Cyber risks in accounting

In this article, we are going to be exploring some of the biggest cyber risks, specifically focusing on cyberrisk, that accountants need to be aware of in their accounting practice. To start with, we will begin by exploring what cyber risks are and what they can mean for accountants. We will then look at what some of the different cyber risks are in more detail, including key examples of cyberrisk, before moving on to explore some practical steps and strategies that accountants can use to protect themselves and their clients from different cyber risks.

What is a cyber risk?

Understanding Cyber Risks in Accounting

Recognizing the importance of understanding cyberrisk is essential in today’s digital landscape, particularly in the accounting profession where the implications of these cyber risks can be severe.

A cyber risk in accounting is basically any risk related to information technology systems that could cause financial loss, disruption, or damage to an organisation. By definition, the term “risk” looks at how probable or likely it is that a particular event will occur, so in this case, we are looking at how likely it is that something bad could happen to an organisation’s information technology systems due to cyber risks in accounting.

Any user of the internet and digital technologies is susceptible to cyber risks. However, as accountants, we can have particularly a lot at stake if our systems were to become compromised, given the significant amounts of financial data and other sensitive information we hold about our clients. Account numbers, transaction details, card details, bank accounts, usernames and passwords, and other types of personal and private information are all examples of information that could be accessed or leaked if we were to experience a cyber risk or attack related to cyberrisk.

Being aware of cyberrisk is crucial for accountants as it can affect their operations and reputation.

Understanding these cyber risks in accounting is critical in today’s digital landscape, particularly in the accounting profession where the implications of cyber threats can be severe.

It is vital to acknowledge the different types of cyber risks, particularly cyberrisk, that we face, and know how to protect ourselves against them. This is one of the primary focuses of this article.

For this reason, it is essential that we understand the different cyber risks in accounting, including cyberrisk, that we face, and know how to protect ourselves against them. This is one of the things we are going to be looking at in this article.

The good news is that there are numerous ways we, as accountants, can safeguard ourselves and protect our clients against various cyber risks, including significant cyberrisk. These protective measures fall under the broader category of ‘cybersecurity,’ which encompasses all practices aimed at defending our systems against potential cyber risks and threats. In this article, we will look at different cybersecurity measures tailored for accountants in greater detail.

What can cyber risks mean for accountants?

As we touched on in the previous section, there can be a number of implications for accountants and their clients if cyber risks are not properly managed. Some of the potential repercussions of cyber risks can include:

• Your devices, servers, or systems being accessed by an authorised person or party
• Your devices, servers, or systems becoming infected with malware or viruses, which may result in an authorised person or party being able to access sensitive information and financial details
• Your website, devices, servers, or systems being taken offline or made inaccessible
• Data or information being lost, destroyed or altered by an unauthorised person or party
• Personal or sensitive information about the company or its clients being accessed by, stolen, or released to unauthorised people or parties

All of these things can have a negative impact on the profitability and reputation of your business, as well as your ability to carry out your key business activities without disruption, if they were to occur. For example, if a security breach occurred where your clients’ details and financial records were leaked to an unauthorised person or third party and released, that may call into question the security of your firm, and make clients less likely to trust you with their sensitive information in future. Or, if your devices and systems were attacked, you may be unable to access the data and information you need to be able to carry out your work, meaning you would be unable to do this or make a profit for the time these were offline. These events could also expose you to legal repercussions or other consequences, if it was found you did not meet your obligations under the Privacy Act or other relevant legislation.

For this reason, it is important that as an accountant, you familiarize yourself with the various types of cyber risks, particularly cyberrisk, and know how to protect yourself, your company, and your clients against each one to minimize the likelihood of encountering any cyber risks.

What are some of the different types of cyber risks, including cyberrisk?

When we talk about cyber risks, there are a couple of different types that need to be taken into account. Generally speaking, there are two main types of risks: those resulting from system failure or technological issues, and those resulting from a cyberattack. Let’s start by looking at the first type: system failure.

When we talk about cyber risk resulting from system failure or technological issues, we are basically referring to any event that results in the loss or damage of your files, systems, servers, or devices as a result of a failure in these two things. Most often, this kind of failure would occur if your hardware or software were to fail or malfunction, which could result in:

• Your files, data, or information becoming corrupted, damaged, unreadable, or inaccessible
• Files containing important data or information being lost or saved over
• You being unable to turn on your device to access your data or information

This kind of cyber risk could also include things like a staff member accidentally losing or damaging data or information - for example, by deleting data or information believing there is another copy stored somewhere else, when there is not.

Moving on to the second type of cyber risk, we have cyber risks resulting from a cyberattack. A cyberattack occurs when a hacker or cybercriminal targets your information systems, computer networks, servers, and accounts with the intention of accessing, stealing, modifying, damaging, or destroying information and data. All devices and systems can be susceptible to a cyberattack (including desktops, laptops, phones, tablets, and other devices), which is why it is so important that businesses know how to protect themselves against one.

