Cyber Insurance for Accountants

Cyber Insurance for Accountants

Cover for accounting firms, tax agents and bookkeeping practices

Cyber insurance for accountants can help an accounting practice respond to an insured data breach, ransomware attack or network security incident. Depending on the policy, cover may include specialist investigation, privacy legal advice, client notification, system recovery, business interruption and certain liability claims.

Accounting firms hold information about clients, businesses and employees: tax file numbers, identity documents, bank details, financial statements and payroll records. A compromised account can expose several categories of information in a single incident.

Clarke Lyons Insurance helps Australian businesses explore cyber cover in the context of their operations and existing insurance. Speak with us about cyber insurance for your accounting firm, tax practice or bookkeeping business.

Request an accounting firm cyber insurance quote. Have your current PI and cyber policies ready so the arrangements can be considered together.

What is cyber insurance for accountants?

Cyber insurance addresses specified costs and liabilities arising from cyber incidents. It may combine first-party cover for the practice’s own response and recovery costs with third-party cover for certain claims made against the practice.

Cyber liability insurance for accountants should reflect how the firm handles information, accesses client systems and relies on technology to deliver services.

An accounting practice may need different provisions for a client data breach, fraudulent payment, ransomware incident or outage at a software provider. The policy title alone does not establish which of these events is insured.

Why accounting firms face cyber exposure

A practice can hold information spanning individual tax returns, company finances, employee payroll and business transactions. Clients may also grant access to accounting software, payment workflows or financial records.

This creates exposure through email, document portals, cloud software, remote access and outsourced services.

Criminals may try to obtain client information, exploit payment instructions or compromise a trusted account.

An incident may disrupt more than one engagement. The practice could need to investigate many client files while continuing to manage payroll, reporting and lodgement deadlines.

The insurance assessment should consider records held and responsibilities accepted, alongside annual revenue.

Who should consider accounting cyber insurance?

Relevant businesses include sole practitioner accountants, accounting partnerships, tax agents, BAS agents, bookkeepers and larger accounting firms.

Disclose services such as payroll processing, business advisory, audit, outsourced finance functions and access to client payment systems. Explain any additional financial services, specialist engagements or overseas operations.

Your policy should identify the correct entities and business activities. Separate companies, acquired practices and joint ventures should not be assumed to be included automatically.

What can cyber insurance cover for an accounting firm?

Available cover varies between insurers and policies. Areas to discuss include the following.

Incident response and forensic investigation

Specialists may investigate compromised accounts, establish how an attacker obtained access and assess whether records were taken.

For an accounting practice, this can involve email, document management, remote access and connections to client systems. Confirm how to activate the response service, which providers are approved and what costs require consent. Australian cyber insurance offerings can include access to specialist incident response services.

Data breach response and notification

A policy may cover specified privacy advice, notification expenses and support for affected individuals after an insured breach.

Assess this separately from liability claims. A firm can face substantial response costs even before a client seeks compensation.

Data restoration and ransomware recovery

Cover may address defined restoration expenses following an insured incident. Check how the wording treats backups, corrupted records and costs of rebuilding affected systems.

Restoring data does not necessarily establish that stolen information is secure. An incident may require both recovery work and privacy assessment.

Cyber business interruption

Depending on the wording, cover may address defined income losses and additional expenses caused by a qualifying interruption.

Waiting periods, indemnity periods and loss calculations matter. A busy period or missed deadline does not automatically establish an insured financial loss.

Privacy and network security liability

Clients or other parties may allege that the firm failed to protect information or that a security failure caused them loss.

Where insured, cover may address defence costs and compensation. Regulatory response expenses and penalties require separate assessment, including whether they are legally insurable.

Cyber extortion and fraud

Some policies include specified extortion response expenses or social engineering cover. Availability, sublimits and conditions vary.

Do not assume that an insured email investigation means stolen money or a ransom payment is also covered. Any payment is subject to applicable law and relevant approval requirements.

Australian insurer offerings illustrate that privacy liability, interruption, dependent interruption, extortion and social engineering can be separate coverage areas. Availability and terms need individual assessment.

Cyber insurance for tax agents and BAS agents

Tax practices should consider the information retained across current and former client engagements. Historical files can create exposure even when the client relationship has ended.

The Tax Practitioners Board says cyber insurance is not a requirement under its Code of Professional Conduct. It recommends considering additional PI policy features addressing fraud and cyber threats, including losses suffered by an agent following a cyberattack.

This does not establish that every PI policy includes sufficient cyber cover. Review the actual wording, any cyber restrictions and the practice’s own recovery expenses.

The TPB also emphasises client confidentiality when giving software providers access to client information. Insurance does not replace those professional obligations.

