The risk is concentrated in trust
Attackers do not need to break every system. A compromised mailbox can reveal client names, payment timing, tax documents and the language used in real conversations. That context can support convincing impersonation or fraudulent banking-detail changes.
Protect business email with enforced MFA, strong domain authentication, monitoring and a defined method for independently verifying payment changes. Staff should use a known phone number or established contact — not contact details supplied in the request itself.
Cloud accounting is still your responsibility
Using a reputable cloud platform transfers parts of infrastructure management, not the firm's responsibility for accounts, permissions, integrations, devices and client data. Review who has access to each client environment, which third-party apps are connected and how access is removed when staff or contractors leave.
Client files need deliberate handling
Identify where tax records, payroll information, identification documents and financial statements are stored and shared. Reduce uncontrolled downloads, personal email use and public links. Apply safeguards appropriate to sensitivity and verify that retention and deletion practices match legal and professional obligations.
Busy season changes the threat model
High workload increases urgency, temporary access, remote work and exception-making. Before busy season, complete access reviews, patching, backup tests and staff refreshers. Define escalation paths so a suspicious request does not sit unanswered because everyone is overloaded.
Recovery must protect deadlines
Map critical systems to client and filing deadlines. Test restoration for email, shared files, identity systems and practice-management or accounting data. Record recovery priorities and the people authorized to make decisions during an interruption.
Cyber insurance renewal should be evidence-led
Controls can support a clearer renewal conversation, but they do not guarantee coverage or lower premiums. Maintain evidence of MFA enforcement, access reviews, endpoint coverage, backups, restore tests, training and incident-response planning. Answer insurer questions accurately and involve a qualified broker.
Where automation fits
Security is only one part of operating resilience. Carefully governed automation can improve lead follow-up, onboarding, document collection, recurring client communication and management reporting. High-risk steps — payments, filings, payroll and privileged access — need stronger approval, logging and human review.
When intake, engagement, billing, staff capacity and client communication must operate as one coordinated system, the requirement may have moved beyond separate automation into OR ONE territory.