While small CPA firms are often vulnerable in terms of protecting their clients' personally identifiable information, the Big four firms aren't particularly breach proof either in terms of safeguarding personally identifiable information. Despite the firm policies and all the CPEs on this topic that the Big 4 Firms use to increase awareness of the firms' employees to the theft and misuse of personally identifiable information (PII), it's all up to the employees who have access to the personally identifiable information to follow the rules and be cautious. The mere size of the Big 4 firms makes it almost impossible to ensure that everybody who handles or who has access to the personally identifiable information is going to be very cautious and is following the information security rules. It's because there are just too many people in the big four firms who handle clients' PII, many of them are new college grads who just got hired, more of them are offshore employees and outsourced contractors in India. PII just passes too many hands in the Big 4 due to the size of the firms and the high employees turnover. Many new college hires don't even know or care about the significance of PII because they are so young and inexperienced. They received some training on this but their mentality just doesn't take this seriously. The more experienced managers and senior managers are also young and naive about the seriousness of identity thefts and the consequence of a breach of PII security to the firms and their clients.
In the small firms, many professionals there don't even know what PII is all about, or do they have a clue as to how to safeguard it. I recommend all the CPAs to do yourselves and the public a favor and read this book, so you don't smirk and just brush it off casually next time when someone talks to you about safeguarding PII.