A small office will spend a week arguing about a $40 subscription and then share the Xero password in a group chat. The file holds every supplier, every pay run, every bank feed, and a live connection to the institution that pays wages. The original Bookkeeping Centre used to keep paper in a cabinet you could lock. The cloud cabinet is better, until the spare key is a screenshot.
This is a practical security list for an Australian office that runs Xero or MYOB, pays people, and lodges BAS. It is not a penetration test and it is not a Cyber Security Centre manual. It is the work we still find undone when a staff member leaves on a Friday and the bank rules keep firing on Monday under their name.
Identity is the control. Shared logins are the incident.
Every person who touches the file needs their own login, their own email, and multi-factor authentication that is not an SMS to a shared desk phone if you can avoid it. An authenticator app or a hardware key is better than a text message. A text message is better than nothing. Nothing is what we still see on owner logins, because “it’s my company”.
The owner’s login is the most valuable. It can change bank details, add users, export the lot, and — in many files — approve pay. Protect it the way you would protect the cheque book, if you still had one.
Never share a password. Not with the bookkeeper, not with the tax agent, not with “the girl who does Fridays”, not with a spouse who “just needs to look”. Invite them. Choose a role. When they finish, remove them. A shared password cannot be removed. It can only be hoped against.
Use a password manager. One person, one vault, unique passwords. Browser-saved passwords on a warehouse PC are a public notice. Write the manager into the office procedure so the next bookkeeper does not invent a spreadsheet called “logins.xlsx” and email it to themselves.
Adviser versus standard, and the roles in between
Cloud accounting borrowed a useful idea from practice management: the adviser is not the client. In Xero, an adviser login from a practice sits outside the client’s user list in a way a standard user does not. In MYOB, the equivalent is a named user from the practice, not a forwarded “admin@”.
Use that split:
- Adviser (bookkeeper, BAS agent, tax agent): their firm identity, MFA, access they can revoke on their side when the engagement ends.
- Owner / director: standard user with administration, MFA, not shared.
- Office manager who codes bills: standard user, invoice and bills only, no payroll admin, no user management, no bank-detail edits if you can help it.
- Site or warehouse: bills or purchase orders on their suppliers, nothing else.
- Payroll officer: payroll, not bank rec, not user admin.
- Read-only for a board or a silent partner: read-only. They can have a PDF pack instead.
Do not make everyone an adviser. Do not make everyone an admin “so it is easier”. Easier is how a casual who raises supplier bills can download the payroll report.
If you use bank feeds with payment approvals, turn approvals on for any payment that leaves the business account from inside the software. Two people is the point. One person with admin and a feed is a single point of failure that looks modern.
What a tax agent actually needs
A registered tax agent preparing a return needs a file they can trust, not a souvenir password from 2022. Invite them as an adviser, or give them a time-limited standard user if that is all the product allows, and send the pack described in books a tax agent can use:
- trial balance and general ledger
- bank reconciliations to PDF statements
- BAS lodgements and GST working papers
- payroll summaries, STP finalisation, and super evidence (12 per cent SG, and from 1 July 2026 the payday super receipts)
- asset register, loans, stock and WIP if you have them
- a note on related parties, cars, home office, grants, anything odd
They do not need the owner’s personal email password, the internet-banking app, or the password to the staff Facebook page. They do not need “super admin for everything, just in case”. If they ask for a bank token, stop and ask why a download or a read-only feed will not do.
When the engagement ends, remove them the same week. Appointing a new agent is not enough if the old invitation is still live. Ask the new agent to confirm they can see the file, and that nobody else from a former firm can.
ATO online agents, relationship authorisations and that whole family of government access sit beside the software. We will not invent the current authorisation product names; they change. Review the ATO access list when you review the software users. A former agent who can still see your activity statements is a former agent who can still see your activity statements.
Offboarding is a payday job
When a staff member leaves, treat access like final pay. Before you run the last pay — and you will run it through STP Phase 2, with unused leave on termination coded as unused leave if they were permanent — close the doors:
- Remove them from Xero / MYOB / the job system / the document tray / the password manager / the email that receives bank statements.
- Remove them from the bank’s authoriser list and from any payment-approval chain.
- Remove them from the super clearing house and the payroll admin role.
- Change any shared mailbox passwords you have not yet killed (and then kill the shared mailbox).
- Review bank rules and repeating bills they created. A rule can keep coding after a person is gone.
- Review API connections and marketplace apps they installed. An abandoned app is a login you forgot.
- Collect the phone that had the authenticator, or remove the authenticator assignment.
Do this on the last day, not “when we get around to users”. A departing payroll officer with a live login is a live payroll officer.
If someone is dismissed, revoke access before they are told, if you can do that lawfully and safely in your situation. That is an employment decision as well as a bookkeeping one; take advice if it is messy. The file’s job is not to be kind with keys.
New starters get the opposite ritual: their own email, their own MFA, the minimum role, a note in the user list of why they are there, and a diary date to review access in ninety days. Do not clone the last person’s permissions. The last person always had too many.
Banks, feeds and the quiet paths out of the company
A bank feed is a live pipe. Protect the bank with MFA, dual authorisation for new payees, and alerts on new devices. Do not store bank passwords in the accounting file’s notes. Do not photograph a token “for the bookkeeper”.
Payment files from payroll are a favourite target because they look boring. Restrict who can change employee bank details. Preview the STP event and the payment file with two sets of eyes when the run is large or when a new employee appears. STP Phase 2 mistakes are not only tax mistakes; a changed BSB is a security event.
Merchant portals, head-contractor portals, and the ATO small-business clearing house all have their own users. Put them on the same offboarding list. A contractor portal that still has a former estimator will show them more than estimates.
Email is part of the file. Bank statements, pre-fill, BAS receipts and employee tax file declarations arrive there. MFA on email. No forwarding rules to a personal Gmail that nobody remembers. A forwarding rule is how a file leaks after you thought you had locked it.
Devices, paper and the five-year habit
Cloud software does not remove the laptop. Full-disk encryption, screen locks, and a rule that a warehouse iPad used for bills is not also used for children’s games. Lost-device procedures: who you call, which logins you kill first (email, then bank, then accounting).
Phone photos of tax invoices are fine if they land in a tray the business owns, not in a staff member’s camera roll. When they leave, those photos leave with them unless you already filed them. The working habit is still five years from lodgement, longer for assets and losses — see source documents. Security and record-keeping are the same problem: can someone who is allowed to, and no one who is not, produce the invoice?
Paper still exists. Payslips, contracts, identity documents. A lockable cabinet, and a shredder for the copies you should not have made. Do not pin TFN declarations to a noticeboard behind the coffee machine. We have seen that sentence in more than one office that also had MFA on Xero and felt modern.
A twice-yearly user review that fits in half an hour
Diary June and December, or attach it to the month-end in those months:
- list every user in the accounting file, the bank, the ATO relationship, the clearing house, the document tray, the password manager
- confirm each name still has a job that needs that access
- confirm MFA is on
- confirm advisers are current firms, not last year’s
- confirm marketplace apps are still wanted
- confirm the lock date is in force, so a compromised low-level user cannot rewrite a lodged quarter
- write a one-line note: reviewed, nothing found / removed X / asked owner about Y
Keep the note with the pack you would show a tax agent. It is a control. It is also how you sleep.
The Rosebery desk used to walk a visitor past the cabinet and the backup book. The cloud file still needs a walk: who has a key, who should, and whether the last person who left still has one. Software vendors will sell you features. They will not offboard your Friday casual. That remains an office habit, which is to say it remains bookkeeping.
.jpg){kind=link}