For most partners, the biggest hesitation about outsourcing isn’t quality or cost – it’s client data. You are trusted with tax file numbers, bank statements and financial records, and that trust doesn’t change when some of the work is done offshore.
The good news is that data security can be checked. Here is what to look for.
Your obligations stay with you
When you use an outsourced team, your professional and legal obligations remain. The Tax Practitioners Board Code of Professional Conduct requires registered agents not to disclose information about a client’s affairs to a third party without permission, unless there is a legal duty to do so. Under Australian Privacy Principle 8, you must take reasonable steps to ensure an overseas recipient handles personal information in line with the Australian Privacy Principles – and you can remain accountable if it doesn’t.
That is why choosing a provider with strong, verifiable controls matters. (This article is general information, not legal advice.)
8 questions to ask any outsourcing provider
1. Are you independently certified?
ISO 27001 is the international standard for information security management. Certification means an external auditor has checked the provider’s security controls and processes, rather than relying on the provider’s own description.
2. How is physical access to your office controlled?
Look for key card access, CCTV and restrictions on who can enter the work floor.
3. Can staff copy or move data?
USB ports and other data-transfer devices should be disabled, personal email blocked and personal mobile devices kept off the work floor.
4. How are internet and system access controlled?
Ask about firewalls, encryption, restricted internet access and multi-factor authentication on every system that touches client data.
5. Who can see our clients’ information?
Access should be on a need-to-know basis – the people working on your jobs, not the whole office.
6. Do your staff sign confidentiality agreements?
Every team member should be bound by a written confidentiality agreement, and the provider should be willing to sign your firm’s own agreement too.
7. What happens when the engagement ends?
You should be able to remove all access immediately, and the provider should be clear about how any data is returned or deleted.
8. How would you tell us about a security incident?
Under the Notifiable Data Breaches scheme, your firm may need to notify affected individuals and the Office of the Australian Information Commissioner about an eligible data breach. Your provider should commit to telling you promptly so you can meet that obligation.
Steps to take inside your own firm
- Update your engagement letters to cover offshore processing.
- Check your privacy policy explains whether personal information may be disclosed overseas and to which countries.
- Give your outsourced team separate logins with multi-factor authentication, never shared staff credentials.
- Review who has access every quarter and remove anything that is no longer needed.
How OrangeIQ protects your data
OrangeIQ is ISO 27001:2013 and ISO 9001:2015 certified. Our 10-step security checklist includes key card access, 24×7 CCTV, disabled USB and data-transfer devices, blocked personal email, restricted internet and social media, a ban on staff mobile devices, multi-layer authentication, strong firewalls with 256-bit SSL encryption and server access on a need-to-know basis.
If your partners or IT team have questions about how we handle client data, get in touch – we’re happy to walk you through our controls.
