Cloud Accounting Security: The Shared Responsibility Gap
- Oct 17, 2025
- 10 min read
Updated: 3 days ago
The cloud accounting dashboard glows reassuringly. ISO 27001, SOC 2 Type II, encryption, uptime promises, a compliance page with enough badges to make a procurement team smile.
Then someone on a distributed bookkeeping team opens a familiar-looking invoice email. The sender looks plausible, the attachment looks routine, and the login page looks almost right.
Three thousand client records later, the firm has learned that the cloud provider has secured the infrastructure. Your firm still had to secure the people, permissions, devices, workflows, and third-party tools sitting above it.
That is the part many accounting firms underestimate when they build global talent models. Cloud platforms make the operating model easier to scale, but they do not make the security model manage itself.
We covered this pattern in SaaSification, Cybercrime and the Enterprise Security Mismatch, where we explored how software gets easier to buy, access gets easier to distribute, and the attack surface spreads faster than governance does.
What Shared Responsibility Means in Cloud Accounting
Cloud accounting platforms such as Xero, QuickBooks Online, and Sage Intacct secure the infrastructure layer. That usually includes data centres, platform availability, encryption architecture, application controls, and internal security processes.
Your firm owns the layer where most daily risk lives: who has access, how they authenticate; what devices they use; which integrations connect to client data; how contractors are onboarded; and how quickly accounts are removed when work ends.
The phrase “shared responsibility” refers to a concept similar to a tenancy agreement, where the building owner secures the lift, roof, and front gate, but the onus is on you to make sure your team doesn't leave the office door wide open with payroll files on the front desk.
The risk is not theoretical. Verizon’s 2024 Data Breach Investigations Report found that the human element was involved in 68% of breaches, including errors, credential misuse, and social engineering. A provider’s certification does not prevent a contractor from reusing a password, clicking a phishing link, approving a suspicious login, or retaining access after the engagement ends.
If your firm is using offshore bookkeeping, distributed finance teams, or cross-border accounting support, the human perimeter stretches across time zones, devices, home networks, agencies, subcontractors, and jurisdictions. That is where the complications lie.
Where Cloud Accounting Breaches Usually Begin
Most accounting security failures do not begin with a genius hacker in a dark room whispering “I’m in” to nobody in particular. They begin with a recycled password, a shared login, an unmonitored admin account, a phishing email, or a contractor profile that should have been deactivated weeks ago.
The UK government’s 2024 Cyber Security Breaches Survey found that phishing was the most common type of breach or attack reported by businesses and charities, affecting 84% of businesses and 83% of charities that had identified breaches or attacks. The inbox is still where much of the work arrives: invoices, bank queries, payroll documents, tax requests, receipts, portal links, and client instructions.
Attackers don't have to rely solely on obvious spam. They can craft highly convincing scams through:
Invoice Fraud
Attackers intercept or spoof vendor emails, altering bank details so you pay the fraudster instead of the legitimate vendor.
Portal Phishing
Malicious emails that include urgent links to fake replicas of portals (e.g., banking or tax portals), designed to steal login credentials.
Impersonation
Emails are made to look exactly like those of internal executives, IT support, or trusted clients to request immediate wire transfers or sensitive payroll data.
Malicious Attachments
Routine documents (receipts and tax requests) containing malware that infects your network when opened.
Accounting workflows are especially attractive because they combine trust, urgency, and money movement. A fake invoice does not need to hack the platform if it can persuade the right person to log in, download, approve, forward, or pay.
That is why firms should treat cloud accounting security as part of their operating model, not as a product feature. If your firm is already thinking about process architecture and operational intelligence systems, you should know whether the system turns operating signals into better decisions before the damage spreads.
Why Global Accounting Teams Are Harder to Secure
Because every extension of the talent model creates another place where accountability can blur.
A London-based firm may use a cloud accounting platform hosted by a major provider, a Manila-based bookkeeping contractor, a South African reviewer, a UK-based client manager, a payroll integration, a document-signing tool, and a shared client portal. Everyone may be doing legitimate work. The security model still has to factor in who owns the risk at each handoff.
When people work across different devices, networks, time zones, employers, and data protection regimes, the risk becomes more difficult to pin down.
Rapid global scaling fragments your security perimeter. When business growth demands speed and lower costs, traditional security controls fail. You can no longer rely on a single secure office network. Instead, you must secure data that flows across a chaotic mix of personal devices, varying international privacy laws, and public Wi-Fi networks.
Balancing fast commercial growth with strict security requires understanding where the new vulnerabilities emerge.
Device Diversification: Employees use unmanaged personal laptops, tablets, and phones, which often lack corporate antivirus software.
Network Fragmentation: Remote workers connect via unsecured home routers, public coffee shop Wi-Fi, or unstable international connections.
Compliance Chaos: Teams must navigate conflicting regulations simultaneously, such as the UK/EU GDPR, US state laws, and local data residency rules.
