Accounting Tech Archives - Page 3 of 215

Accountants Need to Manage Apps for Clients, Says Intuit

June 1, 2018 by Sholto Macpherson 5 Comments

An unstoppable trend is pushing accountants into the job of setting up and managing apps that connect to cloud accounting software. Rich Preece, VP and leader of Intuit’s accountant segment, made the call at Australia’s QuickBooks Connect, which swept into Sydney last week.

Here’s the rationale: To automate the legwork in accounting, accountants need businesses to use apps to collect and categorise their data more efficiently. The most obvious category is expense management (think Receipt Bank, Concur, Expensify, etc.) but also for time sheets, rostering and so on.

Businesses will baulk at setting up and paying for these apps if they have to do it themselves. They are more likely to give it a go if the accountant does it all for them, for an increased monthly fee.

The implications are enormous. Few traditional firms would want to look at any software that wasn’t accounting. Even cloud-minded firms limit the number of apps they deal with out of necessity; the ecosystems for Xero and Intuit contain several hundred programs.

It will likely mean firms will need to hire an in-house app expert to do set up and train staff in how to manage the apps. The longer term upside is that jobs should be more profitable, as these ecosystem apps will contain source data that accountants usually waste many hours a year chasing. It also opens the door to advisory services such as business process automation and workflow management.

Intuit is adding more tools to its practice software that will help accountants recommend apps. Accountants can also use QuickBooks Online Accountant to provide unified billing for QuickBooks and ecosystem apps. Accountants who sign up clients through QBOA get a sizeable discount on the sticker price for those apps which they can choose to pass onto the client.

Other interesting tidbits: Intuit’s direct-to-consumer model works in Australia and other countries just as well as in the US, where it built an 80%+ market share; Intuit will more than likely make business and personal loans to self-employed as well as businesses through QuickBooks Capital; and the business case for accountants to take on QuickBooks Online Self Employed clients is, well, still a little shaky, despite a swelling market.

Digital First: Why do you want to incentivise accountants to do the billing for the clients’ apps in the ecosystem, as opposed to the client paying for the apps separately?

Rich Preece: Well actually, it’s not so much us as the accountant. The accountant is saying to us:

“I’ve got a relationship with a business owner and I charge him $300 a month (for) QuickBooks and I do his taxes and a number of other things. The problem is, I need him to use Practice Ignition and Expensify. And so now I’ve got to say to my client, ‘Hey, I’m still going to charge you $300 a month but I need you to go buy these two things, and I need you to be the master admin and I need you to provision it, and I’d love to help but I actually can’t do any of that.’”

It just doesn’t work that way. And then the accountant says, what I’d rather do is say, “Look Mr Business Owner, for $400 a month I can actually help you with your expenses and I’m going to plug in a product called Expensify and Practice Ignition which I think you should have. So we’re just going to move to $400 and you don’t have to do anything, by the way. I’m going to set it up and manage the whole thing.”

That’s literally the talk track that accountants have said to us for 18 months and so that’s what we built. And frankly the fact that you get a discount. There’s a reason I don’t start with the discount, it is really the cherry on the cake.

We said to the apps, “Look If we’re going to build this and you want to participate, you’ve got to give the accounting professional a better price than you would give the small business.”

Digital First: So, then logically you feel like tech skills of some sort will become essential for accountants? If you’re setting up Practice Ignition or if you’re setting up Expensify, and so on.

Rich Preece: Well, you know I think so. This is the reality of the cloud adviser versus the accountants and bookkeepers. Imagine you and I are both accountants and you provide a service where there’s two or three apps that I need and you’ll take care of it for the small business. And I provide a service where I don’t take care of (the apps). If I’m that small business, I’m probably going to work with you versus me. I just think that’s a reality.

The last thing we want is to have an accounting professional feel like now they have to be a technical expert and write lines of code. That’s not where any of this is going. But if we can make it easy we will need to put the control in the hands of accounting professionals. And if an accountant says, “That’s not for me,” I feel like over time they’ll probably become less effective in their own industry.

Digital First: I hear Intuit is putting a lot of money into TV advertising, and people are wondering how effective that is. Intuit has a dominant share in the US built on direct sales to SMBs. But in Australia the accounting software companies have sold through accountants. Does the direct model work in Australia, UK, France, Brazil?

