EOFY IT checklist for accounting & finance firms

For accounting and finance firms, the end of the financial year is the busiest stretch on the calendar. It’s also the ideal moment to get your technology in order: partly for the tax benefits, but mostly because the systems you rely on through tax season are the same ones holding your clients’ most sensitive financial data.

Here’s a practical, plain-English EOFY checklist to work through with your team (or your IT partner) before and just after 30 June.

Why EOFY is the right time to review your IT

Three things line up at once at the end of the financial year. You’re thinking about deductions, so any technology spend is top of mind. Many software licences, support contracts and cyber insurance policies renew around now. And you’ve just leaned on your systems harder than at any other time of year, so you know exactly where they creaked.

Spending an hour on the items below turns that pressure into a clear plan for the year ahead.

1. Lock down client and financial data

Accounting firms are a prime target. You hold tax file numbers, bank details, payroll data and financial statements, exactly what attackers want and exactly what clients trust you to protect. Tax time makes it worse, because criminals know your inboxes are flooded and your team is moving fast.

Before the new year starts, confirm the basics are actually in place:

• Multi-factor authentication (MFA) on every account: email, your accounting and practice software, and remote access. A password alone is no longer enough.
• Email security that catches the invoice-redirection and fake-ATO scams that spike at tax time. (We dug into how these work in AI phishing: the threat every accountant needs to know.)
• Up-to-date protection on every device staff use to access client files, including laptops people take home.

If you’re not sure where you stand, this is the foundation of our IT security service, and a quick review will tell you what’s solid and what needs attention.

2. Check your backups, and that they actually restore

Most firms have a backup. Far fewer have ever tested that they can recover from it. A backup you’ve never restored is a guess, not a safety net, and “we lost the records” is not a conversation you want to have with a client or the ATO.

Before EOFY closes out, confirm:

• Your client data, email and accounting files are backed up automatically, every day.
• Backups are kept somewhere separate from your main systems, so one ransomware incident can’t encrypt both.
• Someone has actually done a test restore in the last few months.

It’s a small task that prevents a genuinely disastrous loss of data.

3. Make the most of tax-deductible IT upgrades

If you’ve been putting up with slow laptops, an ageing server or software that’s holding the team back, EOFY is the natural time to act. Technology used to run your business is generally tax-deductible, and bringing a planned upgrade forward before 30 June can mean claiming it this financial year rather than waiting another twelve months.

Worth a look:

• Hardware that’s slowing people down. Devices more than three or four years old usually cost more in lost time than they would to replace.
• Software and subscriptions you already pay for but haven’t fully rolled out.
• Any security improvements you’ve been meaning to make.

Speak to your accountant (you are one, or you have one) about how the current rules apply to your firm, but don’t let a worthwhile upgrade drift simply because nobody scheduled it.

4. Review your software licences and subscriptions

Subscriptions creep. Over a year, firms quietly accumulate licences for people who’ve left, duplicate tools that do the same job, and plans that no longer match how the team works. EOFY is a good prompt to:

• Match your Microsoft 365 and accounting-software licences to your actual headcount.
• Cancel anything you’re paying for but no longer use.
• Check you’re on the right plan. Microsoft 365 Business Premium, for example, includes security features many firms pay for separately without realising.

5. Tidy up access, especially for people who’ve left

Staff and contractors come and go, and access often lingers long after they do. An old account that still works is an open door. As part of your EOFY tidy-up:

• Disable accounts for anyone who’s left.
• Review who has access to your most sensitive client folders and financial systems, and confirm they still need it.
• Remove old shared logins in favour of individual accounts you can actually track.

6. Cover the Essential Eight basics

The Essential Eight is the Australian Cyber Security Centre’s set of eight baseline strategies, and it’s increasingly what insurers and larger clients expect to see. You don’t need to tackle all of it overnight, but EOFY is a sensible checkpoint to confirm the fundamentals are running: applications and operating systems are being patched, admin privileges are restricted, and MFA is in place.

For firms that want a formal, recognised credential to show clients and insurers, SMB1001 offers a tiered cyber certification built for small and medium businesses, and a more achievable path than ISO 27001.

7. Review cyber insurance and compliance

Many cyber insurance policies renew mid-year, and insurers now ask pointed questions about MFA, backups and staff training before they’ll cover you (or pay out). Use renewal time to make sure your security genuinely matches what your policy assumes. The two drifting apart is how claims get denied. Getting the controls right can also reduce your premium.

It’s also a good moment to confirm you’re meeting your record-keeping and privacy obligations for the client data you hold.

8. Plan your IT budget for the new financial year

Finally, look forward. A short conversation now about the year ahead (replacement timelines for hardware, security improvements, and any growth you’re expecting) turns IT from a series of surprise bills into a predictable, planned line item. That’s the whole idea behind managed IT for accounting firms: no bill shock, no scrambling, just steady support that fits how your practice actually works.

Your EOFY IT checklist at a glance

• ☐ MFA on every account and system
• ☐ Email security tuned for tax-time scams
• ☐ Backups running daily, with a test restore done
• ☐ Tax-deductible hardware/software upgrades actioned before 30 June
• ☐ Licences matched to headcount, unused subscriptions cancelled
• ☐ Access removed for departed staff; sensitive-data access reviewed
• ☐ Essential Eight fundamentals confirmed (patching, admin rights, MFA)
• ☐ Cyber insurance and compliance reviewed at renewal
• ☐ IT budget and upgrade plan set for the new year

Working through this list is the difference between starting the new financial year confident your systems are secure and sorted, or carrying last year’s risks into the next twelve months.

If you’d like a hand getting through it, that’s exactly what we do for accounting and finance firms across Brisbane. Get in touch for a no-obligation review and we’ll tell you plainly what’s solid and what’s worth tidying up before the new year.

Adam Dodds

Adam leads the Itopia team in Brisbane, helping professional-services firms get secure, productive and confident with their technology, in plain English.