Zhongtian Li, Senior Lecturer, Business School, University of Newcastle, Christina Boedker, Professor, Business School, University of Newcastle, Jing Jia, Senior Lecturer, Business School, University of Newcastle, Karen Handley, Senior Lecturer, Business
Once considered to be simply “bean counters”, accountants now play an important role in the defence, investigation and protection against cybercrime.
Modern cybercrime includes stealing personal information, hacking into systems, spreading viruses and tricking people into giving away money or data via their business email addresses.
In Australia, the average cost of a single cybercrime report in 2022 was A$39,000 for small businesses, $88,000 for medium businesses and $62,000 for large businesses.
In New Zealand, direct financial losses from cybercrime reached NZ$6.6 million in the first quarter of 2024.
Although there is general guidance on cybersecurity, there is limited information about the specific role accountants can play in its detection and prevention.
Traditionally focused on financial elements of a business, accountants are often now the frontline of responding to cybercrime.
Our research examined the role of accountants in cybersecurity and how professionals in these roles can protect businesses from online threats.
From safekeepers to data gardeners
As the keepers to sensitive data, including tax records, payroll information and business transactions, accountants can play an essential role in reducing the impacts of cybercrime.
We conducted 21 interviews with management accountants, cybersecurity experts, legal professionals and senior executives in Australia and New Zealand.
Our findings highlight the following roles accountants can take.
Safekeepers
We found accountants are on the frontline of protecting their organisations from various forms of cybercrime, such as business email compromises.
Many interviewed accountants described how they carefully reviewed email content and attachments, verified the legitimacy of senders, and checked domain names to prevent fraud. They also reported confirming details with email contacts before taking action.
Beyond emails, accountants controlled access to sensitive systems and data. For example, interviewees said their jobs involved ensuring only authorised employees had access to financial records or payroll systems.
By integrating cybersecurity practices into their daily work, accountants helped reduce the risk of cybercrime.
Architects
Accountants didn’t just protect data – they helped strengthen cybersecurity through strategic decisions.
According to our interviewees, accountants often worked with their organisation’s IT team to decide on cybersecurity investments. Using their financial expertise, accountants conducted cost-benefit analyses to ensure limited budgets are spent wisely.
Additionally, they played a crucial role in strengthening cybersecurity by making strategic decisions in areas such as risk identification, risk management strategies, risk coverage and premiums for cyber insurance.
Cyber insurance helps cover costs such as fixing systems, notifying customers about the breach and even dealing with legal claims.
As one research participant explained, accountants can assist the business leadership in answering crucial questions posed by insurers. These can include queries such as:
What risk you are trying to mitigate? And what sort of risk management you have for cyber security. What kind of risk management in cybersecurity have you got? Have you got proper encryption and do you know whether it is hardware or software encryption?
Data gardeners.
Accountants play a key role in helping organisations develop data policies. These policies establish rules and guidelines for managing data, such as how long to retain information, how to protect it and when to delete it.
Why is this important? Retaining unnecessary data increases the risk of a data breach.
Accountants leverage their financial expertise to demonstrate how reducing stored data can minimise risks while still retaining valuable information. For example, they might recommend deleting outdated payroll records or customer data that no longer serve a business purpose.
Importantly, data policies also help organisations comply with privacy and data security regulations, which are becoming increasingly strict across Australia and New Zealand.
Staying vigilent
As cybercrime evolves, accountants must stay up to date. Interviewees recommended several ways to do this, including participating in training courses, forums and seminars.
Courses on cybersecurity, programming and emerging technologies like artificial intelligence (AI) were highlighted as particularly valuable. These courses help accountants better understand how to manage systems, protect data and respond to new forms of cybercrime.
In-house training tailored to accounting and finance teams is also crucial. Simulated cyberattacks – like phishing emails or fake invoice fraud – help accountants recognise and respond to threats in real-world scenarios.
To remain effective in this changing landscape, accountants need to keep learning. By building their technical knowledge and participating in tailored training, they can continue to protect their organisations from the ever-evolving world of cyber threats.
Zhongtian Li receives funding from Chartered Institute of Management Accountants.
Christina Boedker receives funding from Chartered Institute of Management Accountants.
Jing Jia receives funding from Chartered Institute of Management Accountants.
Karen Handley receives funding from Chartered Institute of Management Accountants.
Nirmala Nath does not work for, consult, own shares in or receive funding from any company or organisation that would benefit from this article, and has disclosed no relevant affiliations beyond their academic appointment.
