Accounting Industry
Secure Data Destruction for Accounting Firms
Accounting firms face a distinct set of pressures when selecting an ITAD vendor — pressures that go beyond what most other professions encounter. In addition to professional standards and regulator requirements, accounting firms have a unique perspective for the detailed and auditable records required for disposing of electronic equipment that contains sensitive client information. Not only does Back Thru The Future® posses the highest industry security and environmental compliance certification, it also provides a uniquely auditable and detailed chain of possession disposal process featuring both our Safe Harbor Express scheduled disposal process and Compliance Library our cloud based record retention system. We have been providing our ITAD services for over 35 years and currently support some of the largest legal, Financial and Healthcare enterprises in the country along with 1000 plus assorted small and mid sized firms through out the country.
Heightened Confidentiality Obligations
Under the AICPA Code of Professional Conduct, CPAs are bound by a professional duty to protect confidential client information — defined as any non-public information obtained from a client. Unlike most businesses where data protection is primarily a statutory matter, accounting firms carry an ethical obligation enforceable through professional discipline (loss of license, peer review consequences).
This is different from, say, a manufacturing company disposing of old laptops — accounting firms are custodians of someone else’s financial life.
FREQUENTLY ASKED QUESTIONS 
A Secure Process from Collection Through Final Disposition
An effective data destruction program should answer several fundamental questions:
What equipment was collected?
All equipment is inventoried at pick up time by mfg serial number and/or custom bar code labels that we provide. You sign off on the inventory prior to our departure.
Who controlled the equipment?
Chain-of-custody procedures provide accountability as assets move through the disposition process.
Was the data actually destroyed?
Physical destruction provides a definitive method for rendering stored information inaccessible. Chain of custody procedures follows the data assets through the destruction.
Can the destruction be documented?
Certificates and project records provide evidence of the completed process and are storied permently in our Compliance Library record.
What happened to the remaining electronics?
All remaining electronics are demanufatured and the components sent to specialized materials recovery facilities for final recycling.
Will you pay me for my retired IT Assets?
No. We do not resell used IT Equipment. Back Thru The Future® is unique within the computer recycling industry for maintaining a strict No-Resale Policy. We believe that retired IT assets should not remain in circulation carrying residual liability.
Back Thru The Future® brings these elements together into a single, managed process.
Multi-Regulator Compliance Overlap
Accounting firms may simultaneously be subject to several overlapping data disposal regimes that other professions typically don’t face together:
GLBA Safeguards Rule
Accounting firms providing financial services (tax planning, investment advisory, payroll) fall under the FTC’s Safeguards Rule, which requires proper disposal of customer/consumer information as a specific mandate.
IRS Publication 4557
Tax preparers must comply with federal requirements for disposing of taxpayer data, including specific timeframes for retaining and then securely destroying tax return information.
SOX implications
For firms performing audit or attestation work, Sarbanes-Oxley requires retention of audit workpapers for seven years. Premature or undocumented destruction of devices containing workpapers could trigger SOX obstruction-of-justice concerns.
State privacy laws
(CCPA, state breach notification statutes) layer on top of all of the above.
A hospital worries about HIPAA. A retailer worries about PCI. An accounting firm may need to satisfy all of GLBA, IRS, SOX, AICPA, and state laws simultaneously.
Audit Trail and Workpaper Integrity
Accounting firms must maintain defensible chains of custody not just for the hardware but for the data lifecycle itself. If a device containing client workpapers or tax returns is retired, the firm needs to demonstrate that:
- The data was destroyed per NIST 800-88 standards
- The destruction is documented at the serial-number level with per-asset certificates
- The timeline of disposal aligns with retention requirements (i.e., the firm didn’t destroy data it was legally required to retain)
This is a concern most other professions don’t share — a marketing agency retiring a laptop doesn’t face the same retention-versus-destruction tension.
Third-Party Service Provider Due Diligence
The AICPA Code requires members to exercise due diligence when using a third-party service provider, including informing clients in writing. This means the ITAD vendor selection process itself becomes part of the firm’s professional compliance documentation. The firm needs evidence that it vetted the vendor’s certifications (R2v3, e-Stewards, ISO 27001, NAID AAA), insurance coverage, and references — not just as good business practice, but as a professional obligation.
Client Perception and Engagement Letter Liability
Because accounting firms must disclose their use of third-party service providers to clients, the ITAD vendor’s reputation directly affects client relationships. A vendor with a data breach history or environmental violations could cause clients to object to the engagement — or worse, trigger a breach notification obligation to every affected client. This reputational linkage is more direct for accounting firms than for most other industries.
What’s Different From Other Professions
| Concern | Accounting Firms | Most Other Professions |
|---|---|---|
| Primary data type | Client financial records, tax returns, audit workpapers | Varies — often internal/operational data |
| Regulatory stack | GLBA + IRS + SOX + AICPA + state laws | Typically one primary regime (HIPAA, PCI, etc.) |
| Ethical duty | AICPA Code — enforceable professional obligation | Statutory only |
| Retention vs. destruction tension | High — must align disposal with multi-year retention mandates | Lower for most |
| Client notification of vendor use | Required by AICPA Code | Generally not required |
| Per-asset audit trail | Essential for professional liability defense | Good practice but not always required |
The bottom line: for accounting firms, ITAD vendor selection isn’t just an IT operations decision — it’s a professional compliance decision with ethical, regulatory, and client-facing dimensions that most other professions simply don’t face in the same combination.
