Accounting firms in New Zealand sit on a uniquely sensitive data set: tax returns, IRD interactions, AML/CFT verification records, financial statements, trust account positions. The Privacy Act 2020, the AML/CFT Act 2009, and Chartered Accountants Australia New Zealand professional standards all expect verifiable controls, not best efforts.
Most managed IT providers can install Microsoft 365 and call it a day. We configure it for the way accounting practices work: client matters partitioned, IRD myIR access locked down with MFA and session monitoring, document retention aligned to the seven-year statutory minimum, and audit trails that survive a CA ANZ practice review or a DIA AML/CFT inspection.
The rules Australian accounting firms work under
Privacy Act 2020. Sets the baseline for how personal information is collected, stored, used, and disclosed. The Office of the Privacy Commissioner expects breach notification within 72 hours of confirming a notifiable privacy breach. For accounting firms, almost everything you handle is in scope.
AML/CFT Act 2009. Has applied to chartered accountants since 2018 for client services covering trust accounts, real estate transactions, and certain tax structuring. Requires identity verification, transaction monitoring, suspicious activity reporting, and an annual report to the DIA. Your IT setup needs to support customer due diligence (CDD) record retention for the five-year statutory minimum, with evidence the DIA can inspect.
CA ANZ professional standards. Govern client confidentiality, record retention (typically seven years for working papers), and the quality framework expected of every chartered accounting practice. CA ANZ practice review covers IT controls, file security, and continuity of access.
In practice, your controls have to be provable, not promised.