Tax file numbers and client data protection

Handling tax file numbers requires particular attention. The OAIC identifies the Privacy (Tax File Number) Rule 2015 as a binding rule governing TFN information.

Small business status does not automatically remove every privacy obligation. The OAIC notes that some small businesses have specific obligations concerning TFN information.

An accounting firm should assess access, transmission, retention and disposal of client records with appropriate privacy advice.

Cyber insurance may help with specified response costs after an insured event, but it does not establish that the firm’s data handling complies with the law.

Payroll fraud, invoice scams and business email compromise

Payroll and payment workflows create insurance questions beyond ordinary data breach cover.

A criminal may impersonate an employee requesting a bank account change, send altered supplier details or use a compromised client mailbox to request payment.

The firm might process payroll data without releasing funds, or it might have authority to initiate a payment. These roles carry different responsibilities.

When assessing cover, establish:

Who owns the money that was transferred.
Who authorised or processed the payment.
Whether the firm faces a liability demand.
What response expenses the firm incurred.
Which fraud or social engineering provisions apply.

A client’s direct financial loss, the practice’s own loss and a negligence allegation may require different policy responses.

Verify payment changes through a trusted contact method independently of the message requesting the change.

Cloud accounting software and dependent interruption

Practices may use Xero, MYOB, QuickBooks, Microsoft 365 and other cloud services for accounting, communication and documents.

Using established platforms does not remove the risks associated with account access, connected applications or reliance on external systems.

A provider incident could interrupt your work even if the firm’s own network remains operational. Ask whether dependent business interruption covers the provider and the type of outage.

Check waiting periods, provider definitions, sublimits and exclusions. Ordinary maintenance, service degradation and every software outage should not be assumed to be insured.

Outsourced bookkeeping, offshore teams and managed IT

Disclose how employees, contractors and external providers access client information. Relevant arrangements can include offshore processing, outsourced payroll and managed IT support.

A provider’s own insurance does not automatically cover your firm’s costs or liability. Your policy should be assessed against the outsourcing arrangements you actually use.

Clarify access permissions, confidentiality obligations and incident reporting in the relevant contracts. Changes to providers or services may also warrant an insurance review.

Ransomware during a busy reporting period

A ransomware incident can stop access to working papers, payroll files and client correspondence when the practice is under time pressure.

The impact may involve recovery costs, additional staffing, delayed invoices and disrupted services. These are potential consequences, not guaranteed insured losses.

Discuss the interruption trigger, waiting period, recovery period and evidence required to calculate a loss. Also check whether restoration or mitigation expenses require insurer approval.

A response plan should include an alternative way to contact staff, clients and insurers if normal email is compromised.

Cyber insurance versus accountants’ professional indemnity insurance

Professional indemnity insurance principally addresses certain liabilities arising from professional advice and services. Cyber insurance may address defined incident response expenses, recovery losses and cyber-related liabilities.

An allegation about incorrect tax advice raises different questions from unauthorised access to client records. One incident may nevertheless involve both.

Some PI policies include privacy or cyber-related provisions; others contain relevant restrictions. A cyber policy may also exclude particular professional services liabilities.

Review the policies together. Neither the existence of PI cover nor the purchase of cyber insurance proves that every exposure is addressed.

Does tax audit insurance cover a cyber incident?

Tax audit insurance and cyber insurance serve different purposes.

Tax audit cover may address specified professional fees incurred in responding to certain audits or enquiries, subject to its wording. Cyber cover may address specified cyber events and resulting costs.

A ransomware attack, stolen client file or fraudulent transfer should not be assumed to be covered by a tax audit policy.

If the practice offers or holds multiple insurance products, identify the intended insured parties and triggers for each.

Hypothetical accounting firm cyber claims

These examples illustrate possible exposures. They are not Clarke Lyons claims records or promises of cover.

A compromised mailbox exposes tax records

An employee enters credentials on a fake login page. An attacker accesses emails containing client identity documents and tax information.

The firm may need forensic investigation, privacy advice and client communications. The response depends on the incident, policy terms and approved expenses.

A payroll bank detail change is fraudulent

A request appears to come from a client employee. Bank details are changed and a payment goes to an attacker.

Who transferred the funds, the verification process and the firm’s agreed payroll responsibilities matter. Cover for data breaches alone does not establish cover for the payment loss.

Ransomware interrupts access to working papers

The practice cannot access files needed to deliver client work. It incurs recovery costs and alleges interruption losses.

Backups, event definitions, waiting periods, financial evidence and insurer consent requirements would be relevant to an insurance assessment.

How much does cyber insurance for accountants cost?

The cost depends on the practice’s activities, information, security controls and requested cover. There is no reliable universal premium for every accounting firm.

Insurers may consider:

Revenue, staff and office locations.
Client record numbers and types of information held.
Payroll, payment and advisory responsibilities.
Cloud services and external providers.
Multi-factor authentication, backups and access controls.
Previous incidents and known circumstances.
Requested limits, excesses and extensions.