Rich Preece: It does. I’ll start by saying yes we’ve increased money on spend and it’s in two areas. One is the “Backing you” campaign which has been really successful for us in the US. It’s because A, it truly is the message we want to send and then B, because it’s been well received. We wouldn’t spend more unless ultimately there’s a business model there. We’ve been increasing our investment, but it’s with a good return.

The second area where we’ve been increasing our investment in terms of marketing is on the Intuit brand itself. There are benefits to having the Intuit brand and one of those is attracting talent. So in the US you’re quite right when you say most of our customers historically – and still – come direct. If we’re friends and I’m opening up a small business, I say to you, “What do you use?” And chances are you use QuickBooks, so before I ever get to my accountant or bookkeeper I’m already going to the website and probably buying.

Outside the US it’s far more balanced; it’s roughly the same in terms of accountants and bookkeepers and direct. The competitors that you mentioned have always been more so on the accountants and the bookkeepers, and I do think it’s because it’s a channel. I think the definition of a channel is, the more somebody buys, the less they pay. Whereas if you look at us it’s like a wholesale billing with a discount.

Digital First: So, the short answer is selling accounting software direct works globally, full stop.

Rich Preece: It does. And then at the same time obviously I would say accountants and bookkeepers are critically important.

Digital First: Why is Intuit making such a big deal about QuickBooks Online Self Employed, given that it must have the lowest ARPU (average revenue per user) of all your products? Where’s the payoff for Intuit, and where’s the payoff for accountants and bookkeepers?

Rich Preece: The first answer is yes, it is a lower ARPU, typically it is $7 to $10 a month. At the moment it doesn’t have an app ecosystem. The reason why we’re so excited is if you look at that gig economy, it’s huge and exploding. And so we believe that we have to build solutions for those people. Now it is obviously a thin slice of the functionality that QBO has. SE allows you to understand what is a personal expense and what is a business expense.

The monetization strategy is that some of those folks will continue to grow (to the point) where they do need a different version of QuickBooks. Like an Uber driver that ends up with two or three cars. They actually grow into a small business from someone that’s self employed. So that’s one strategy.

As you might imagine, we’ll look to set up APIs into Self-Employed. That’s absolutely something that will be worked on. We’ll look to take pieces of QBO and add it on, so maybe you’re a self employed person that just needs inventory. And then separately for monetization model it’s sort of like building those pieces around a bit more bespoke.

Digital First: But what about things like QuickBooks Capital and lending to self-employed?

Rich Preece: While it’s not going to happen short term, we would absolutely open that up to Self-Employed customers as well.

Digital First: For business loans or personal loans or both?

Rich Preece: Well at the moment we would think about it for business because that’s where we specialise and we have no intention right now for personal loans. But QuickBooks Capital continues to be very, very successful and we are very excited and bullish about it.

Digital First: Can you give me stats on that?

Rich Preece: What we learnt very quickly was 70 percent of the people that we were approving had already been declined somewhere else. So that was very good. Then banks like Bank of America were offering lower rates based on QuickBooks data than they were to their own customers. In the last 18 months we started to put our own balance sheet on the platform and we tried to lend it to people that were not going to get approved by anybody else. Again, based on QuickBooks data; we’re not just throwing money at people. There’s an algorithm that sits beneath this.

And what you’re looking for is default rates to train the algorithm. And one of the biggest challenges that we’ve had is those low default rates. We keep loosening a little bit to who we lend to based on what we’re looking at. It’s been very successful in getting many, many millions of dollars into the hands of small businesses on a very regular basis.

Digital First: What is the default rate?

Rich Preece: Well I doubt we’ve announced the default rate. One of the biggest things the team is always talking about is, you need people to default to help the algorithm get smarter on who not to lend to. And that’s been one of the biggest problems. It’s a very low default. It’s a wonderful problem to have, in a strange way.

Digital First: Lend to me, I’ll default for you.

