Insights

Sharp thinking for your practice.

The security and IT questions firms actually ask, answered plainly.

Featured guide
Eight controls, four maturity levels, one clear target.
Essential Eight

The Essential Eight, explained for accounting firms.

What the ACSC's Essential Eight actually means for a practice holding client TFNs and financials, and how to reach a sensible maturity level without slowing the firm down.

Nathan James 8 min read
Read the guide →

Latest

11 articles
AI

Can you connect Copilot or Claude to Xero Practice Manager?

Xero's new AI integrations cover your accounting data, not your practice management. What actually connects to Practice Manager today, and why the security work comes first.

Nathan James 6 min read
Read →
Cyber

SMB1001 vs the Essential Eight: why your firm needs both

Essential Eight or SMB1001? Accounting firms need both. One hardens your systems, the other shows where you stand. How they fit, and which comes first.

Nathan James 7 min read
Read →
Cyber

AI has made your practice worth attacking properly. Here is how to check where you stand.

The ASD and the AICD have told directors how AI is changing cyber attacks. What it means for an accounting practice, what it costs to fix, and what happens after a breach.

Nathan James 7 min read
Read →
AI

Your engagement letter probably doesn't mention AI. After the TPB's new guidance, that's a problem.

The TPB's July 2026 guidance says client data entered into an AI tool can be a disclosure to a third party, and that disclosure needs the client's permission first. What that means for your engagement letters, and the systems questions behind them.

Nathan James 7 min read
Read →
Guides

SMB1001, explained for accounting firms. Bronze to Diamond.

The five certification tiers in plain English, what the standard actually covers, how a practice gets certified through CyberCert, and where the Essential Eight fits alongside it.

Nathan James 6 min read
Read →
Essential Eight

The Essential Eight is being retired. Here's what your firm should do about it.

The ASD is replacing its best-known framework with the Essentials series by about mid 2028. What's changing, what carries across, and why nothing needs to pause.

Nathan James 6 min read
Read →
Cyber

How secure is data in ChatGPT? What accountants need to know

Where client data actually goes once your staff hit enter, why it collides with APES 110 and the Privacy Act, and how to set AI up so it can't bite you.

Nathan James 8 min read
Read →
Essential Eight

Is the Essential Eight mandatory for Australian accounting firms?

The honest answer, plus the insurance and client pressures pushing firms toward it whether or not a regulator ever makes it official.

Nathan James 7 min read
Read →
Cyber

The Xero login problem nobody talks about.

Xero lets you control what staff can see, not where they log in. The credential gap most firms miss, and how we close it so passwords can be used but never seen.

Nathan James 7 min read
Read →
IT Strategy

General IT vs accounting-firm IT: what's actually different.

Plenty of providers "also do" accounting firms. Here's why generic IT quietly costs a practice time, security and sanity.

Nathan James 6 min read
Read →
The Quarterly Brief

One short email each quarter.

A short, practical roundup of security and IT tips for accounting firms, four times a year. No spam, unsubscribe anytime.

Kip, the Worktopia mascot, holding a coffee

Prefer to just talk it through?

Reading only gets you so far. Tell us what's slowing the firm down and we'll map the fix. One partner, one flat fee, no jargon.

Book a strategy call or call 1300 856 912