Perth accounting firms - from sole practitioners to mid-size practices - hold some of the most sensitive data of any professional services business. Tax returns, financial statements, trust account records, payroll data, and business valuations for dozens or hundreds of clients. A breach is not just an IT problem: it is a professional indemnity event, a Privacy Act notifiable data breach, and a serious reputational risk with clients.
The Unique IT Challenges for Accountants
Accounting practices have a distinct IT profile compared to general professional services:
- ATO portal access - tax agents access the ATO's Online Services for Agents (OSA) platform, which requires myGovID and Relationship Authorisation Manager (RAM) access. These credentials are high-value targets for attackers who want to lodge fraudulent returns or access client ATO records.
- Specialist accounting software - MYOB AccountRight/Practice Manager, Xero Practice Manager (XPM), Reckon Accounts, Handisoft, and APS are all common. Each has specific infrastructure requirements, integration points, and update cadences that generic IT providers often mishandle.
- Tax lodgement deadlines - IT failures during March–May (EOFY preparation) or October (extended tax return season) are not just inconvenient; they can affect lodgement compliance for clients.
- Client data volume - a 5-person Perth accounting practice may hold sensitive financial records for 200–500 clients. The data volume and sensitivity far exceeds what the practice size might suggest.
ATO and myGovID Security
The ATO's Online Services for Agents is accessed via myGovID - a digital identity credential linked to the tax agent's personal details and devices. Attackers who compromise a tax agent's myGovID can access client ATO records, change bank account details for refunds, and lodge fraudulent returns.
Key security controls for accounting practices:
- myGovID on a dedicated device - the ATO recommends myGovID be used on a dedicated device not used for general browsing. At minimum, it should be on a fully managed, encrypted business device with endpoint protection.
- Strong myGovID identity strength - aim for Standard or Strong identity strength by verifying documents in the myGovID app. Basic strength provides weaker protection.
- RAM access review - regularly review who has Relationship Authorisation Manager access and remove staff who have left or changed roles.
- Monitor for suspicious ATO activity - review ATO portal activity logs for unexpected access, unusual lodgement patterns, or changes to bank account details.
Practice Management Software
MYOB AccountRight and Practice Manager
MYOB AccountRight can run in two modes: company files stored locally or in the MYOB cloud. Local company files require a server or shared network location - these need to be backed up, secured, and maintained. MYOB cloud-hosted files eliminate the infrastructure concern but require reliable internet connectivity and appropriate access controls.
Xero Practice Manager
XPM is fully cloud-based, accessed via browser. The IT considerations are identity security (MFA on all XPM accounts, access reviews when staff leave) and ensuring reliable internet connectivity. XPM integrates with Xero client files, so access controls in XPM flow through to client data access.
Handisoft / APS
Both Handisoft and APS have traditionally been on-premise applications requiring a Windows Server environment. Both have cloud-hosted versions. Practices still running on-premise installations of these platforms carry additional infrastructure risk - server patching, backup management, and access controls must be explicitly managed.
Email Security - Business Email Compromise Is Rife
Accounting firms are prime targets for business email compromise (BEC) - attackers impersonate the firm to misdirect client payments, or impersonate clients to divert trust account distributions.
Perth accountants have lost significant sums through BEC attacks where:
- An attacker compromises the firm's email, monitors client correspondence, and intercepts a property settlement instruction - changing the destination bank account to their own
- A client receives a fake email appearing to come from the firm, instructing them to change a bank account or make an urgent payment
Essential email security controls:
- MFA on all Microsoft 365 or Google Workspace accounts - non-negotiable
- SPF, DKIM, and DMARC configured correctly - prevents attackers from sending email that appears to come from your domain
- Microsoft Defender for Office 365 Safe Links and Safe Attachments
- External email warning banners - so staff immediately know when an email originates from outside the organisation
- A verbal verification protocol for any instruction to change bank account details - regardless of how the instruction arrives
Backup and Data Retention
Accounting records must be retained for specific periods under tax law - generally 5 years from the date of lodgement. Your backup and data retention policy must account for this:
- Backup retention must meet the statutory retention period - a 30-day rolling backup is not sufficient for tax records
- Deleted client files must be recoverable for the statutory period
- Backups must be tested - an accounting practice discovering that 3 years of client records are unrecoverable after a ransomware attack is in a serious position
Remote Access for Accountants
Many Perth accountants work with clients on-site or work from home, requiring remote access to practice management software and client files. Options:
- Cloud-based software (Xero, MYOB cloud) - accessible from any managed device with MFA, no remote access infrastructure needed
- VPN with MFA - for on-premise software, a VPN with MFA-protected access is the minimum standard. RDP exposed directly to the internet is not acceptable.
- Azure Virtual Desktop - for complex on-premise practice management software, AVD provides a cloud-hosted desktop with the application installed, accessible from any device
Frequently Asked Questions
Why does myGovID need extra protection at an accounting firm?
Because it's the credential that gives access to the ATO's Online Services for Agents, so an attacker who compromises it can potentially view client tax records or change bank details for refunds. Using it on a dedicated, managed device rather than a general-purpose computer significantly reduces that risk.
How long do accounting practices need to retain backups for?
Tax records generally need to be kept for around 5 years from lodgement, so a backup policy with only a short rolling window, 30 days for example, isn't going to cut it. It's worth confirming your specific retention obligations with your professional body or a compliance adviser, since requirements can vary.
What makes accounting firms a target for business email compromise?
Accountants regularly handle instructions involving client bank details and settlement figures, which gives attackers an opening to impersonate the firm or a client and redirect a payment. A verbal verification step for any bank account change request, no matter how the instruction arrives, is one of the most effective defences.
Do sole practitioners and small bookkeeping firms need the same IT security as larger practices?
The controls matter regardless of size, since even a small practice can hold financial records for hundreds of clients. A breach carries the same professional and privacy consequences whether the firm has 2 staff or 20, so scaling down security just because the practice is small isn't really an option.
We support Perth accounting firms with managed IT, email security, ATO portal protection, and practice management software - experience across MYOB, Xero, Handisoft, and APS.
Accounting IT Services →IT support for your Perth accounting practice
Call 0433 087 091 - we understand the ATO portal, practice management software, and compliance obligations specific to accounting firms.
Book a Free AssessmentFor related reading, see our guides to IT Support for Law Firms & Accountants in Perth and IT Support for Health & Medical Practices in Perth.