Rich Preece: The second question was the importance of QuickBooks Online Self-Employed (QBO SE) to accountants. That’s a really good question. When we first conceived and launched Self-Employed, the reason why we didn’t integrate with the QuickBooks Online Accountant (QBOA) was because we hypothesised that accountants wouldn’t be hugely interested in QBO SE clients, and that these clients wouldn’t be hugely interested in accountants and bookkeepers. One of the surprises we had was Self-Employed folks were asking us to connect them to accountants and bookkeepers on the matchmaking platform at the same rate as small businesses. So then we knew that on the one side of the equation, they actually did need an accountant and bookkeeper, but obviously they didn’t often have the ability to pay quite as much. And on the other side, accountants often said I’m not sure I want this client because they can’t pay quite as much.

So first of all we decided to start integrating (QBO SE into QBOA) for those who wanted to work together. Then we started to see accountants in the US carve off one or two employees and have them manage Self-Employed clients under a different business model. A number of firms in the US spend a limited amount of money advertising to self-employed, whether it’s Uber drivers, folks who sell things on Etsy, whoever it might be. They attract people to a free webinar, literally 100 people a month, and the accountant says, “For 30, 40, 50 dollars a month I will be your accountant or bookkeeper, I will provide you with a copy of QBOSE, and every month there is a webinar which you will attend in a group and I will share the most important things in terms of tax deductions for Self-Employed, we’ll answer a few questions. And then at the end of the year you’ll have a one hour face to face consultation with a tax professional at my firm.” And what they’ve found is, if you can start to get 100, 200, 300 folks, this thing can start to become a division of your accounting firm. That actually has some healthy margins to it.

And so this is in its early stages and we just have a few of the firms in the US who are ProAdvisors who have started to kind of do this, off their own bat. We haven’t been doing anything to help them particularly. But I personally find it interesting and I would love to see whether it’s Australia or other country’s folks testing that or other business models, because ultimately the short answer to your question is, they have to create a slightly different business model but its scale, I think, is quite interesting, particularly when you think about the growth in a segment.

Digital First: It just feels very unlikely to me that many accountants will want to do that. Maybe it’s an H&R Block model or something like that because those numbers, when you look at the margins you’re going to make on that compared to a regular business… Just booking 200 one hour meetings a year for that amount of money net a year, which is maximum $600.

Rich Preece: My personal thought is, particularly as I look at the number of self-employed, accountants and bookkeepers who lean into it are likely going to be rewarded. If you’re an accounting firm today in Sydney who advertises that you specialise for these people, you probably don’t have a huge amount of competition. If you can figure out this model, and maybe it’s 60 bucks a month, you figure out the right price point, because in the future it will be competitive.

Image credit: Intuit

MYOB Launches AI-Powered Reporting with Advice in Plain English

March 16, 2018 by Sholto Macpherson 14 Comments

MYOB has added a breakthrough feature with MYOB Advisor, an algorithm-driven feature that automatically adds explanations and suggestions to financial reports.

Included in MYOB AccountRight Live and MYOB Essentials, MYOB Adviser generates a 15-page, monthly management report in seconds.

It includes sections on sales, revenue (year-to-date and cumulative), top customers by revenue, cashflow summary and at bank, expense report with cost of sales and operating expenses, and accounts receivable with top debtors.

The real magic is in the use of algorithms to insert plain-English explanations in each section of the report. A business owner can pick up the report and understand instantly how each part of the business is performing.

MYOB Adviser inserts two types of advice. The first is the explanation, in black font, describing the story behind the numbers in each section. The app uses an algorithm to analyse the numbers in the report and generates an appropriate explanation from its internal “natural language” library.

The second type is more proactive. This advice, framed in a purple border, sometimes makes an observation, such as:

“The decrease in sales this month has contributed to the decrease in overall net operating profit from last month. We know this is due to seasonal factors so not a cause for concern.”

Or it will make a suggestion to the business owner. For example:

“Even though your cash balance is increasing at a healthy rate, it could be appreciably better if accounts receivable was under control.”

An accountant or bookkeeper can manually edit both boxes to include their own observations or delete the auto-generated text.

Examples of the two types of advice generated by MYOB Advisor.

If you would like a sample report from MYOB Advisor that shows the natural-language algorithm at work please leave a comment below. Update: MYOB will send a better version of the report by Friday. So leave a comment and I’ll send it to you then.

Where it fits

MYOB Advisor is a key element of MYOB’s “connected practice” concept. By turning data into written sentences that simply explain business performance, accountants and bookkeepers can use the reports as a prompt to speak with clients.

