be able to show how client records are protected.
This guide covers what IT for professional services needs to get right across those firms: who is responsible for what, the obligations that shape the setup, the risks to plan for and the questions to ask an IT provider.
Find the guide for your type of firm
Each of these guides covers the systems and workflows specific to that kind of practice:
- Law firms. Matter files, trust accounting and settlement deadlines, in our guide to IT support for law firms.
- Accounting firms. Practice software access, client file exchange and recovery, in our accounting IT support service.
- Insurance brokers. Broking systems, client records, renewals and adviser handovers, in our guide to IT support for insurance brokers.
- Engineering and architecture firms. Design workstations, large project files and project archives, covered by our engineering IT support service.
The rest of this page covers what those firms have in common.
What is IT for professional services?
IT for professional services is ordinary business technology, such as Microsoft 365, devices, identity, connectivity and backup, arranged around the way a practice works. What makes it different is not the technology itself but the workflow it supports: confidential client files, practice software supplied by a specialist vendor, fixed deadlines and money moving on a client’s behalf.
Sector relevance comes from understanding those workflows. A matter file, a set of workpapers, a client register and a project archive each need clear rules about who can open them, where the file of record sits, how long it is kept and how it is recovered.
Who is responsible for what?
Three parties are involved in IT for professional services. The firm sets its policies, supervises staff and makes decisions about client information. The IT provider looks after the shared environment, such as Microsoft 365, devices, identity, the network and backup. The practice software vendor looks after its own application and, where it hosts the software, the hosting too.
Problems start when nobody has written down where one responsibility ends and the next begins. IT for professional services works best when that boundary, and the escalation process across it, is agreed before something goes wrong.
Client information: confidentiality, privilege and privacy
Confidentiality and legal privilege are different things. A lawyer’s duty of confidentiality covers client information generally, while privilege attaches only to certain communications and documents. Not every client document is privileged, and technical controls alone do not decide privilege, so IT for professional services should protect all client information rather than trying to sort it by privilege. For lawyers using cloud services, the Law Society’s cloud computing guidelines set out what to check.
The Privacy Act
IT for professional services can support your privacy obligations through appropriate access controls, secure sharing, retention settings and incident records. Those controls do not establish compliance on their own. The firm also needs to decide what it collects, why it holds it, who may use it and when it should be deleted.
Where information is collected indirectly, such as from a referrer or another party to a transaction, consider the notification requirements under IPP3A, which came into force on 1 May 2026, and any applicable exceptions. Our guide to Privacy Act compliance covers the wider duties, including breach notification.
AML/CFT and record keeping
AML/CFT obligations depend on whether the firm carries out captured activities. A law firm that manages client funds or handles property transactions may be a reporting entity, while another professional firm may not be. Do not assume every lawyer, accountant, adviser or broker has identical obligations.
Where your firm is a reporting entity under the AML/CFT regime, its IT for professional services setup needs to support the applicable record-keeping requirements. Retention periods depend on the record and the event that starts the clock, such as a completed transaction or the end of a business relationship. The DIA guideline for lawyers and conveyancers sets these out by record type.
Agree the schedule with the person responsible for compliance, including any other retention duties or legal holds. Our guide to a data retention policy covers how to write the schedule down.
What risks should professional firms plan for?
The risks below shape IT for professional services because they target client trust and client money. They are listed to help planning, not ranked by frequency.
- Payment redirection and email compromise. An attacker gains access to a mailbox, watches for an invoice or settlement and changes the bank details. Controls include multi-factor authentication, sign-in monitoring and a rule that payment details are confirmed by phone on a number already held.
- Ransomware and data theft. Systems are encrypted and client files may be copied first, so recovering from backup does not settle the matter. Patching, protected backups and monitoring all play a part.
- Misdirected email and sharing. A file goes to the wrong client or a link is shared too widely. Sharing settings, external-send warnings and a clear process for reporting mistakes help.
- Departing staff and partners. Access that is not fully removed, or client files taken when someone leaves.
Our email security services cover the email side of these risks, and multi-factor authentication is the starting point for protecting mailboxes.
What good IT for professional services looks like in practice
Identity and access
Identity is the foundation of IT for professional services. Use centralised sign-in where your applications support it, named accounts for every person, separate privileged accounts for administration and a process for exceptions. Access to sensitive client files should follow the person’s role and be reviewed when roles change.
Documents and records
A dedicated document management product is not compulsory for IT for professional services. What matters is that the firm defines the outcomes it needs: who can access each file, where the file of record sits, how versions are handled, how long records are kept and how they are retrieved. For some firms that is a practice system; for others it is Microsoft 365 with agreed structure and permissions.
Check what logging is available in each system, whether it is switched on and how long the logs are kept, because this varies by product and licence. Archiving is not the same as a retention and deletion policy.
Staff changes
Offboarding needs particular care in IT for professional services, because partners and staff leave with client relationships. It is not complete when one account is disabled. It needs to cover applications that do not use central sign-in, active sessions on phones and laptops, shared credentials, vendor portal access and any client files held outside the firm’s systems.
