Is your accounting firm as secure as you think?

The article is relevant to members in Australia and New Zealand and was current at the time of publication.

A team member pastes client information into an artificial intelligence (AI) chat. An accountant working from home leaves sensitive documents where they can be seen. A cyber attacker gains access to the firm’s systems. And a practitioner suddenly discovers they are subject to new anti-money laundering and counter-terrorism financing obligations.

None may be deliberate, but each can leave a small practice exposed to regulators, clients, insurers and, potentially, significant costs.

Stay safe year-round

Jodie Smith, FCPA GAICD and Best Practice Program Manager for CPA Australia, says that, given the number of risks facing practices today, it is unlikely every one of them can be eliminated.

The best defence is knowing where vulnerabilities lie, how to reduce them and what to do when something goes wrong.

“You can’t mitigate every risk back to zero,” Smith says.

Under APES 325 Risk Management for Firms, all accounting firms must have a risk management framework that identifies and assesses risks and documents mitigation strategies. Smith says it should be reviewed at least annually. 

Practices should also carry out a formal risk assessment yearly instead of waiting for a problem to expose a gap.

Too small for hackers? Never

Large firms are being breached, so small firms should not assume they will be spared. Accounting practices hold valuable financial and personal data, so they are attractive to criminals.

Mark Dal-Corobbo, Managing Principal at Marsh Affinity, says: “It doesn’t matter what size you are, we’re all vulnerable to a cyber breach or hack from a threat actor.”

Cyber insurance can provide another layer of protection, but it should not replace the controls designed to prevent an incident in the first place.

Are your AI users the weak link?

Practices should not avoid AI, but Smith says they should by now have clear policies setting out which tools employees can use and what information can and cannot be put into them.

They should also vet the tools, understand how and where data is stored and, where appropriate, tell clients how their information is being used.

“Make sure to also train your employees in AI use, including the boundaries and parameters you set,” she says.

Knowledge versus compliance

Accountants in both New Zealand and Australia are now required to comply with anti-money laundering and counter-terrorism financing laws.

But Dal-Corobbo says knowing the legislation does not eliminate the risk: familiarity with the requirements is not the same as complying with them.

Firms also need to consider the consequences of regulatory action.

Professional indemnity insurance does not necessarily provide the answer. A management liability policy with statutory liability cover may provide protection against certain regulatory fines arising from an unintentional breach, subject to policy terms and conditions.

Deliberate, dishonest or criminal conduct, however, is a different matter and is generally excluded, Dal-Corobbo says. 

Firms should understand the cover before an incident, not discover its limitations afterwards.

PI policy does not cover everything

Accountants cannot assume their professional indemnity (PI) policy covers risks that actually sit elsewhere, Dal-Corobbo says.

Contractor liability, bodily injury, property damage and director exposures may require other forms of cover.

Home-based practitioners should always disclose business activity to their home and contents insurer, as it can affect a claim. Public liability cover may also be required.

Dal-Corobbo says the solution is not to buy every insurance product but to ensure the insurance program reflects the risks identified in the risk assessment.

Risks beyond the office 

Working remotely does not necessarily create an insurance problem, but where people work and how they handle information can create additional risks.

Dal-Corobbo points to public liability exposure when people work from different locations, as well as the need to protect sensitive client information in shared or public environments.

Offshore providers are not inherently risky, but firms need to monitor data security, cybersecurity and quality assurance, and ensure compliance with legal and professional requirements.

Too swamped to safeguard yourself?

Smith says competing compliance demands and “the volume and variety of client demands vying for practitioners’ attention each day” can make it tempting to prioritise immediate client issues over internal risk management.

But firms should allocate time and the appropriate employees to understand regulatory changes, assess their impact and put systems in place before new requirements take effect.

Risk management should also be ongoing, with policies, procedures, risk assessments and quality-control manuals regularly reviewed and updated.

“It’s the first line of defence for you, your employees and your clients.”

Valuable checklist 

Ask yourself the following questions:

Do we know our three biggest risks? 
Conduct or update your risk assessment.

Have new laws, regulations or technology changed our exposure? 
Assess the impact and update your policies and procedures.

Do we know exactly what our insurance covers — and what it does not? 
Ask your broker to map your policies against your risk profile.

Do our employees know what they can and cannot put into AI tools? 
Establish an AI policy and train employees.

If something went wrong tomorrow, would we know what to do? 
Check your incident response procedures and update them if necessary.