A sole practitioner tax business and a multi-office firm providing outsourced finance services can have materially different requirements.

Compare accounting cyber insurance quotes on response services, exclusions, interruption conditions and fraud sublimits alongside price.

How much cyber insurance does an accounting firm need?

Consider the possible cost of investigation, legal advice, restoring systems, communicating with clients and defending a covered claim.

The number of affected individuals can extend beyond direct clients. Payroll files may contain information about many employees, while business records can identify directors and other people.

Check whether response expenses and liability claims share an aggregate limit, and whether smaller sublimits apply to specific losses.

Client contract requirements provide another input, but do not establish the suitability of the entire policy.

What should accountants check before selecting cyber cover?

Review the following against the practice’s actual work:

Incident triggers and notification requirements.
First-party response and restoration cover.
Privacy and network security liability.
Business interruption and dependent interruption.
Fraud, social engineering and whose money is insured.
Security declarations, conditions and exclusions.
Approved response providers and consent requirements.
Outsourced services, locations and jurisdictions.
Known incidents and treatment of prior events.
Coordination with PI, crime and other insurance.

A certificate of currency or short product summary will not explain all these provisions.

Preparing for an accounting cyber insurance quote

Prepare a clear service description and details of your systems, staff, records and external providers. Include payroll responsibilities, payment authority and offshore access where relevant.

Confirm your security controls with your IT provider. Multi-factor authentication enabled for some accounts should not be described as applying to all accounts without verification.

Provide current insurance schedules, relevant contract requirements and details of previous incidents or circumstances. Accurate disclosure helps insurers assess available terms.

What to do after a suspected accounting data breach

Activate your response plan and contact the insurer’s designated incident response service promptly. Preserve relevant records and obtain expert assistance to contain compromised access.

If money has been transferred fraudulently, contact the relevant financial institution immediately using trusted contact details.

Obtain privacy advice where client information may be affected. For organisations subject to the Notifiable Data Breaches scheme, eligible breaches require notification to the OAIC and affected individuals.

Check insurer consent requirements before appointing providers, making admissions or incurring substantial costs. Insurance notification does not replace regulatory reporting.

Why discuss accounting firm cyber insurance with Clarke Lyons?

Clarke Lyons helps Australian businesses explore cyber insurance suited to their information, systems and operations.

For an accounting practice, the discussion can consider current policies, outsourced services, client records and payment workflows together.

Ask about available incident response arrangements, policy limits and important restrictions so the cover can be assessed against how your practice operates.

Explore our cyber insurance for Australian businesses for a broader overview.

Frequently asked questions about cyber insurance for accountants

Do sole practitioner accountants need to consider cyber insurance?

Yes. A sole practitioner can hold confidential client records and depend on digital systems. Appropriate cover depends on the practice’s exposures, contractual obligations and existing insurance.

Is cyber insurance compulsory for tax agents?

The TPB says cyber insurance is not required under its Code of Professional Conduct, while recommending consideration of fraud and cyber protection. Check other applicable contracts and obligations separately.

Does accountants’ PI insurance cover a data breach?

It may address certain liabilities depending on the wording. Do not assume it also covers the firm’s forensic investigation, restoration, notification and interruption costs.

Can cyber insurance cover ransomware?

A policy may cover specified response, restoration, extortion or interruption costs following an insured event. Limits, exclusions, conditions and approval requirements apply.

Is payroll fraud covered by cyber insurance?

Not automatically. Review social engineering and fraud provisions, whose money is insured and the firm’s role in processing or authorising payments.

Can cover apply to a cloud accounting software outage?

Potentially, where dependent interruption cover includes the provider and the event meets the policy terms. Waiting periods, sublimits and exclusions matter.

Does a small accounting practice have TFN obligations?

Small business status does not automatically remove obligations relating to tax file number information. Assess the applicable TFN and privacy rules for your practice.

Can bookkeepers and BAS agents obtain cyber insurance?

They can seek cover, subject to underwriting. Disclose services, client information, systems and payment responsibilities accurately.

Can I buy cover after discovering a cyber incident?

Do not assume a new policy will cover an incident already known to you. Notify existing insurers as required and seek appropriate response assistance.

Request cyber insurance for your accounting practice

Speak with Clarke Lyons about cyber insurance for your accounting firm, tax business or bookkeeping practice.

Whether you work independently or manage a growing team, provide your service details, systems, client information and existing insurance so available options can be assessed.

Request an accountants’ cyber insurance quote. Ask Clarke Lyons to consider the relationship between your cyber, professional indemnity and wider business cover.

General information only. Cover is subject to insurer acceptance and policy terms, conditions, limits and exclusions.