Every outside person who opens your books can also see your customers' names, your bank balances and your payroll. Ordinary controls handle much of that risk: personal logins, two-step sign-in, limited access and a plan for when something goes wrong.
Key Takeaways
- Give each outside person a personal login with two-step sign-in and access to only the accounts the job needs.
- Tax preparation firms must keep a written security plan under the FTC Safeguards Rule, and IRS Publication 4557 explains how.
- GDPR, HIPAA, PCI DSS and SOX cover only some businesses, so find out which, if any, cover yours.
- Insider risk includes carelessness as well as bad intent, so limit access and keep logs.
- Ask each provider for its security measures in writing, and keep your own copy of your records.
Risks of Sensitive Data Exposure
When you outsource accounting, you hand customer records, payment details and financial statements to someone else's laptop, network and habits. A phished password, an unencrypted file sent by email or a laptop left in a taxi can expose all of it.
A breach costs more than the clean-up. Customers lose trust, and some laws require you to notify the people affected. (For related pitfalls, see our post on common mistakes in outsourcing accounting.)
Check the provider's practices before you hand over access, and check them again every year.
Compliance and Regulatory Challenges
Four sets of rules come up in security talk, and each covers only some businesses:
| Regulation | Requirement |
|---|---|
| GDPR | Rules for the personal data of people in the EU, with conditions for sending it to other countries |
| HIPAA | Safeguards for health information held by healthcare providers, health plans and their business associates |
| PCI DSS | Industry standard for protecting card payment data, set by the PCI Security Standards Council |
| SOX | Internal-control and financial reporting rules for public companies |
For many US accounting clients the rule that matters most is the FTC Safeguards Rule, which lists tax preparation firms among the businesses it covers. It requires a qualified person to run a security program, a written risk assessment, access controls, encryption, multi-factor authentication, oversight of service providers and a written incident response plan. A covered firm must tell the FTC within 30 days of discovering a breach that involves the unencrypted information of at least 500 consumers (FTC, December 2024).
HIPAA reaches an accounting provider only when it handles protected health information for a healthcare client, because the federal definition of a business associate includes accounting services that involve that information. The GDPR applies to a company outside the EU when it offers goods or services to people in the EU or monitors their behavior there. PCI DSS applies to organizations that store, process or transmit card data.
Lack of Visibility and Control
Handing work to someone outside leaves three common gaps:
- Insight. You may not know which devices, networks or subcontractors touch your data. Ask for them by name.
- Ownership. If the contract does not say who owns the records and who must protect them, each side may assume the other does. Put both in writing.
- Response. When something goes wrong, you need a named person to call. Get the number before you need it.
Clear contract terms, regular reports and a named contact close these gaps.
Insider Threats and Data Misuse
Insider risk covers carelessness as well as bad intent: a bookkeeper who forwards a file to a personal email, or a former employee whose login was never switched off. The controls are the same for both. Give each person only the access the job needs, keep audit logs of who did what and when, and remove access the day someone leaves.
When you are choosing an outsourced accounting firm, ask how it screens and trains staff and what happens to access when a person moves to another client. Ask which background checks it runs and whether they cover staff in other countries.
If you hire a remote assistant directly, give that person a personal login to your own software.
Vendor Security Practices and Reliability
Where the vendor works affects which data protection law applies and who enforces it. Our post on the best countries for outsourcing accounting compares two countries on that point. A SOC 2 report from an independent CPA firm describes a vendor's controls for security and related areas, so ask to read it and note the dates it covers.
Put three requests to any vendor:
- Describe how access to my data is monitored and how long the logs are kept.
- List what is encrypted in transit and at rest, and who holds the keys.
- Show the incident response plan and say what I would be told within a day.
Strategies for Mitigating Data Security Risks
The first step is the choice of partner, and our guide on how to choose an outsourced accounting firm covers it. After that, the controls are mostly routine.
IRS Publication 4557 lists the basics for tax professionals. They include multi-factor authentication for anyone who accesses customer information, encryption of sensitive files and emails, backups on a secure external source that is not connected full time to a network, access limited to people who need it, audit logs and a clean desk policy. The guide also tells practitioners to report data theft or loss to the IRS Stakeholder Liaison.
Teach everyone who touches your data, the outside person included, to spot phishing emails. The IRS puts that first on its list of basic steps.
Review all of this once a year, and again whenever a provider changes owner, systems or staff.
Frequently Asked Questions
How Can I Ensure My Accounting Data Is Securely Backed Up?
Keep a copy of your books and key files in storage you control, and keep at least one backup disconnected from the network. Test a restore once a year, because a backup you have never opened may fail when you need it.
What Legal Requirements Apply to Outsourcing Accounting Data?
It depends on your business and your customers. Tax preparation firms fall under the FTC Safeguards Rule, healthcare clients bring HIPAA, businesses that take cards face PCI DSS, and customers in the EU can bring the GDPR. States have their own breach notification laws too, so ask a lawyer which ones apply to you, since our assistants do not give legal advice.
How Do I Evaluate the Cybersecurity Capabilities of an Accounting Firm?
Ask for the written security plan, a SOC 2 report if the firm has one, and a description of how it screens staff and handles a lost device. Compare the answers across two or three firms, because vague answers tell you something.
What Happens if My Outsourced Accounting Provider Experiences a Data Breach?
Ask the provider what was exposed and when, then change passwords and revoke its access to your systems while you find out. If you hold tax data, report the loss to the IRS Stakeholder Liaison, as Publication 4557 advises. If the FTC Safeguards Rule covers your firm, notice to the FTC is due within 30 days of discovering a breach that involves the unencrypted information of at least 500 consumers. Ask a lawyer about notices to customers and to your state.
How Can I Monitor the Activities of My Outsourced Accounting Team?
Give each person their own login so the audit log shows who did what, then review that log and the monthly reports. Keep payment approval and the bank login yourself.
Final Thought
Sharing your books with an outside person is a normal business decision, and the risks have known controls. Choose providers who answer security questions in writing, keep your own copy of the records, and book a free consultation call if you want to talk through the access a recruited assistant would need.