Vetting Velocity: Rapidly onboarding freelancers or third-party contractors bypasses thorough background checks and security training.
Shadow IT: Distributed teams independently adopt unauthorised software tools to fix immediate local workflow blockers.
3 Ways to Secure a Borderless Workforce
To manage this complex environment, shift your defence strategy from protecting networks to protecting identities, data, and applications.
1. Adopt a Zero Trust Architecture
Verify Everything: Never trust a user or device by default, regardless of their location or previous logins.
Device Health Checks: Block access to company systems if a device lacks updates, encryption, or active antivirus.
Least Privilege Access: Grant workers access only to the specific files and tools required for their immediate roles.
2. Centralise and Secure Data Access
Virtual Desktops (VDI): Use cloud-hosted virtual desktops so sensitive data stays in a secure cloud, never downloaded onto local devices.
Enterprise Password Managers: Mandate a company-wide password manager to eliminate weak, reused passwords across global teams.
Cloud Access Security Brokers (CASB): Deploy software to monitor data movement between your users and cloud applications, preventing unauthorised downloads.
3. Standardise Global Operations
Unified Compliance Policies: Create a single baseline security standard that satisfies the strictest global regulation you operate under.
Automated Onboarding: Build standardised, automated security training and tool provisioning that triggers the moment a contract is signed.
The security controls need to scale with the model. If the firm adds global capacity without tightening access reviews, MFA enforcement, endpoint rules, incident reporting, and contract terms, it has not built a global delivery model; it's built a wider doorway.
The same access-sprawl issue shows up in broader enterprise security. As explored in our article Enterprise Identity Is the New Perimeter, identity has become the control point because work no longer sits neatly inside one office, one network, or one device estate.
The Three Failure Patterns
1. Dormant credentials
A contractor finishes a reconciliation project. The agency rotates staff. A junior bookkeeper leaves. A temporary payroll assistant moves on. Active logins from departed workers create silent, high-risk security holes. This issue occurs when organisational growth outpaces operational governance.
When offboarding tasks lack clear ownership, credentials remain valid indefinitely. Disgruntled ex-employees, or hackers who compromise their reused passwords, can then access your financial systems undetected.
That dormant account is now a standing invitation. The fix is not complicated; it's also operationally unforgiving. Every user account needs an owner, a role, a permission level, and a review date. Every contractor exit needs same-day access removal. Every agency relationship needs a named person responsible for notifying the firm when a team member changes.
2. MFA gaps
Multi-factor authentication is a control that is unevenly applied.
Microsoft’s security guidance says more than 99.9% of compromised accounts do not have MFA, leaving them exposed to password spray, phishing, and password reuse.Microsoft also states that MFA can block more than 99.2% of account compromise attacks.
The 3 most common, automated attack methods include:
Password Spraying: Attackers use automated bots to try common passwords (like Password123!) across thousands of corporate email accounts simultaneously, bypassing account lockout triggers.
Phishing Leaks: Employees accidentally type their credentials into highly convincing, fake login portals, giving attackers direct access.
Password Reuse: When an employee uses their corporate password on an unsecure external website (like a retail or hobby site) that suffers a data breach, hackers immediately test those leaked credentials against corporate systems.
That means a basic password is no longer enough to protect business accounts. Implementing Multi-Factor Authentication (MFA) is the single most effective security control you can deploy. It creates a vital secondary barrier that stops the vast majority of automated credential attacks, even if a user falls for a phishing email.
If someone can access client financial data, MFA should be mandatory. No exceptions for contractors. No exceptions for temporary users. And no exceptions for senior leaders who are too busy to protect the keys to the vault.
For accounting firms, MFA requirements should appear in service agreements with offshore providers and outsourced bookkeeping partners. Use access testing, contractual control, and recurring evidence as enforcement measures.
3. Data residency confusion – "The data is in the cloud."
Because the cloud platform has a compliant data centre, data protection obligations do not vanish for businesses that serve clients in the UK or Europe. Sub-processors, access, processing, downloads, temporary storage, breach notification, and client instructions are still important.
The European Data Protection Board's (EDPB) guidance on controllers and processors makes clear that controllers must use processors that provide sufficient guarantees around technical and organisational measures. The EDPB’s SME guidance also notes that processors assist controllers with security, breach notification, and data protection impact assessments.
The UK Information Commissioner’s Office (ICO) similarly explains that organisations must understand controller and processor roles and responsibilities under UK GDPR. Under GDPR breach rules, processors must notify controllers without undue delay after becoming aware of a personal data breach, while controllers face notification duties when a breach is likely to create risk for individuals.
Put plainly, outsourcing the work does not outsource the accountability.
Four Layers Every Global Accounting Firm Needs
A useful security model has four layers, and they all require discipline.
Layer 1: Contractual clarity
Before any provider, agency, contractor, or offshore team touches client data, the agreement should answer the questions nobody wants to negotiate after a breach.
