Sam runs the front office at a 12-person wealth management practice. Sam books the conference room, processes new client paperwork, keeps the CRM tidy, and, somewhere along the way, became the person who calls the internet provider when the WiFi drops. Sam also knows the admin password to the file server, resets everyone’s Microsoft 365 login, and decides which USB drive is safe to plug in. Nobody hired Sam to do any of that. It just happened, one small fix at a time, until Sam was the de facto IT department for a firm managing client retirement accounts and sensitive financial records.
This is not a rare story. It is close to the default state for small and mid-sized financial firms that have never formally staffed IT. And it deserves to be named honestly: Sam is not the problem. Sam is doing exactly what a capable, resourceful employee does when nobody else has stepped in. The problem is what Sam was never given: training, authority, backup, or a way to know what “good” actually looks like in a regulated environment.
Every Financial Firm Has a Sam, Whether or Not It’s in the Job Title
The accidental IT coordinator role rarely comes with a title change or a raise. It accumulates. A laptop needs setup, so Sam handles it. A staff member gets locked out of email, so Sam resets the password. A new advisor joins and needs a login, so Sam copies the last person’s account permissions to save time. None of these individual decisions look risky in the moment. Collectively, they mean the person managing access to client PII, custodian portals, and financial planning software has no formal security training and no visibility into what a properly configured environment should include.
This isn’t a failure of judgment. It’s a structural gap. A 12-person RIA doesn’t have the headcount or the budget to justify a full-time systems administrator, so the responsibility lands on whoever is closest and most willing. Recognizing that pattern, rather than treating it as an embarrassing secret, is the first step toward fixing it.
What Sam Was Never Given Is the Real Risk
Walk into almost any financial firm that has never had a formal managed IT partner, and the same gaps show up in nearly the same order: multi-factor authentication enforced on some applications but not others, departed employees whose mailbox access was never fully revoked, personal devices checking corporate email with no mobile device management in place, and admin credentials shared across the office because nobody ever separated standard accounts from privileged ones. None of these are exotic failures. They happen when IT ownership is informal rather than structured.
The exposure isn’t theoretical for a firm handling client financial data. External sharing links on a SharePoint site, an unmonitored mailbox forwarding rule, or an unpatched workstation are the kinds of configuration gaps that turn into an actual incident, not because Sam missed something obvious, but because nobody ever audited the environment against a standard built for a regulated business rather than a general small office.
Regulators Are Asking Questions Sam Was Never Trained to Answer
This is where the stakes shift from operational to existential for an RIA or wealth management practice. In its fiscal year 2026 examination priorities, released in November 2025, the SEC’s Division of Examinations laid out its plan to review firms’ compliance with federal securities laws, publishing the priorities to give registrants transparency into where examiners will focus and to encourage firms to direct compliance efforts toward areas of heightened risk. Cybersecurity and the 2024 amendments to Regulation S-P sit near the top of that list, and examiners are specifically looking for documented incident response programs, customer notification procedures, and evidence that safeguards for client information are actually in place, not just described in a policy binder.
An office manager who has been quietly holding the network together has no framework for producing that kind of documentation. There’s no access review log, no incident record, no evidence that backups have been restored and tested, no proof that a departed employee’s credentials were revoked on their last day rather than discovered three months later during an audit. It isn’t a knowledge gap Sam should be expected to close alone. It’s a structural one that only gets solved with the right systems and the right partner behind the scenes.
Beyond the regulatory angle, the baseline security posture matters on its own terms. The FTC’s guidance for small businesses is built around the reality that cybercriminals target companies of all sizes, and putting basic protections into practice meaningfully reduces the risk of a successful attack. For a financial firm, “basic” has a higher bar than it does for a typical small business, but the underlying principle is the same: the fix is a system, not a person working harder.
Recognition, Not Replacement
None of this is an argument for sidelining Sam. Sam knows the firm’s workflows, the advisors’ habits, and where the operational friction actually lives, none of which shows up in a network diagram. The right move isn’t to replace the accidental IT coordinator. It’s to give that person a real partner: a team that handles the deep technical and compliance work, deploys the monitoring and security controls a financial firm actually needs, and leaves Sam as the point person who knows the business, not the one solely responsible for whether it survives a ransomware event or a surprise SEC exam.
That’s the model a co-managed or fully managed approach is built for. Sam keeps the institutional knowledge and day-to-day relationship with staff. A dedicated IT and security team takes on identity and access management, patching, backup verification, documentation, and the audit trail regulators expect to see. The office doesn’t lose its most resourceful employee. It stops asking that employee to carry a job nobody ever formally gave them.
If your firm’s IT has been running on the same kind of informal ownership, the conversation worth having isn’t about what’s going wrong. It’s about what your team has been quietly holding together without the tools or backup to do it safely. For a closer look at how this plays out specifically for RIAs, wealth managers, and CPA firms, see Alliance Tech’s financial services IT page. For firms ready to talk about what proper support looks like, our managed IT services page outlines how that partnership actually works.
