IT support for accountants in Brisbane

An accounting practice holds tax file numbers, bank details, identity documents, payroll data and the financial affairs of many clients in one place. That makes it a rich target, and attackers know the calendar as well as you do. A locked system or a convincing fake email is far more painful in the days before a lodgement deadline.

Email is the usual way in. A fake email that appears to come from a partner, a client or the ATO can lead to a stolen password, a changed bank account or a request to release funds. Another common problem is access that is too wide: everyone can open every client folder, and nobody can say who opened what.

Registered tax practitioners are bound by the Code of Professional Conduct under the Tax Agent Services Act 2009, administered by the Tax Practitioners Board. The Code includes obligations around confidentiality of client information. The ATO also publishes guidance for tax practitioners on protecting client data and securing their practice. Both are worth reading with your adviser.

The Privacy Act 1988 and the Notifiable Data Breaches scheme may also apply, depending on the practice. If personal information is accessed or disclosed in a way likely to cause serious harm, the practice may need to notify the OAIC and the people affected. Whether a given incident is notifiable is a decision for the practice, ideally with advice. Technology supports these obligations, it does not determine them, and no IT provider can guarantee compliance.

Practices commonly run a mix of Xero, MYOB, Xero Practice Manager (XPM), Handisoft, Class (often for SMSF work) and Karbon for workflow, alongside Microsoft 365 for email and files and the ATO's online services for tax agents. We look after the devices, network, access, backups and security around your systems, and keep the operating systems and tools they run on at supported versions. We work with the software vendor on application issues. The agreement sets out which products are covered and who owns each part.

The Essential Eight, from the Australian Signals Directorate, is a baseline of mitigation strategies. For an accounting practice, the most valuable are usually:

• Multi-factor authentication on email, cloud accounting tools and remote access, because stolen passwords are the most common way in.
• Patching, scheduled around lodgement peaks so updates do not interrupt busy periods.
• Regular, tested backups that ransomware cannot alter, so client records can be restored without negotiating.
• Restricting administrator access, so one stolen account cannot reach every client.
• Application control and macro settings, which help block malicious attachments disguised as invoices or tax documents.

It is a framework to work towards in stages, not a certificate.

Good IT in an accounting firm follows the compliance calendar. Upgrades, patching and hardware refreshes are scheduled around BAS, EOFY and lodgement deadlines, not in the middle of them. Client folders have permissions set per client or portfolio, with a record of who opened sensitive documents. Staff can work remotely at peak times through secure access. Client documents are shared through an encrypted portal rather than as email attachments. Email filtering and staff training address spoofed emails, and a change of bank details is always confirmed by phone on a number you already hold. Outside peak periods, the work is tighter access, tested restores and keeping ledger and tax software on supported versions. Our EOFY IT checklist covers the year-end side.