accounting cybersecurity

The Real Risk Equation: How Accounting Firm Owners Can Move From Cybersecurity Fear to Action – Luke Kiely

accounting cybersecurity

GrowCon conversations often focus on offense: winning clients, growing revenue, and building a stronger firm. Luke Kiely, CEO of Complywise and a former cybercrime investigator, came to talk about defense.

In his presentation, “The Real Risk Equation: Protecting Your Firm in the Age of AI, Cyber Threats & Regulation,” Kiely argued that the greatest danger for many accounting firms is not a sophisticated attacker. It is the paralysis that follows when security feels too expensive, too technical, or too big to tackle.

His message to firm owners was direct: You do not need a perfect security system to make meaningful progress. You need someone to take ownership and a working program that addresses the risks your firm actually faces.

Why firms freeze

The familiar risk equation is threat × vulnerability × impact. But Kiely asked the audience to consider another variable: inaction. Twenty years ago, protecting client records could seem as simple as locking a filing cabinet. Today, client information moves through email, cloud software, employee devices, payroll systems, and, increasingly, AI tools. Each new way to work creates another place where the firm must make a decision about access and protection.

Kiely described four pressures that can keep owners stuck:

  1. Attackers look for easy openings. Phishing messages, reused passwords, and accounts without multifactor authentication (MFA) can give criminals an opening without an elaborate technical attack. He recounted a small hotel that paid a ransom, restored compromised files, and found itself facing the attackers again. His lesson: recovery only works when you understand what you are restoring.
  2. Security vendors can make the problem feel bigger. An expensive package may sound reassuring, but the right investment starts with identifying your own systems, information, and weak points.
  3. Compliance requires ongoing work. A written plan matters, but a document alone cannot train employees, control access, test safeguards, or guide a response to an incident.
  4. The firm has competing priorities. Client deadlines and revenue work demand attention every day. Security tasks are easy to postpone until “next quarter” unless a leader is responsible for them.

A plan is a starting point. A program is what your firm does.

This distinction was central to Kiely’s talk. The IRS’s Publication 4557 guides tax professionals on safeguarding taxpayer data and creating a written information security plan. The FTC Safeguards Rule calls for a written information security program appropriate to a covered firm’s size, activities, and the sensitivity of the information it handles. It includes measures such as risk assessments, access controls, MFA, staff training, testing, and an incident response plan.

For an owner, the useful question is not simply, “Do we have a document?” It is, “Can we show how the protections in that document work in our business?”

That is also why ownership matters. The FTC rule calls for a Qualified Individual to oversee the program. That person can be an employee or a qualified outside provider, but the firm still has responsibility for oversight. An IT vendor can help implement controls; the firm’s leadership must know who is accountable for the program and how its effectiveness is reviewed.

AI makes the boundary around client data more important

Kiely warned that competitive pressure is pushing firms to adopt AI faster than they are setting rules for its use. AI can be useful in an accounting practice, but entering client information into a tool may transmit that information to an outside service. What happens to it depends on the tool, its settings, and its terms.

Before staff use an AI product for client work, firm owners should decide which information may be entered, who can approve tools, and how each provider handles and retains data. Treat AI adoption as part of the same security program that governs your other software and service providers.

Build protection around the firm you actually run

Kiely compared a firm to a living organism. Its circulatory system is the movement of data, billing, and payroll. Its nervous system is the judgment and habits of its people. Its immune system is its policies, safeguards, and incident response. Its membrane is the boundary between client information and the outside world.

The metaphor offers a practical way to start: map where sensitive information moves, identify who can reach it, and find the weak points where it crosses that boundary. Then prioritize the basics. Turn on MFA for accounts that access client information. Limit access to people who need it. Train employees to recognize suspicious requests. Keep recoverable backups and test your response plan. Review providers and AI tools before client data flows through them.

Kiely’s point was not that every small firm needs the same budget or technology as a large enterprise. Protection should fit the firm’s size and risks, while meeting the requirements that apply to it.

Three questions to ask this week

  1. Who is responsible for our information security program, and when did we last review it? Look for evidence of current practices, not just the date on a written plan.
  2. Is MFA enabled wherever people access client information? If there are exceptions, identify them and address them with the person overseeing your program.
  3. What does our cyber insurance policy actually cover and require? Read its conditions and exclusions with your broker or insurer. Do not assume a policy will cover every incident or that any particular lapse automatically voids coverage.

Kiely ended with a challenge: your firm’s safeguards will be tested sooner or later. You have more control when your team tests them first. Name an owner, choose a starting point, and take the next concrete step before a client, an attacker, or an incident forces the issue.

