Security questions to ask an offshore accounting provider

1. Where does our data live, and under which law?

Australian Privacy Principle 8 says that before you disclose personal information overseas, you must take reasonable steps to make sure the recipient doesn't breach the principles. If they breach anyway, section 16C of the Privacy Act treats it as your breach. That holds even if you took reasonable steps, and even if a subcontractor caused it (OAIC, APP 8 guidelines). The OAIC says it generally expects an enforceable contract requiring the recipient to handle the information in line with the APPs. There's an exception where the recipient is bound by a substantially similar law, but you need a reasonable belief that it is. Don't assume that for any country without advice.

A good answer names the country where the people sit and the country where any copy of your data is stored. If the work happens inside your own Xero or practice software, the answer is usually "your data stays in your systems and our people log in to them". Either way, they should accept the APP terms in writing.

2. Who can see it?

The Australian Cyber Security Centre's advice for small business is plain. Staff should have access only to the systems and data they need. Shared accounts increase risk and make activity harder to trace. Multi-factor authentication is one of the most effective ways to protect business accounts, and codes sent by SMS or email are its least secure form (ACSC, securing accounts and identities). MFA and restricting administrative privileges are also two of the Essential Eight, the baseline controls the Australian Signals Directorate recommends (ASD, Essential Eight explained).

A good answer sounds like a named login for each person inside your software, access only to the client files they work on, and MFA through an authenticator app. No shared logins. An access list they can show you today. That is how our outsourced bookkeeping team works: named logins in your software, seeing only the files you give them access to.

3. What does your certification cover, and what doesn't it?

ISO/IEC 27001 sets the requirements for an information security management system: a system for managing risks to the information an organisation owns or handles. Certification to it is optional, and it is done by an independent certification body, not by ISO, which does not certify anyone (ISO/IEC 27001:2022; ISO on certification). The certificate names a scope: which organisation and which activities were audited, at which sites. A certified office network or data centre is a different thing from a certified process for handling your clients' files. A certificate shows a management system exists and passed an audit. It doesn't promise that nothing will go wrong.

A good answer is the certificate itself. Read the scope statement. Check that the certification body is accredited (in Australia and New Zealand the accreditation body is JAS-ANZ). Then ask the provider to say plainly what sits inside the scope and what doesn't. Our site says our people work on ISO 27001-certified infrastructure. Ask us the same question.

4. What devices and workplace do your people use?

The Tax Practitioners Board says that if you outsource or offshore, you must take reasonable steps to make sure sufficient IT security controls are in place on both sides. Its list includes encrypted network traffic, security credentials, access controls, audit trails, segregation of duties, and approval and review of data changes (TPB, outsourcing and offshoring).

A good answer sounds like devices the provider owns and manages, with personal laptops ruled out. No client documents saved to the device or sent to personal email. A clear account of where people work. If it's an office, ask who can walk in. If it's home, ask how the device and network are controlled and what stops someone photographing a screen.

5. What happens when someone leaves?

The ACSC's advice is to change login details when staff leave or change roles, and to remove access promptly (ACSC). Most of the risk is in the gap between the resignation and the deleted login.

A good answer is a written offboarding process, same-day removal, and a message to a named person at your firm. If the logins sit in your own software, you can remove them yourself.

6. How and when will you tell us about an incident?

Under the Notifiable Data Breaches scheme, an eligible data breach is unauthorised access to, disclosure of, or loss of personal information that is likely to cause serious harm. Remedial action that removes the risk takes it out of scope. Once you suspect one, you have 30 calendar days to take all reasonable steps to finish your assessment. Once you believe one has happened, you must notify the OAIC and the affected people as soon as practicable. Where information is held jointly, only one entity needs to notify. The OAIC says the one with the most direct relationship with the individuals is usually best placed, and for client data that is your firm (OAIC, NDB scheme guidance).

You can't meet those deadlines if you hear about the incident late. A good answer is a written breach response plan that includes telling you about suspected breaches, a named contact, and a timeframe in hours. The OAIC lists breach notification to you as expected contract content.

7. Are you insured, and are we?

The TPB tells registered practitioners who outsource to review their professional indemnity policy and check it covers the outsourced services (TPB). Ask the provider for proof of its cover, then call your insurer. Don't assume either way.

8. Who else touches the work?

The OAIC expects your contract terms to flow down to any third party the provider uses, and section 16C liability can arise through a subcontractor (OAIC). A good answer is that the people on your files are the provider's own staff, that nobody else is involved, and that any change needs your written consent.

9. Can we audit you?

The TPB says services provided on your behalf by unregistered people must be under the supervision and control of a registered practitioner, with adequate review arrangements (TPB). You can't supervise what you can't see. A good answer is yes, on notice. And if the work happens in your software, the audit trail is already yours. Review and sign-off are among the things that stay onshore whatever you move.

What to put in the contract

Most of the above comes down to seven clauses. The OAIC's APP 8 guidelines list the first two, the fourth and the last as expected contract content (OAIC, APP 8 guidelines).

• The kinds of personal information you will share and what the provider may do with it.
• A duty to handle it in line with the Australian Privacy Principles, including storage and destruction. The same terms flow down to anyone the provider uses.
• No subcontracting without your written consent.
• A data breach response plan, with a duty to tell you about suspected breaches and a timeframe in hours.
• Named logins, least privilege and MFA as conditions of access, and removal of access the day someone leaves.
• A right to audit on notice, and return or deletion of your data when the engagement ends.
• A complaint-handling process.

This is a summary, not legal advice. Have your adviser read the final wording. For client consent and the review layer, see how to move your firm to offshore bookkeeping. For how we run access and review week to week, see how we work.

Questions

Is offshore accounting safe?

It can be. The risk sits in access and process, not in geography. A provider whose people work inside your software with named logins, limited access and MFA, on managed devices and under the contract above, is a controlled risk. A provider who copies your files onto its own systems and can't show you who has access is not.

Does ISO 27001 mean our data is secure?

No. It means an independent body audited the provider's security management system within a stated scope. Read the scope, and still ask the other eight questions.

Do we have to tell our clients?

If you're a registered tax or BAS agent, yes. The TPB says you must get the client's permission before disclosing their information to a third party. You must also tell them to whom and where it will be disclosed, including whether that is overseas. An engagement letter that names the provider and the country, or another signed consent, does the job. A generic line does not (TPB).

Next step

If you'd like to put these questions to us, book a call with me. Bring your engagement letter and a list of the software your clients' files live in. I'll answer each question straight, show you how our people would be set up inside your systems, and tell you if we're not the right fit. If we go ahead, a co-founder joins your weekly review.