What security practices should a payroll firm document before a buyer visits?
Write down who can see employee pay and banking data, how access is granted and removed, how devices and email are protected, how data is backed up, and what you would do after a breach. A buyer expects the practice to be on paper, not just in your head.
Payroll data is among the most sensitive a small firm holds, so a buyer will probe. Begin with access: a list of who can open client payroll files, by role, and a record of when access was granted or removed. Show that former staff lost access promptly and that shared logins are avoided.
Next, document the protections. Describe how laptops and phones are secured, how email and file transfers are protected, and how sign-in is checked beyond a single password. Government cyber guidance for small organizations offers a plain list of baseline controls you can compare yourself against. Note which you meet and which you are working on.
Cover the unhappy path as well. Write down who does what if data goes missing or an account is taken over, whom you notify, and how clients would hear about it. Keep a record of any past incident and what changed afterward. Ask your lawyer about your duties around privacy and breaches. Give the buyer a short, dated summary, and be ready to demonstrate the controls rather than only describe them, on a screen if asked.
Key takeaways
- List who can view payroll data by role, and record when access is granted or removed.
- Compare your controls against government baseline guidance.
- Write an incident plan with named roles, contact steps and a note on how clients would be told.
- Disclose past incidents and what you changed, rather than hoping the buyer does not ask.
Related reading
15 pages on the same subject, grouped by topic.
Buying
Selling
- Expert answerHow do I document the equipment lists at each of my HVAC service contract sites?
- Expert answerHow should a payroll service owner prepare clients for a change of ownership?
- Expert answerWhat records should a payroll service owner gather before talking to buyers?
- Expert answerHow do I keep my event rental company’s phones answered while buyers visit?
- Expert answerHow do I prepare my linen route drivers for a buyer’s visit?
- Expert answerHow do I train a buyer on my security firm’s incident response routine?
Due diligence
- Expert answerHow do I check a courier firm’s weekend and after-hours service demand?
- Expert answerHow can I verify a bookkeeping practice’s reliance on one accounting software?
- Expert answerWhat do aged work-in-progress balances tell me about an accounting practice’s billing habits?
- Expert answerWhy do payroll service client onboarding notes matter during a purchase?
- Expert answerHow do I check how a security firm stores its clients' sensitive test data?
Sources
This answer is checked against primary sources. Links were last confirmed on the dates shown.
- 01Canadian Centre for Cyber SecurityGovernmentBaseline cyber security controls for small and medium organizations
- 02Business Development Bank of CanadaGovernmentHow to conduct due diligence when buying a business
Deavo is an advertising and listings platform, not a brokerage, law firm or valuation firm. This page is general information, not legal, tax, accounting or valuation advice, and rules differ by province. Confirm anything you rely on with a qualified professional before you act on it.