Small CPA firms have so many worries and risks these days. And, as we get to be more and more linked
What’s A Cyber Security Breach?
When you have a breach of this type, it’s typically when a hacker has illegally accessed a company’s secure website. Personal information is often what’s sought. A CPA firm database with sensitive customer data is frequently the target. However, depending on the nature of the hack, all a firm’s data could be potentially in danger. For instance, if a cyber-criminal has somehow obtained login credentials that allow access to the entire company network, the damage caused could be way beyond a mere database. And, the devastation caused could be long-term, even resulting in the demise of the firm. Therefore, managing cyber-risk should be essential to all accounting firms.
When you think of cyber risk, it may suggest hackers in some far-off country working diligently to find a crack in the company’s defenses. But, it usually isn’t that way. Cyber risk doesn’t just come from outside a firm; risks can be even higher from inside. Disgruntled employees and others getting ready to exit the company can wreak havoc on their way out the door.
Reputational Consequences
No matter why it happened, a cyber breach often impacts a CPA firm's reputation. It makes a company look like it wasn’t paying attention, didn’t know enough to be able to stave off the risk. A reputation takes years to earn. Yet, it can be dashed with one incident. And, this loss of name isn’t just with the public and out in the marketplace. It’s with customers, the people and businesses that the firm serves and who pay the bills. And, since some studies show that up to one-third of customers will leave after learning of the cyber breach, the reputational consequences are extraordinarily high.
Monetary Costs
Even if the word doesn’t get out about a breach and a CPA firm’s reputation stays intact, financial costs can be severe. Cleaning up the damage from a cyber break-in can be expensive. It starts with figuring out how data was accessed and what was accessed. From there, determining if anything was taken. All this takes time and money. And, if financial resources were stolen, the loss could be real money. It’s not uncommon for financial accounts to be hacked and, either company credit used, or cash pilfered.
Intellectual Property Damage
Intellectual property, things like copyrights, patents, trade secrets and ownership rights, are vital to a firm having an advantage in the marketplace. These advantages are what help to make an accounting firm successful. They can be almost priceless to a business. Cyber theft of these items can result in the loss of a competitive marketplace advantage. And, again, it’s like real money being lost.
Legal Consequences
Once the word is out about a breach, a firm can just about count on a lawsuit, or many lawsuits. Think of it as a trickle-down effect. The data breach more than likely exposed not only company data, but customer data. And, if customer data was disclosed, the customer could end up with some of the same problems as the company. That could be a loss of intellectual property, money, reputation, etc. If that’s the case, the customer might very well look back to the CPA firm for remuneration for those items.
Regulatory Costs
While the marketplace might view a cyber breach as carelessness and incompetence, the government often looks at it as a violation of some rule or regulation. This means that a breach is subsequently followed by an audit or examination from one or more governmental bodies. And, if a violation is found, even if not done willfully, the government will add insult to injury. Massive fines and penalties can crater a firm’s profits and add to the destruction caused by the breach.
Managing Risk
As you can see, managing for risk against a cyber breach is of ultra-importance. Keeping a breach from happening in the first place is paramount. But, with all the possible post-breach threats, the hack itself might end up being one of the least of the issues. The loss of reputation, money, and marketplace advantage can be devastating. Add to that, losses from lawsuits and regulatory fines and penalties, and the cost of the breach may end up as insurmountable to a firm. But, there are ways to protect against this risk.
One way to protect against risk is to limit access to data. Only people who need access to the data should have contact with it. Another way to put employees on notice that confidentiality is critical is to include provisions against disclosure in employment contracts. One more way is to make sure that the company network and databases are protected with up-to-date technology. Redundancy measures should be in place so that multiple copies of information are stored in different locations. These measures will keep data available should one version be destroyed via a hack. All these items can protect a company against a hack or the loss of data from a breach.
Ultimately, one of the best ways to protect against cyber risk is with accountants cyber insurance. Like all coverage, cyber insurance helps to transfer the risk of loss away from the company. And, since the costs of a breach can be so high, it’s a risk that indeed must be transferred. The cost of the insurance is small when compared to the price a CPA firm will pay once all the “breach bills” are come due. Accountants cyber insurance could be the difference between the demise of a firm and the successful recovery to live and prosper for many years to come.