The management report becomes a reason to meet with the client once a month to review progress, spot issues and adjust forecasts.

MYOB Advisor is in a pilot program with general release set for mid-2018.

“With MYOB Advisor we’re looking to use it as a way to stay involved on an ongoing basis – not just reporting at year end,” Jason Seidel of Galpins Accountants, Auditors & Business Consultants, who is involved in the beta, said in the press release. “It turns the conversation into a live analysis rather than a retrospective analysis looking at tax information, for example.”

Seidel said the reporting tool could engage staff who are tired of compliance work.

“Instead of doing monotonous tax returns, staff are freed up to use their skills more. They (can use the report) to pick up issues and bring them to the partners’ attention or to surface them directly with clients.”

Image credit: MYOB

CEO No More: What Will Drury Do Next?

March 9, 2018 by Sholto Macpherson Leave a Comment

What a way to start the week – a 9am press release announcing Rod Drury was relinquishing the role of CEO at Xero, seemingly out of the blue.

First, you have to pay credit where it’s due. Drury and co-founder Hamish Edwards were the first to reimagine accounting software in its current form. Automating compliance through digitising the bookkeeping and compliance process, building a massive online database of rich, professionally categorised data, and connecting it to a far broader number of online software, services and financial institutions than desktop software ever could.

And doing it all in just eight years after starting out from the tiny town of Wellington, New Zealand. It’s a hell of a run.

The conference call with media an hour later, where chairman Graham Smith introduced Steve Vamos and formally thanked Drury for his efforts, was especially revealing.

Why Drury left

Drury is first and foremost a technologist. He loves gadgets. Watch one of his keynotes or interviews and notice where he starts to jumble his sentences because he’s talking too fast.

Technologists like to invent the cool stuff. Invent something that is “truly magical and revolutionary”. That is fun. I really respect that – because that’s what excites me too.

To a technologist I would imagine running a global business would be a massive headache. People are a headache. Unless you’re into culture and educating people then this is work with a capital W. Like everything that Vamos is taking on: leadership talent, global operations, diverse geographies, managing growth rates, optimising global teams and implementing a matrixed organisation.

“I was finding I was a little bit stretched – we have so much innovation we can build, and then there’s the day to day of running a global business and working all that out,” Drury said on the call.

“I’m so passionate about building new products over this platform and I’d really like the time to work on those, work with our great leaders and get those strategies into place. This allows me to get back to the bits that really turn me on in the business.”

How it will work

Steve Vamos is in charge of the “day to day” and Drury is in charge of innovation on the platform. It’s a slightly odd arrangement in that Drury is now a non-executive director – possibly a face-saving move so Drury doesn’t have to report to Vamos. But as Matt Paff points out, Drury is clearly taking an executive role.

Vamos would no doubt have heard about the last time Xero tried to split these two positions – Drury holding onto CEO and pulling in Angus Norton as chief product officer. That lasted all of eight months, apparently because Drury couldn’t keep out of the product.

This approaches the same problem from the opposite direction. On the face of it it’s a much better fit. And Vamos made several comments about his familiarity with founder-led businesses, and also made this promise: “Rod’s DNA will always be part of Xero as I lead the business through the next phase.”

I can’t imagine Drury will surrender a mandate to take the product wherever he wants. With Vamos as the enabler and the board as the referee.

If Drury and Vamos can make it work they will be a pretty dangerous combination.

A note on the board: “The highest priority for the board is scaling operations around the world which requires slightly different set of skills in the CEO role. We’re committed to executing on our strategy. The next phase is on hiring the very best talent for global execution,” Smith said.

In short, Xero is mature enough to sell to millions more businesses everywhere. That alone will turn Xero into a very large and powerful company.

It also means the highest priority for the board is not product development. Will this lead to conflict? Maybe, but hopefully not.

Xero will always be Drury’s baby. He told the media he’s not taking any other directorships. And the board will no doubt want Drury around, if they believe recent research published in the Harvard Business Review. “S&P 500 companies where the founder is still CEO are more innovative, generate 31% more patents, create patents that are more valuable, and are more likely to make bold investments to renew and adapt the business model — demonstrating a willingness to take risk to invent the future,” the study said.

