Strengthen cybersecurity by testing how approvals, access, and recovery plans work when routine business takes an unexpected turn.
Transformation Trends
By Donny Shimamoto
Center for Accounting Transformation
A supplier provides new payment instructions. An executive sends an urgent bank transfer request. A payroll administrator receives a message asking to reset a password.
Each situation looks like ordinary business, but needs a control that works even when the request seems legitimate.
October was Cybersecurity Awareness Month, an opportunity for accounting and finance professionals to examine how their organizations protect money, private information, and the ability to keep operating. Whether we work in business and industry, government, nonprofits, or public practice, cybersecurity reaches into the processes accountants manage every day.
We do not need to become cybersecurity engineers to protect our organizations. In fact, cybersecurity tools don’t protect you from the situations above; traditional accounting internal controls do. We need to bring our understanding of risk, authorization, and accountability into decisions about technology and the work that we are doing.
Payment controls are cybersecurity controls
The FBI’s 2025 Internet Crime Report records 24,768 business email compromise complaints and approximately $3.05 billion in reported losses. These are losses reported to the FBI’s Internet Crime Complaint Center, not an estimate of every loss nationwide.[1]
That threat lands directly in accounting’s territory. A convincing message can redirect a legitimate payment without first shutting down the organization’s systems.
The FBI recommends independently verifying payment requests and changes to account numbers or payment procedures.[2] Build that verification into the workflow. Call a known contact using a previously verified number, rather than a number supplied in the request. Require a second approval for sensitive changes, and document the verification before releasing funds.
Then examine the exceptions. Can someone override the process because an executive is traveling or a vendor is demanding immediate payment? Does the same person change banking information and authorize the transfer?
A control that disappears under pressure offers little protection when urgency is the attacker’s strategy. Leaders should explicitly support employees who pause a transaction to verify it, including requests that appear to come from leadership.
Ask for evidence that protections work
Verizon’s 2026 Data Breach Investigations Report finds that vulnerability exploitation accounts for 31% of initial access in its breach dataset. Ransomware appears in 48% of breaches.[3] These findings describe the report’s investigated breaches; they are not the probability that any particular organization will experience an attack.
For accounting professionals, the practical response is to ask better questions about the protections supporting critical work and sensitive information.
Who owns software updates? How are urgent security fixes prioritized? Which devices and applications fall outside the organization’s normal monitoring? If a system is too old to secure adequately, who approves the risk of continuing to use it?
Access deserves the same scrutiny. NIST recommends enabling multifactor authentication on accounts that offer it and considering phishing-resistant options for sensitive applications. It also advises limiting access to what people need and removing it when their needs change or they leave.[4]
Ask to review access to banking, payroll, financial reporting, and document-sharing systems with the responsible technology team. An employee’s new role (transfer within the organization) should trigger an access review, just as departure does. Convenience should not quietly become permanent authority.
Translate downtime into business consequences
A backup report saying “successful” does not tell leadership how quickly payroll can resume or whether the accounting team can complete the close.
Work with technology and operational leaders to identify the processes that must continue during an outage. Estimate the cost of interruption, including delayed collections, missed payments, overtime, and the effort required to reconstruct records. Decide how long each process can reasonably remain unavailable.
Then test recovery against those needs. Ask for a restoration exercise that demonstrates usable data and an achievable recovery time. Include the people who will actually perform the work after systems return.
Outsourcing also requires clear responsibilities. For a payroll provider, cloud accounting platform, or managed technology service, establish who handles access, backups, incident notification, and recovery. Ask what your team must do if the provider becomes unavailable. Record those answers before an incident forces everyone to negotiate responsibilities under pressure.
Make the response a practiced process
An effective response begins with employees knowing how to report a concern quickly, without fear that an honest mistake will become a public reprimand.
Run a short exercise using a realistic scenario: A payment has gone to a fraudulent account, or staff cannot access payroll on processing day. Identify who contacts the bank, who coordinates with technology specialists, and who authorizes operational decisions. Keep essential contact information accessible even if email is unavailable.
For suspected business email compromise, the FBI advises contacting the financial institution immediately and reporting the incident to IC3.[2] Put those steps into the response plan.
If you didn’t already do it in October, choose one critical workflow and follow it from request through authorization, execution, and recovery. Identify a weakness, assign an owner, and set a date to verify the improvement.
Cybersecurity becomes more useful to leadership when we can explain what is protected, what could interrupt operations, and which action reduces that exposure. Accounting and finance professionals can make that conversation concrete, and help ensure that the controls on paper work when the organization needs them.
Build Your Cybersecurity Confidence
Center for Accounting Transformation resources
Understand your technology options
On Nov. 16, 2026, Donny Shimamoto presents “Understanding Your Cybersecurity Tech Options: How Non-Techies Can Mitigate Their Malware Risks.” This two-hour webinar offers 2 CPE credits and explores malware protection, device management, email security, backup, secure document exchange, and other risk areas. Learn how to assess your controls and identify remaining risks to discuss with your technology adviser.
Explore the course and upcoming events
Explore protection for a small or home office
The Center’s Small Office/Home Office (SOHO) Protection Package is designed for small- to medium-sized accounting practices seeking help selecting cybersecurity protection. The process starts with understanding your services and technology stack, then identifying a subscription level that fits your needs and budget. Connect with an adviser to explore the available options.
Learn about the SOHO Protection Package
Sources
- FBI, 2025 Internet Crime Report, published in 2026, printed pages 7–8. Business email compromise complaints and reported losses.
- FBI, Business Email Compromise. Payment verification and incident reporting guidance.
- Verizon, 2026 Data Breach Investigations Report Executive Summary, printed pages 9–10. Vulnerability exploitation and ransomware findings.
- NIST, Multi-Factor Authentication, updated Jan. 5, 2026. Authentication and access management guidance.
