The recent high-profile government security lapses have made us all aware of the potential for terrible publicity when things go wrong with personal data records. HMRC can survive the PR disaster which accompanies the loss of disks containing details of 25 million benefits claimants simply because they are in a monopoly position but, be assured, if we taxpayers could have taken our business elsewhere, many of us would have. Had the Revenue been a commercial company, the negative effect of the horror stories in the media would very likely have put them out of business.
Now, I personally think that the issue was blown out of all proportion. Yes, the disks could have fallen into the hands of a shady underworld, ready and waiting to pillage our bank accounts but it is statistically more likely that they are in a landfill site - or under the seat in post office van somewhere. Of course, it is the fear of what could happen that drives the tabloid hysteria and puts worries in the minds of the public at large. So, if you are running your own accountancy practice, how well do you sleep at night, knowing what data is kept on the server in your office?
That's right, accountants are probably holding more personal financial information in their computer systems than any other group outside of the civil service. Names, home addresses, national insurance numbers, tax references, dates of birth, details of dependents, bank account numbers, details of individual bank transactions, VAT registration numbers, company registration numbers, dates of residence at various addresses, dates of starting and leaving various employments, pension details, life assurance details.... the list is almost endless.
By now most well-run accountancy practices will have robust procedures in place for backing up client data, which probably even includes someone taking the tapes off site (if they remember or aren't on holiday). However, this is a focus purely on security from the disaster recovery point of view - if the office goes up in smoke at least we can restore the data that Anita took home with her (although we may never have actually tested that). When you think about the security of the data itself then what could be worse than an employee taking the disk home and either leaving it the car or chucking it in the fruit bowl in the kitchen. How safe is that?
Even if your off-site backup copy is looked after properly, what is to stop someone breaking into your office, unplugging the server, putting it under their arm and walking out? Being able to restore your data makes your insurance company happy but losing the data will make your clients extremely unhappy - and angry and litigious.
The first accountancy firm that has to publicly own up to a data loss in the way that HMRC did is going to go out of business - at "Andersens" speed. In my firm we have just moved every scrap of our data, client and internal, to a secure datacentre. All staff members have a laptop to access the applications and data they need via the Internet from the datacentre. No data or applications (other than Internet Explorer) are allowed on the individual's laptops and we are changing our contracts of employment to make the retention of any data on a laptop a dismissible offence. It's time to get serious, really serious about what's on that little black box in the back room of your office.
Recent Comments