What Drury does next

Xero is heading in two directions; fancy fintech integrations that reinvent financial services (think automated approvals for loans), and adding more user features to Xero. The first direction will draw on Xero’s treasure trove of data – $1.3 trillion of transactions, neatly categorised (for free!) by an army of bookkeepers, accountants and business owners.

Every financial services provider from insurance companies to banks and investment funds will want to know how businesses are performing in various segmentations and when they are likely to need to buy a financial service. Xero will be busy clipping all sorts of tickets in the next five years.

The second is just as interesting. Drury talks about moving “from the back office to the front office” – that is, putting more elements of Xero in the hands of employees. In fact on the call Drury described the first 10 years of Xero’s life as “building all the complexity of SAP for small business”.

SAP is a business platform for enterprises that spans every part of the business from HR to inventory and warehousing to sales and marketing as well as finance. Will Xero ever get that big? It’s possible. Drury has talked about going after the mid-market before in his 2016 Xerocon keynote. In the conference call he talked about “reinventing the user experience”.

Perhaps, now that he has freed himself of the “day to day”, Drury can take on his next dream – to give fast-growing SMEs a reason never to leave Xero.

Image credit: Xero

2018: Predictions for Cloud Integrators in the Accounting Ecosystem

January 26, 2018 by Jeri Wambeek 15 Comments

2017 was a big year for cloud integrators. In previous years the term “cloud integrator” wasn’t well known. But last year accountants started to actively seek out cloud integrators. Either they had tried helping clients implement solutions themselves – and it was much harder than expected – or they had decided to just focus on accounting, be it doing tax returns, compliance, monthly reporting and so on.

But what’s next for the cloud Integration industry? Here are my predictions for 2018.

1. More apps, more cloud integrators and more content

Think that “information bloat” from thousands of addons and apps is bad? It’s going to get worse. The list of apps that connect to Xero and QuickBooks Online grows every week – and that’s just the official software solutions. There are hundreds more with connections available that just aren’t certified.

There is no doubt that there is an opportunity for more apps. Businesses increasingly want to move to the cloud because they see the benefits of doing so or are sick of paying ongoing server and internal IT costs.

Alongside the influx of new apps and cloud integrators there will also be a flood of content trying to get your attention for these apps. No matter how good an app sounds, make sure that you do your research and your testing to ensure that it’s the right solution for you.

If you don’t have the time or expertise, engage an experienced cloud integrator to help you find the cloud solution for your business before you waste your time and money on the wrong one.

2. Software vendors doing more implementations

We have all experienced the growing pains of the cloud software industry over the last few years. Cloud integrators have overcommitted, software companies haven’t trained support staff fast enough and unfortunately, you can’t become a successfully cloud integrator overnight.

We started out with clients needing inventory management. It takes considerable time to learn the solutions available to an expert level.

It’s not just about knowing the solution yourself but knowing how to sell, implement, train others and support everyone involved – to an expert level.

Software vendors have been burned by unsuccessful implementations. Sometimes it is the fault of the software. Sometimes it’s the fault of cloud integrator for not providing the correct setup, implementation, training and support, not the software itself.

Software vendors will subtly push away from partner referrals and increase their direct implementation and training services. Software vendors don’t want to bear the pain of rookie cloud integrators ruining the reputation of the software and increasing their attrition rates.

3. More customisations, less generic automation

As cloud integrators have honed their skills and their systems they have looked at automating their training and support processes. This may reduce the price of implementations, but low-cost services aren’t likely to develop a system to its fullest potential.

Clients need to feel supported. They need to ask questions and feel comforted that they have all the resources they need to hit the ground running with their new cloud system. To provide higher levels of service, cloud integrators will start focusing on more personalised connections with clients, more powerful implementations and less generic automation.

The time for lite training and fluffy webinars is over.

4. Partner programs will become more expensive and more technical

Along the same lines as above, software vendors are sick of getting burned by rookie cloud integrators. They will demand partners meet higher certifications to guarantee standards. The barriers to entry to become an implementation partner with many software companies will be more expensive and more rigorous.

Cloud integrators will need to become more serious about their business and know niche solutions to an expert level. It will improve the quality of partners doing the software certification programs because the training is becoming more focused, more technical and more practical.

