IT for accounting firms

An accounting practice holds every client's TFN. One mailbox can expose them all.

A breach at an accounting firm reaches every client at once, and attackers can use what they find to lodge false returns or redirect refunds. Here is what Australian practices need from their IT, the obligations that apply, what to do after a breach, and a readiness check for your firm.

Details from the ATO, TPB, AUSTRAC and OAIC guidance, checked 31 October 2026. General information, not legal advice.

Book a practice assessment Check your practice 07 3114 2808

TFN protection
Obligations explained
10-point readiness check

Reviewed by Blake Bath, General Manager, on 31 October 2026.

An accountant at a timber desk works through a stack of client folders, with a calculator and a spreadsheet on the monitor beside him. — **After a breach**Call the ATO on 1800 467 033 early, so it can protect client accounts.

What we find

Five IT gaps we see in accounting practices.

Each one puts client TFNs or money at risk.

Mailbox takeover

A partner's email is read for weeks, then used to ask clients for payment to a new account.

Strong MFA
Rule alerts
Monitoring

What applies

The obligations that shape accounting firm IT.

Obligation	What it means for IT	Applies to
Privacy Act and Notifiable Data Breaches	Reasonable steps to protect personal information; assess suspected breaches and notify where serious harm is likely	Firms covered by the Privacy Act, and any TFN breach
Tax File Number rules	TFNs collected, stored, used and destroyed securely, and only for lawful purposes	Anyone who holds TFNs, whatever their turnover
TPB Code of Professional Conduct	Confidentiality, competence, proper client records and, since the 2024 changes, a quality management system	Registered tax and BAS agents
AML/CTF (from 1 July 2026)	Enrolment, a program, customer due diligence, secure records kept generally 7 years, suspicious matter reports	Firms providing designated services
Cyber and professional indemnity insurance	Controls the insurer asks about, such as MFA and backups	Firms with cover

General information only. Check your obligations with the TPB, your insurer and your advisers.

ATO guidance

Who to call after a breach, in order.

From the ATO's data breach guidance for tax professionals.

The ATO, as soon as possibleClient Identity Support Centre on 1800 467 033, weekdays 8 am to 6 pm AEST. It can put protections on your business, staff and client accounts.
myID, if it may be misusedReport straight away on 1300 287 539, option 2.
The OAIC and the TPBAssess the breach under the Notifiable Data Breaches scheme and check the TPB guidance on your registration.
Clients, staff and your software providerTell those affected, and your provider if the breach may have started in their service.
IDCARE for supportFree identity and data breach support on 1800 595 160, for you and your clients.

Watch for warning signs too: lodgments you did not make, unexpected changes to client details, and sign-in problems.

What good looks like

The controls that matter most for a practice.

Strong sign-inPasskeys or an authenticator app on email, practice software and ATO access. No shared logins.
A client portalTFNs, returns and ID documents exchanged through a portal, with email kept for conversation.
Managed devicesEncrypted, updated and able to be wiped. Personal devices limited to app protection.
Connected apps under controlOnly approved integrations, reviewed yearly, unused ones removed.
Independent backupsMicrosoft 365, documents and practice data, copies that cannot be deleted, tested restores.
MonitoringSign-ins, mailbox rules and endpoints watched, with someone to act.

The Essential Eight is a sensible yardstick. Maturity Level One across all eight is the practical first target.

Before 1 July

Get IT ready before return season, not during it.

Test a restoreProve you can get practice data and email back.
Review accessRemove leavers, check who can reach ATO services and client portals.
Update devices and softwareSo patching does not interrupt the busiest weeks.
Brief the team on fraudFake ATO emails and client bank change requests spike around lodgment time.

Our view

Protect the mailbox and the TFNs first.

Most incidents we see in professional services start with one mailbox. In an accounting practice, that mailbox usually holds years of returns, notices and ID documents. So we start with sign-in, a client portal to get TFNs out of email, and monitoring of mailbox rules.

Then we bring devices under management, tidy up connected apps and make sure backups would get the practice running again. That order protects clients and gives you evidence for your insurer and the TPB.

The order

Securing an accounting practice in five steps.

Step 1Lock down sign-in
Strong MFA, starting with partners and admins.
Step 2Get TFNs out of email
A client portal and retention rules.
Step 3Bring devices and apps in
Managed devices, reviewed integrations.
Step 4Back up and monitor
Independent backups and monitoring.
Step 5Plan and train
Breach plan with the ATO number, staff fraud briefings.

Related guides

Accounting firm IT in depth. Start with the mailbox.

Fraud, sign-in, incidents and insurance.

Get help your way

Six ways to reach us. Pick whichever suits you.

Helpdesk hours are Monday to Friday, 8am to 5pm AEST. On Advantage and above, emergencies get a response within 1 hour and outages within 2, with 24/7 best-effort escalation.

Questions

What accounting firms ask about IT and security.

What IT obligations apply to Australian accounting firms?

The Privacy Act and its Notifiable Data Breaches scheme, the Tax File Number rules, the TPB Code of Professional Conduct for registered tax and BAS agents, and AML/CTF obligations if you provide designated services. This is general information, not legal advice.

Does the small business exemption get us out of the Privacy Act?

Not for tax file numbers. If you hold TFNs, the TFN rules apply to you regardless of turnover, and a data breach involving TFN information falls under the Notifiable Data Breaches scheme.

What changed in the TPB Code of Professional Conduct?

The Code Determination 2024 added eight obligations, including keeping proper client records, making sure work done on your behalf is competent, and maintaining a quality management system. They apply from 1 January 2025 for firms with more than 100 staff and from 1 July 2025 for everyone else.

Do AML/CTF obligations apply to our practice?

Only if you provide designated services, such as forming companies or trusts, acting as or arranging a director or trustee, buying or selling businesses for clients, or handling client money for those services. Ordinary tax and compliance work alone generally does not bring you in. Obligations started 1 July 2026. Check your position with an AML adviser.

What should we do first after a data breach?

Contain it, then call the ATO Client Identity Support Centre on 1800 467 033 so it can protect client accounts. Assess the breach under the Notifiable Data Breaches scheme, check the TPB guidance, tell your insurer and software provider, and point affected clients to IDCARE on 1800 595 160.

Does our cloud practice software back up our data?

The provider protects its own platform, but that is not the same as a copy you control. Export or back up your practice data, Microsoft 365 and documents separately, keep copies that cannot be deleted, and test restoring them.

Next step

Want an IT assessment built for an accounting practice?

We assess sign-in, TFN handling, devices, connected apps, backups and your breach plan, then give you a prioritised plan and evidence for your insurer and the TPB.

Talk to us 07 3114 2808