The technology problems that actually bite small accountancy practices

It is the third week of January. The tax software will not open, or the internet is down, or the server is making a noise it has not made before. You have a hundred and forty returns still to file.

Most businesses that lose a week lose a week’s turnover and catch up. Your work is not evenly spread — it is stacked against fixed statutory dates that HMRC will not move because your IT broke. A missed Self Assessment deadline is an automatic £100 penalty per client whether or not any tax is owed, then £10 a day after three months up to £900. Multiply that by the clients affected and you are looking at a bill you cannot invoice for, an awkward conversation with every one of them, and a professional indemnity question. The other thing nobody plans for: your quiet season is when you should be doing the upgrades, and the quiet season is getting shorter.

Client due diligence for every client and every beneficial owner: passport, driving licence, a utility bill, sometimes a bank statement. Mostly sitting as email attachments and a folder on the server called Clients.

The Money Laundering Regulations require you to keep those records for five years after the business relationship ends, so the pile only grows. Nobody in the practice thinks of it as a database — but that is precisely what it is, and it is identity-theft-grade: everything a criminal needs to open credit in your clients’ names, already collected, verified and conveniently filed. Two obligations then pull in opposite directions. AML says keep it for five years. UK GDPR says do not keep personal data longer than you need it and keep it secure. Satisfying both requires an actual retention schedule that runs, and most small practices have neither the schedule nor a way to run it.

The agent services account. The old Government Gateway credentials. Companies House. The payroll software. Bank feeds for forty clients.

This is the asymmetry that makes accountants worth attacking. A criminal who gets into one of your clients gets one business. A criminal who gets into your agent account gets the tax affairs of every client on your list, plus the standing to act on their behalf. HMRC itself is the most impersonated brand in the country by some distance — it received more than 135,500 reports of HMRC-related scams in ten months, 29,000 of them about fake tax refunds, and shut down close to 25,000 fake websites and phone numbers in the same period. And the point of all that phishing is repayment fraud: HMRC told MPs that criminals used credentials harvested elsewhere to hit around 100,000 PAYE accounts and claim roughly £47m before it was stopped.

An email arrives from a client, on the right thread, in the right tone, saying their supplier has changed bank details. Or one from an employee, just before payroll cut-off, asking you to update where their salary goes.

You are the trusted party who tells people where money should go, which makes your mailbox unusually valuable. An attacker reading it quietly for a fortnight learns your clients, your timings, your phrasing and your payment runs — and then only needs one convincing email. Impersonation was reported by 12% of UK businesses last year and phishing by 38%, the most common attack by a distance. Payroll is the softer target of the two, because a changed bank detail looks like admin rather than a payment, and the person who would notice does not find out until payday.

Making Tax Digital. Companies House identity checks. A client’s procurement questionnaire asking whether you hold Cyber Essentials. None of these are things a practice manager can absorb with a policy document any more.

These have quietly turned from paperwork into technical assertions somebody has to be able to evidence, and several of them are already in force rather than coming soon:

• Making Tax Digital for Income Tax became mandatory on 6 April 2026 for qualifying income above £50,000, drops to £30,000 on 6 April 2027 and £20,000 on 6 April 2028 — quarterly updates through compatible software, not an annual return.
• Since 18 November 2025, Companies House identity verification is a legal requirement, and if you verify identities for clients you need to be registered as an Authorised Corporate Service Provider.
• From 26 April 2026, Cyber Essentials v3.3 makes missing MFA on cloud services an automatic fail — as is failing to apply critical and high-risk updates within 14 days.

A machine in the corner runs the tax and practice software, holds the shared drives, and has been there longer than at least one member of staff.

It is the single point of failure for the entire practice, it sits in the same building as any fire, flood or burglary, and if the operating system has gone out of support it will fail Cyber Essentials on its own account. It is also exactly where ransomware wants to land, because every workstation has a drive mapped to it. And the week it dies will not be a week you chose. One more trap worth naming: Microsoft does not back up your Microsoft 365 either. Microsoft keeps the service running; keeping your data is your side of the bargain.

Someone has a set of management accounts to summarise and a client meeting in forty minutes. There is a free tool one click away that will do it in thirty seconds.

There is nothing wrong with using AI, and plenty of good reasons to. But the moment client-identifiable financial data goes into a consumer service you have engaged a third-party processor with no data processing agreement, no view of retention, and no idea whether the text is used for training. Your professional duty of confidentiality does not pause for convenience. The realistic risk here is not a dramatic leak — it is that when a client or your PII insurer asks whether client data has been put into AI tools, nobody in the practice can answer.

Four people, one shared login for the software everybody needs, and the bookkeeper knows the partner’s password because otherwise nothing gets done on a Friday.

You lose attribution. When something goes wrong — a return filed wrong, a payment authorised, a client record changed — you cannot say who did it, and in a practice that handles other people’s money and other people’s filings that is exactly the answer you most need to have. Shared accounts also cannot be meaningfully protected with MFA, and they are never removed when someone leaves. Cyber Essentials fails you on this, and it is right to.

Some of the bookkeeping goes out to a third party, possibly overseas. Payroll runs through a bureau. There is an accounting platform, a tax package, a company secretarial tool, a receipt-capture app and a document portal, each with its own login.

Client data is now spread across suppliers and services you do not control, and every one of them is a way in. An attacker does not need to breach your practice if they can breach the smaller outfit that emails you spreadsheets every week. The count is the problem as much as the security of any one of them: nobody has a list, so nobody can say where client data actually lives, who at a supplier can see it, or what happens to it when you stop using a product. That is also the question a decent procurement questionnaire now asks, and the one a data protection complaint would start with.