Secure Data Destruction Services for Accounting Services
Back Thru The Future® provides secure destruction services for virtually all forms of data-bearing equipment and media, including:
Data Media Destruction
- Hard drive shredding
- SSD destruction
- Backup tape destruction
- Optical media destruction
- Flash media destruction
- USB drive destruction
- Mobile phone destruction
- Tablet destruction
- Microfilm disintegration
IT Asset Disposition (ITAD)
- Server decommissioning
- Storage array deinstallation
- Network equipment disposal
- ATM and branch technology retirement
- Payment terminal destruction
- Card reader destruction
Onsite Destruction Services
For organizations requiring maximum control and visibility, our mobile destruction services perform destruction at your facility while maintaining documented chain-of-custody controls.
Proven ITAD Experience
Back Thru The Future® specializes in providing environmentally compliant and certified secure data destruction service to businesses that face extraordinary regulatory compliance. We have extensive client experience within the accounting industry as well as:
- Healthcare (Multiple healthcare systems including two of the largest health providers in the NYC metro area)
- Financial (Over 50% of the community banks in NJ as well as several major international banks, brokerage firms and Insurance companies in the NYC metro area)
- Legal (Several of the largest law firms in the US and multiple mid and small firms in the NYC metro area)
Multiple organizations rely on us because we understand the unique compliance and operational requirements associated with regulated environments and have the handling and documentation processes in place to support audits.
Protecting Confidential and Privileged Client Information
Attorneys have a professional responsibility to safeguard information relating to their clients. That responsibility does not end when a computer, server, hard drive, mobile device, or other piece of electronic equipment is retired.
Data can remain recoverable from storage media even after files have been deleted, drives have been reformatted, or equipment has been removed from service.
For law firms, improperly handled electronic assets can expose:
- Attorney-client privileged communications
- Personally identifiable information (PII)
- Financial and banking information
- Litigation and discovery materials
- Intellectual property and trade secrets
- Medical and employment records
- Internal firm and employee information
Secure physical destruction of data-bearing media eliminates the uncertainty associated with relying solely on software-based deletion.
Data Security Risks Continue After Equipment Is Retired
Retired technology can easily become an overlooked component of a firm’s information security program.
Computers may be placed in storage. Hard drives may remain inside unused equipment. Servers may be removed during an office renovation or technology upgrade. Laptops, phones, and other devices can accumulate while firms determine how they should be disposed of.
Every device that contains information represents a potential data security risk until the information it contains has been securely destroyed.
A comprehensive IT asset disposition process should therefore address both the physical equipment and the data stored on that equipment.
Certified Hard Drive Shredding and Data Destruction
Physical destruction provides a clear and definitive endpoint for sensitive information stored on retired media.
Back Thru The Future® provides secure destruction services for hard drives and other data-bearing devices, including onsite destruction options that allow organizations to maintain control of sensitive media through the destruction process.
Depending upon project requirements, Back Thru The Future® can securely process:
- Hard disk drives
- Solid-state drives
- Servers and storage systems
- Desktop and laptop computers
- Mobile devices and tablets
- Backup and removable storage media
- Other electronic devices containing confidential information
Physical destruction helps ensure that information cannot later be recovered, reconstructed, or exposed through the resale or reuse of retired storage devices.
Maintain a Documented Chain of Custody
For legal organizations, knowing that data was destroyed is only part of the requirement. Being able to immediatly access the project information at any time is equally as important.
Back Thru The Future® provides our unique cloud based “Compliance Library” of all project documentation which is accessible 24/7.
Project documentation can include asset inventories, chain-of-custody records, certificates of destruction, recycling documentation, and other records associated with the disposition project.
This documentation can help firms demonstrate that reasonable measures were taken to protect confidential information and properly manage retired electronic assets.
Onsite Hard Drive Shredding
For firms with particularly sensitive information or strict internal security requirements, Back Thru The Future® offers onsite hard drive shredding.
Our mobile destruction services allow hard drives and other approved media to be physically destroyed at your location, providing an additional level of control over the chain of custody.
Authorized personnel can witness the destruction process, eliminating the need for intact data-bearing drives to leave the facility before destruction.
Onsite destruction can be particularly valuable during:
- Office closures and relocations
- Technology refreshes
- Server and infrastructure upgrades
- Records-management projects
- Mergers and acquisitions
- Large-scale equipment replacement
Electronics Recycling Without the Data Security Tradeoff
Once sensitive information has been securely destroyed, the remaining electronic equipment still requires responsible disposition.
Back Thru The Future® combines secure data destruction with environmentally responsible electronics recycling, allowing law firms to address information security and environmental obligations through a coordinated process.
This approach reduces the risks associated with sending retired technology through multiple vendors or disposition channels.
A No Resale Approach to Data Security
Back Thru The Future®’s No Resale Policy provides an additional distinction for organizations concerned about where retired equipment ultimately goes.
Back Thru The Future® is a recycling company—not a used-computer reseller. Retired equipment entrusted to BTTF is handled through a process focused on secure data destruction and responsible recycling rather than maximizing the resale value of used technology.
For legal organizations handling confidential and privileged information, removing resale incentives from the disposition process can provide an important additional layer of risk reduction.
Supporting Legal Industry Compliance
Law firms may possess information governed by numerous privacy, security, contractual, and professional requirements depending upon their clients and areas of practice.
A single firm may handle healthcare information, financial records, consumer information, employment data, intellectual property, or information belonging to highly regulated corporate clients.
Secure data destruction therefore supports more than a firm’s internal security policies. It can also help firms meet obligations associated with the sensitive information entrusted to them by their clients.
Back Thru The Future®’s documented destruction and recycling processes provide legal organizations with a defensible approach to managing electronic assets at the end of their useful lives.
100%
of our client quality control survey rate both our pre-project and post-project communications as “Excellent”
92%
of our new client quality control surveys have been returned marked “Exceeded Expectations”