Who is the controller?
Who is the processor?
Are sub-processors allowed?
Where can data be accessed from?
What security controls are mandatory?
What evidence must be provided?
What breach notification timeline applies?
Who tells the client?
Who tells the regulator if that becomes necessary?
Generic service terms rarely answer those questions with enough precision. A proper data processing agreement should map to the jurisdictions your clients operate in and the type of data being processed.
Layer 2: The human perimeter
The strongest technical controls still need trained behaviour around them.
That means phishing simulations, password manager adoption, MFA training, acceptable-use rules, public Wi-Fi guidance, personal-device boundaries, and a no-blame reporting channel for honest mistakes.
That last point is especially important because if your employees think that reporting a suspicious click will get them humiliated, they will hesitate. Hesitation is how a small incident earns itself a larger invoice.
Security culture in a distributed accounting team does not emerge because someone uploaded a policy to the shared drive. It develops through repeated practice, visible leadership, and fast reporting.
For a broader view of how cyber risk is becoming operational rather than purely technical, our cybersecurity strategy archive is the relevant next stop.
Layer 3: Technical controls
This is the control set every firm should expect as a baseline. It includes MFA across every account that touches client data, role-based access rather than broad admin permissions, and endpoint controls that enforce screen lock, disc encryption, and patching.
Implement restrictions on local downloads of client files and activity logs with anomaly alerts. password manager use across the full team, and secure document portals rather than email attachments wherever possible.
The important part is consistency. A firm needs controls applied to everyone, including partners, contractors, offshore staff, and temporary reviewers.
The security risk is also starting to overlap with AI-enabled deception. If your firm has clients approving payments, changing bank details, or confirming instructions remotely, then deepfake fraud risk belongs in the same conversation as cloud accounting access.
Layer 4: Continuous verification
Cloud accounting security decays when nobody checks whether the control still exists.
Run a quarterly access review. Pull active users from every cloud accounting platform, payroll tool, document portal, reporting app, and integration. Compare the list against the current team roster and remove everyone who no longer needs access. Downgrade anyone with permissions beyond their role.
Request current assurance documents from providers that hold client data and review SOC 2 Type II reports where available, with attention to scope, audit period, exceptions, complementary user entity controls, and the systems actually covered. A SOC 2 report is useful, but it is not a magic amulet.
Many firms buy well, implement decently, then stop verifying. Security doesn't collapse in one dramatic moment. It usually frays gradually.
The First 30 Days: MFA, Access Audits, and Offboarding
Start with MFA and access.
First, mandate MFA for every user across every cloud accounting tool, payroll system, document portal, and reporting platform. Then verify it. Do not rely on policy. Pull evidence.
Second, run an access audit. Export every active user list. Match users to current employees, contractors, agencies, and clients. Remove dormant accounts. Downgrade excessive permissions. Confirm that every admin account has a named owner.
Third, create a same-day offboarding rule. When a person leaves the team, access ends that day. Not when the monthly IT checklist gets reviewed and not when someone remembers. That same day.
Fourth, update provider and contractor agreements so security duties are explicit. MFA, device controls, breach reporting, sub-processor disclosure, data access locations, evidence rights, and offboarding duties.
Fifth, create a simple incident route. One email address, one Slack or Teams channel, one person accountable for triage. and one rule: report quickly, without fear.
Cloud accounting security is not just a product your provider delivers; it's a practice your firm maintains across every person who touches client data. The cloud may hold the ledger, but your operating model still holds the risk.
Disclaimer
This article is editorial and informational. The Industry Lens does not provide business, legal, financial, technical, cybersecurity, or professional advice. Before making decisions about cloud accounting security, outsourcing, data protection, breach reporting, or vendor contracts, conduct your own research and speak with qualified professionals in the relevant jurisdictions.
Frequently Asked Questions About Cloud Accounting Security
What is the shared responsibility model in cloud accounting?
The shared responsibility model means the cloud provider secures its platform infrastructure, while the accounting firm remains responsible for user access, permissions, authentication, connected apps, devices, staff behaviour, and client data handling.
Does SOC 2 mean my accounting firm is fully protected?
No. SOC 2 can provide useful assurance about a provider’s controls, but it does not secure your users, passwords, devices, workflows, or contractor offboarding. Firms still need their own access governance and monitoring.
Why is MFA so important for accounting firms?
Accounting firms handle sensitive financial data, client records, payroll details, bank information, and tax documents. MFA reduces the risk that a stolen or reused password becomes direct access to client systems.
What should firms check before using offshore bookkeeping support?
They should check contractual terms, data protection roles, access controls, MFA enforcement, device security, breach notification duties, subprocessor use, data access locations, and offboarding procedures.
What is the fastest cloud accounting security improvement?
Run an access audit. Export every active user list, remove dormant accounts, downgrade excessive permissions, and verify MFA across every user who touches client data.
Comments