5. The term “cloud integrator” will become recognised globally

Our recent visit to the US in late 2017 was an eye-opener. I have seen the growth of our industry first hand over the past nine years. Australians and New Zealanders are open to the idea of consultants who can help you find the right solution and manage a software project.

Here’s what I found in the US. Cloud accounting adoption increased substantially after dramatic improvements to QuickBooks Online in 2016-2017. So has the idea that apps are needed to make QBO even better.

In the US, they have already cottoned on to the fact that apps and cloud accounting go better together from day one.

I stood in a room full of hundreds of accountants at QBConnect (Intuit’s annual QuickBooks conference) who wanted to learn about how to select apps for clients. Over 500 people easily at a conference for “new” QBO advisors and users. You have to be lucky to get half that in Australia at Xerocon which has double the number of attendees.

But here’s what was so interesting. The US has effectively two professions in their massive traditional software industry that we would consider for the role of a cloud integrator in Australia. They have “selection consultants” – who help the client select the right software solutions, usually providing a choice of two to three, and then introducing the client to the software vendor to make their final decision.

The chosen software vendor either assists the business to implement their solution or introduces them to an “implementation partner”.

As cloud integrators we do both – help find the solution and implement it. In the US the concept of a cloud integrator is also limited by the historical understanding of which services you need to move to new software.

Many US business know they need a cloud integrator and they need apps to improve their efficiency and profitability. But they don’t know how to find those people that can help them. Throughout 2018, you will see the term “cloud integrator” become much more common globally as demand for a smarter solution increases.

2018 is going to be an exciting year for the cloud integration industry as it booms across the world.

If you are working with clients that need to move to the cloud, ensure that you do your research and find the right cloud integrator that suits your clients and your business.

Image credit: TW Solutions

10 steps to protect your finance team from cyber crime

January 9, 2018 by Sholto Macpherson 4 Comments

It was just another week in March when the bookkeeper sat down to pay suppliers for the Sydney-based company. However, as the bookkeeper entered payment details for $50,000 worth of invoices, a hacker was lying in wait. The hacker had changed numbers on the invoices and every invoice was paid to dummy accounts.

Luckily for the business, the bank was able to reverse the funds transfers, says Tom Cavanagh, a lawyer from Wotton and Kearney who specialises in cyber and data security.

(Pictured: Tom Cavanagh)

Cyber-attacks are rife among Australian SMEs, which faced a blistering 200,000 ransomware attacks in April and May last year, more than any other country in the world apart from Japan.

Ransomware, fake invoices and email scams can cost an average of $1.9 million a hit for companies with 100 to 500 employees, according to a recent survey of 600 IT decisionmakers by internet security company Webroot.

These are only direct costs and don’t include reputational damage. In February, the Notifiable Data Breach Scheme will force companies to report cyber attacks to their customers and business partners.

Security is no longer just the IT department’s problem. Hackers regularly target finance teams for obvious reasons. Every employee is a potential entry point for a hacker to access internal systems. So what’s the answer? This checklist from Murray Goldschmidt, CEO of Sense of Security, and Tom Cavanagh provides helpful hints to protect your internal finance team.

(Pictured: Murray Goldschmidt)

1. Be observant

Sometimes the simplest checks are best. Your finance team should always ask: “Is there anything suspicious about this email?” Giveaways of phishing emails (fake emails) are spelling mistakes or a missing or incomplete signature. If the sender is not known, always check the email header to see the server domain of the sender. Sender names and email addresses are easily faked. And if unsure, links should not be clicked on.

2. Check social requests

Double-check connection requests on LinkedIn. If the name, occupation and location is not familiar to you, then reconsider whether to accept. It may be flattering to amass a large social following, but this is also a first step to infiltrating your company.

When you connect to someone on LinkedIn, they can see your email address by default (this can be switched off). Most software uses the business email address as the username, so a hacker now has half the login details. If an employee is using a password at work they use in their personal accounts, they are very susceptible to a hack. For example, Yahoo reveals that hackers have gained access to most passwords of its three billion accounts. A hacker can search the stolen database, match the name, get the password and with the email address on LinkedIn they can use your account.

A first-level LinkedIn connection can also search your contacts for the name of the CFO or other key personnel. Targeted attacks, where fake emails are addressed to targets by name, are called spear-phishing and can be very effective.