All of us at Universal Accounting Center would like to express our gratitude to Luke for sharing his perspective with us at GrowCon 2026. If you would like to watch Luke’s presentation in full, alongside the other 13 industry leaders who presented in Salt Lake City, you can order recordings of all of the presentations online.

You won’t want to miss what we’ve got planned for you next May in Scottsdale, Arizona at GrowCon 2027! Reserve your seat today, and you can take advantage of our early bird discount with code EB300.

virtual bookkeeping (1)

What Is Virtual Bookkeeping and How Does It Work?

The term virtual bookkeeping gets thrown around a lot, but plenty of business owners and aspiring bookkeepers still are not entirely sure what it actually means in practice. Is it just regular bookkeeping done from home? Does it work the same way as an in office arrangement? In this post, we will define virtual bookkeeping clearly, explain how it functions day to day, and cover who tends to benefit most from working this way.

Defining Virtual Bookkeeping in Simple Terms

At its core, virtual bookkeeping is the same financial work a traditional bookkeeper performs, just conducted entirely through cloud based software instead of in a shared physical office. Recording transactions, reconciling accounts, and generating financial reports all happen the same way technically, the difference is purely in where and how the work gets done.

This distinction matters because the underlying skill set has not changed at all. A virtual bookkeeper still needs the same understanding of accounts payable, receivable, and financial statement preparation that any bookkeeper needs. What changes is the delivery method and the tools used to communicate and share information with clients.

Some people assume virtual bookkeeping is a lesser or watered-down version of the traditional role, but that assumption misses the point entirely. The financial skill required is identical; only the working arrangement has shifted to match how modern small businesses actually operate.

How the Day-to-Day Process Actually Works

A typical virtual bookkeeping setup starts with connecting to a business’s bank feeds and accounting software through secure, permissioned access. From there, the bookkeeper logs in remotely to categorize transactions, reconcile statements, and prepare reports on an agreed schedule, whether that is weekly or monthly.

Communication happens through email, phone calls, video meetings, or a shared client portal rather than face to face conversations. This does not make the relationship less personal; it simply moves the same conversations to different channels that fit a remote working arrangement.

What Makes Virtual Bookkeeping Different From Traditional Bookkeeping

The biggest practical difference is flexibility. A virtual bookkeeper is not tied to a single business’s physical location, which means they can serve multiple clients across different cities or even states, and clients are not limited to hiring someone local. This opens up a much wider pool of options for business owners and a much larger potential client base for bookkeepers.

Cost structure also tends to differ. Since virtual arrangements do not require office space or a full-time salary commitment, business owners often pay based on the actual scope of work needed rather than a fixed employee cost, which can make virtual bookkeeping more affordable for smaller operations.

Who Virtual Bookkeeping Works Best For

Small businesses without enough transaction volume to justify a full-time hire tend to benefit the most, since virtual bookkeeping lets them get consistent, accurate books without the overhead of an employee. Freelancers and solo entrepreneurs also gravitate toward this model, both as clients seeking help and as bookkeepers looking for flexible, location-independent work.

For anyone considering this as a career path, learning how to become a bookkeeper with solid technical training first gives you the foundation needed before adapting those skills to a remote, client-facing environment.

Building the Skills to Work Virtually

Working virtually requires more than technical bookkeeping knowledge. Comfort with cloud software, clear written communication, and the ability to manage multiple client relationships without in person contact all matter just as much as understanding debits and credits correctly.

become a bookkeeper (3)
become a bookkeeper

Universal Accounting School structures its training around this exact combination, since students pursuing bookkeeping certification online often go on to build careers working entirely with remote clients rather than in a traditional office setting.

Virtual bookkeeping is not a different profession from traditional bookkeeping; it is the same profession adapted to modern tools and modern client expectations. Whether you are considering hiring a virtual bookkeeper or becoming one, understanding what the term actually means makes it much easier to know what to expect.

Frequently Asked Questions

1. Is virtual bookkeeping the same as online accounting software?

No, virtual bookkeeping refers to a person doing the bookkeeping work remotely. Online accounting software is simply the tool that makes remote work possible.

2. Can a virtual bookkeeper handle payroll and taxes too?

Some do, depending on their training and the services they offer, so it is worth confirming exactly what is included before starting a virtual bookkeeping relationship.

3. Is virtual bookkeeping less secure than traditional bookkeeping?

No, reputable virtual bookkeepers use encrypted software and secure, read only access, which often provides better security than paper based traditional record-keeping methods.

4. How much does virtual bookkeeping typically cost?

Pricing depends on transaction volume and business complexity, but many small businesses find virtual bookkeeping more affordable than hiring a full time in house employee.

5. Do I need special training to start working as a virtual bookkeeper?

Yes, solid bookkeeping training is essential, along with comfort using cloud software and communicating clearly with clients you may never meet in person.