Under the cyberattack umbrella, there are a range of different threats that may be used to target a business or company and their information systems. Some of the most common ones include:

• Scams (where the hacker or cybercriminal imitates a legitimate business or individual, and tricks you into providing them with money or personal information)
• Phishing emails (when an employee or business is sent an email that prompts them to click a link, which may then provide the hacker or cybercriminal with access to their systems or information)
• Data breaches (also known as a “data spill” - when a security breach occurs and a hacker or cybercriminal is able to gain unauthorised access to the business or company’s information and data, which they may then release on to further unauthorised parties)
• Hacking (which occurs whenever someone gains unauthorised access to a system, device, or network)
• Malware (where a hacker or cybercriminal installs malicious software on your device, which is designed to steal your information or gain unauthorised access to your systems)
• Ransomware (another kind of malicious software that may be installed by a hacker or cybercriminal, which damages, locks, or encrypts your files so that they become inaccessible)
• Viruses (another type of malicious software that is designed to impair system functionality and disrupt business operations)

As you can see, there are a range of different cyber risks that businesses and companies, including accountants, need to be aware of. The good news is that by educating yourself on the different cyber risks out there and equipping yourself with the skills, knowledge, and resources to be able to prevent them and respond in the event that one of these risks does actually occur, you will be best-placed to minimise the damage caused to your information systems and data.

How can accountants protect themselves from cyber risks?

At the start of this article, we touched on cyber security, which basically refers to all the things we can do to protect ourselves against different cyber risks. Broadly speaking, these cyber security measures can be classified into six main categories, which break them down based on the type of activity that is being carried out and the kind of protection that it is designed to offer. These categories are:

• Network security (which refers to how we secure our computer network against attacks or access by intruders)
• Application security (which refers to the steps that we take to protect our software applications and devices against threats)
• Information security (which relates to how we protect the integrity, privacy, and security of the data that we store and handle, to ensure that it remains protected against unauthorised access)
• Operational security (which covers the processes and practices that we use to protect our data assets - for example, by managing who accesses the data, how and where it is stored, and where and when it can be accessed)
• Business continuity (may also be referred to as disaster recovery - relates to how we respond to an adverse event that causes loss or damage to our data and information systems, with a view to restoring our operations and information and returning to normal as quickly as possible)
• End user education (which relates to the steps that we take to educate ourselves and our employees, colleagues, and clients about the different cyber risks and how to protect ourselves against each one, which helps to minimise the human risk factor by ensuring everyone follows good cybersecurity practices)

Within each of these categories, there will be a whole range of different techniques, strategies, practices, and action steps that we can take to minimise cyber risks, and protect ourselves and our information against these. Whilst it would be impossible to cover every cyber risk within the scope of this article, here are some of the main steps that accountants can take to protect themselves, their company, and their clients against cyber risks.

• Making regular backups:Setting and maintaining a regular backup schedule is one of the best ways that businesses and companies can protect themselves from their data or information becoming damaged, overwritten, or lost. This is particularly true in relation to the kinds of cyber risks resulting from technical failure or system failure, as we touched on in the last section. By creating regular backups (e.g. daily, weekly, or monthly) that are stored in multiple locations (e.g. one on the company’s server and one in the cloud), the likelihood of your company’s information, data, and files becoming lost is very low. In the event that something did happen to your information system, you would then be able to restore your files from the last backup that was performed, meaning any losses would be minimal.
• Know what to look for:Many cyber risks can have a significant impact on your business activities and systems, particularly if they go unnoticed and are successful in gaining full access to your devices and systems (e.g. viruses, malware, and ransomware). Knowing what to look for can play an important role in addressing these issues in a timely manner if they do arise.

As just one example, by knowing the signs of a virus (e.g. a slow system, unwanted pop-ups, unexplained blue screens, crashing, and unusual system changes), you are then able to keep an eye out for these and take immediate action if you notice any of them.