3. Improve your business processes

What is one way to check that the urgent invoice from your CEO asking to pay $100,000 immediately is legit? Pick up the phone and call to confirm. Even if they are travelling.

Clever hackers will monitor the CEO’s movements and send money transfer requests just before they board an international flight. A hacker can add “I can’t attend to this because I’m overseas” to give context, which adds legitimacy to the request.

It doesn’t take much to confirm with the CEO via a quick text message to their mobile. If it’s a large amount, then make the phone call and get verbal confirmation. It is possible to spoof SMS messages, but nearly impossible to fake a spoken conversation. If you want to take it to Jason Bourne crime fictional levels, add a codeword to prove they are not held under duress. A second pair of eyes on transactions will also increase the chance of spotting a suspicious error.

4. Call suppliers to confirm new invoices

Create a policy for the finance team to call new suppliers before they pay the first invoice. Don’t call the number on the invoice itself: hackers are very enterprising and can pay someone to act as a receptionist. Even if the email address, email signature and logo appear to be genuine, the phone number may be fake. Look it up online and make sure you’re on the correct website. The supplier should be listed in Google Maps or other directories.

5. Use an e-invoice service

One way to eliminate fake invoices is to use a third party to authenticate them. Link4 takes invoices from one accounting program such as MYOB and automatically enters the details in a different program such as Xero or QuickBooks Online. The service requires the supplier and the customer to sign up separately. Once connected, the supplier can send invoices directly into the customer’s accounting software.

Xero has created an internal network for sending and receiving invoices from two companies on Xero by using a network key to validate the connection. If the finance team knows that all invoices for that supplier appear automatically in Xero, then any invoice from that supplier appearing in an email should automatically be treated as suspicious.

6. Use multiple signatories for bank transfers

Remember when we used cheques? Businesses often required two signatories to withdraw money. The same process should be followed for online banking. Many banks can set up safeguards for two authorisers to approve payments over a certain amount. Newer banks such as Tyro are more sophisticated in permissions. When the finance team makes payments, Tyro automatically notifies the business owner or manager with an alert on their mobile phone. They then swipe to approve each invoice directly.

7. Use multi-factor authentication

Multi-factor or two-step authentication should be a mandatory policy – definitely on your online banking and accounting software, but also on business software you use regularly. It usually involves sending a time-sensitive SMS code or using an authentication app on your mobile phone.

Some banks still use dedicated tokens to provide the second piece of authentication. These little gadgets attach to your keyring and display a randomly generated number to supplement your password.

8. Don’t rely on default protection

Cloud productivity software is better protected than the desktop equivalent, because it has anti-virus scanning built in. Any email sent through Microsoft Office 365 or Google G Suite is checked to see whether it is carrying malicious code and if it is – it will block access to the attachment. However, companies shouldn’t rely on these default settings.

“Standard anti-virus is so useless, it’s as good as having nothing at all,” says Goldschmidt. A phishing email may contain a link which directs the receiver to download a file from a website directly. For a few dollars a month per employee, you can buy security software that will download attachments into a “sandbox”. The software checks the attachment and only gives access if it is free of malware.

9. Continuous validation through simulations

It is good practice to train your staff to recognise phishing emails and other cyber-security attacks. It is better practice to continuously validate how well they follow the recommendations. One subscription service simulates a phishing campaign by sending one fake email a week to your finance team. The emails look genuine, but if an employee clicks on it, the email displays a message explaining it was against policy to do so or a reminder that these types of emails are dangerous.

Free testing services include Trend Micro’s Phish Insights. Paid services include Shearwater’s Phriendly Phishing and Phishingbox. You can find more phishing services here.

10. Monitor staff behaviour changes

“There is evidence that the social behaviour of a person in the two to three weeks leading up to their resignation changes dramatically,” says Goldschmidt. The volume of email may increase or decrease, or the frequency of logins to a particular website may alter. That employee could be planning on taking company secrets with them.

Another red flag is when a hacker obtains the identity of a legitimate employee and infiltrates the corporate network. Behavioural software flags the activities of the fake employee as suspicious because they are different to the usual pattern. Consider installing apps that analyse employee behaviour. Apps such as Blindspotter, Veriato and Splunk use algorithms to detect changes and altert IT staff.

This article was first published in Acuity magazine.