Devices and networks
Laptops and phones used for client work should be centrally managed, encrypted and able to be wiped if lost. Separate staff devices from visitors, for example with a guest WiFi network, and make sure remote staff are protected by the same IT for professional services controls as in the office.
Backup and recovery
Recovery is where IT for professional services meets the firm’s deadlines. Agree recovery objectives for each critical system: which systems and records are needed first, how much data loss the firm can tolerate and the target time to restore access. Then test restores to check the objectives can be met. Microsoft 365 data and practice software data are backed up differently, and some practice software is backed up by its vendor, so the backup scope should say what is protected by whom. Our guide to Microsoft 365 backup covers the Microsoft side, and a business continuity plan covers how the firm keeps working while systems are restored.
Practice software and your vendors
Practice software is the part of IT for professional services that sits partly with someone else. It sits alongside Microsoft 365, devices, identity and connectivity. Before support starts, agree which parts the IT provider manages and which remain with the application supplier. Where a problem crosses that boundary, the escalation process should set out who contacts the supplier and who keeps the firm updated.
Check who applies updates, who manages integrations with Microsoft 365 or accounting systems, who controls user accounts in the application and what the vendor backs up.
How to choose an IT provider for a professional firm
When choosing a partner for IT for professional services, look at how clearly it explains its support model and the boundaries of its responsibility, rather than at general claims of sector experience. Useful questions include:
- What is included in support? And which work is quoted separately, such as projects, migrations and vendor charges.
- How are urgent issues handled? Ask about support hours, response targets, on-site availability and after-hours escalation as separate points.
- How will you work with our practice software vendor? Including who raises and follows up vendor issues.
- How do you protect our client information in your own systems? Including who on your team can access it.
- How would we move from our current provider? Including handover of passwords, documentation and admin access.
A quote for IT for professional services depends on the number of users and sites, the practice applications, where they are hosted, the backup scope, the security requirements and the support coverage. Our managed IT services page sets out how Exodesk’s support model works.
How often should IT for professional services be reviewed?
Review the setup around risk and change rather than a fixed calendar: when the firm grows, opens a site, changes practice software, takes on a client with new requirements or has an incident. Use those reviews to check access, backup scope and the vendor boundaries are still right.
Frequently Asked Questions
What is IT for professional services?
IT for professional services is the technology, security and support that firms doing confidential client work rely on. It covers identity and access, document handling, email and payment security, backup and recovery, and a clear split of responsibility with practice software vendors. The aim is to protect client information while keeping the practice working.
Does a professional firm need a dedicated document management system?
Not necessarily. IT for professional services needs defined outcomes for access, filing, versioning, retention and retrieval, and a clear file of record. For some firms that is a practice system, and for others it is Microsoft 365 with agreed structure and permissions.
Does the Privacy Act require specific IT controls?
The Privacy Act requires safeguards that are reasonable in the circumstances rather than a fixed list of products. Access controls, secure sharing, retention settings and incident records can support those safeguards, but they do not establish compliance on their own. Where information is collected indirectly, IPP3A notification requirements and their exceptions also need to be considered.
Do AML/CFT record-keeping rules apply to every professional firm?
No. AML/CFT obligations depend on whether the firm carries out captured activities, so two firms in the same profession can have different obligations. Where a firm is a reporting entity, its systems need to support the applicable record-keeping requirements.
How long do AML/CFT records need to be kept?
Retention depends on the record and the event that starts the clock. For reporting entities, DIA guidance sets five years from the completion of a transaction for transaction records, and five years from the end of the business relationship for identity and verification records. Agree the full schedule with the person responsible for compliance, including legal holds.
How can a firm reduce the risk of payment redirection fraud?
Use multi-factor authentication on every mailbox, monitor for unusual sign-ins and mailbox rules, and confirm any change to payment details by phone on a number already held. Staff also need a simple way to report a suspicious request quickly.
What should happen when a staff member or partner leaves?
Offboarding should cover every application, including those outside central sign-in, active sessions on devices, shared credentials and vendor portal access. It should also confirm that client files have not been kept outside the firm systems. Disabling one account is not enough on its own.
Who supports our practice software, the IT provider or the vendor?
That depends on the agreement for IT for professional services. The vendor supports its application, while the IT provider supports the environment around it, such as Microsoft 365, devices, identity and connectivity. Agree the boundary and the escalation process before support starts.
How often should a professional firm review its IT setup?
Review IT for professional services around risk and change rather than a fixed calendar, such as growth, a new site, new practice software, new client requirements or an incident. Each review should check access, backup scope and vendor responsibilities.
How do we get started with IT support for our firm?
Tell us about your team, locations, practice software and the support problems you want to solve. We can discuss a suitable support scope and the next steps.
NEXT STEP
Talk about IT support for your firm
Tell us about your team, locations, practice software and the support problems you want to solve. Our teams in Christchurch and Dunedin work with firms across New Zealand.
Or see our managed IT services.