• Educate your staff:Research shows that 82% of cyberattacks are a result of human error. For this reason, it is essential that businesses and companies educate their staff on cyber risks and cybersecurity, so that they have a thorough understanding of this. In particular, you will want to make sure that they know what some of the different cyber risks are, what to look for in relation to each one, and what to do in the event that they come across a potential cyber risk. For example, would your staff know what to do if they received an email that asked them to confirm their personal details or the company’s payment information? Whilst this seems obvious, many phishing emails can look very convincing, and can imitate the branding and email address/website URL of a legitimate company. This can mean that if, for example, you receive an email that appears from a supplier that you actually work with asking for you to confirm your payment details, it can be challenging to discern whether it is actually from the supplier or not. For this reason, it is important that staff are aware that these kinds of emails exist, and the things they should be checking for to see whether the email and sender is legitimate, before handing over their payment details. Likewise, some phishing emails ask you to click a link, which if you do so, will then provide the scammer with access to your device and systems. Would your staff know what to do if they received an email like this purporting to be from your organisation or another organisation that you work with, asking you to click a link to update your details?
• Install an anti-virus or internet security software:Almost all businesses or companies will have some kind of anti-virus or internet security software installed. This kind of software can help to protect devices and systems against cyberattacks and other types of cyber threats, by continuously monitoring for potential threats and taking immediate action when one is identified. Having this kind of software installed on your work devices and systems ensures that any cyber risks are handled promptly, so that they do not get the chance to infiltrate your devices and systems and cause serious damage.
• Ensuring you are compliant with the Privacy Act:The Privacy Act is a piece of legislation that governs how businesses and companies collect, store, handle, and use personal information and data. Of course, accountants are also governed by this piece of legislation, so it is important that you are familiar with the obligations and responsibilities outlined in the Act. You should also ensure that you take the necessary steps, as outlined in the legislation, to protect and secure the information that you collect and store about your clients. This might include password protecting or encrypting files, restricting access permissions, using multi-factor authentication for logins, or using a secure storage and file management platform.
• Restrict access permissions:Building on the earlier point about 82% of cyberattacks being a result of human error, it is worth businesses and companies restricting access permissions to ensure that only staff members who need to have access to information or data have access to it. By preventing staff members from having access to data or information that they don’t need access to, this reduces the risk of unauthorised access, misuse, or abuse, or an employee accidentally providing a hacker or cybercriminal with access if they were to click on a phishing email or fall victim to a scam.
• Use a secure cloud-based file storage platform:Many cloud-based file storage platforms or file management systems have a range of built-in features designed to ensure the security of your data and information. Many have functionalities such as password protection and encryption, as well as automatic backups (which can help with the previous point where we talked about the necessity of ensuring you schedule regular backups for your business or company’s files, data, and information). It’s advisable to keep your data stored in a localised fashion (i.e. by using the cloud-based platform and perhaps a company server or one other location, rather than spreading the data, information, and files across multiple different servers and platforms). Not only does this make the data and information more difficult to locate, but this can also increase your risk of falling victim to cyber risks, as you have multiple different systems that you are trying to monitor and protect, rather than just one or two.
• Choosing secure passwords:It is thought that around 80% of hacking-related breaches are the result of insecure passwords and human error. Ensuring that all of your staff and company accounts use secure passwords is one of the best ways that you can protect them from unauthorised access and other cyber risks. Passwords should be strong and hard to guess, meaning they should be long and include a mix of numbers, letters, characters, and upper and lower case. Common words (e.g. Password.1) should be avoided.
• Having a detailed cybersecurity management plan:It is recommended that businesses and companies prepare a detailed cybersecurity management plan. This plan should be prepared in consultation with a cybersecurity and IT expert, and cover all the things you will be doing to protect your data and information from cyber risks. This may include a combination of different practical strategies from this list, or others that the cybersecurity or IT expert you are working with identifies as being appropriate for your business and the type of information or data you store.
• Having an incident response plan:It is also important to have a detailed plan for how you will respond in the event of a cyberattack or another type of cyber risk. For example, if your server or devices were to suddenly go down, what would you do? How would you ensure your business remains operational during this time, and how would you react to minimise damage in the event of an attack? Again, working with an experienced cybersecurity or IT expert is the best way to formulate an incident response plan tailored to your business and the types of information and data you collect.
• Cybersecurity audits:Finally, working with a cybersecurity or IT expert to conduct regular cybersecurity audits is another way in which accountants and other types of businesses can protect themselves against cyber risks. Carrying out these kinds of checks and audits regularly will ensure that any vulnerabilities or threats are identified early, and strategies or updates are implemented to mitigate, reduce, or eliminate the risk before a breach or attack actually occurs.

In conclusion, recognizing the various cyber risks, especially cyberrisk, that professional accountants face daily is crucial. Given the sensitivity of financial data, we must take the necessary precautions to minimize our cyber risks and enhance our cybersecurity strategies. These measures can significantly reduce our vulnerability to cyberattacks and ensure the safety of the information we manage.

In conclusion, there are a number of cyber risks that professional accountants need to be aware of throughout their day-to-day accounting practice. Given the sensitivity of financial data and other kinds of information handled by accountants, it is important that we take appropriate precautions to minimise our cyber risks and maximise our level of cybersecurity. All of these things can help us to reduce the risk of system or technological failure, as well as our susceptibility to cyberattacks. In turn, this will help us to ensure our systems remain safe and secure, and that the information we hold about ourselves, our company, employer, and our clients remains protected.

By understanding the landscape of cyberrisk, accountants can better prepare for and mitigate these threats.

How artificial intelligence (AI) is disrupting accounting

Understanding the significance of cyberrisk in today’s world is paramount for accountants.