Client Due Diligence: Does Your Accountancy Firm Need a Penetration Test?

No public rule names a penetration test for an accountancy or professional services firm. When a client asks for one, the asker is a private party writing its own due diligence or security questionnaire. In our experience the request comes from audit clients, corporate clients and referral networks, and what they want is evidence that the systems holding their records have been independently tested.

Does a client’s due diligence require your firm to have a penetration test?

No law or professional rule requires a penetration test because a client has asked for one. Each client, bank or referral partner writes its own supplier checklist, so the wording differs from firm to firm. What the request means is set by the exact question you have been sent.

Clients ask because of what a firm holds: tax records, identity documents, bank details, payroll files and audit working papers. A firm that takes payment instructions and moves client money is also a target for invoice fraud. A client who hands that material over is entitled to ask how you know your own systems stand up to attack.

One legal text sits behind many of these questions. Client records are personal data, and UK GDPR Article 32(1)(d) requires a process for regularly testing, assessing and evaluating the effectiveness of your security measures. It does not name penetration testing as the method. See our page on GDPR penetration testing.

The Information Commissioner’s Office says in its guide to data security that you can undertake this testing through a number of techniques, such as vulnerability scanning and penetration testing. A penetration test is therefore one accepted way to meet Article 32, and a client asking for one is asking for the most direct form of evidence you may already owe.

Professional bodies publish cyber security guidance for member firms. In our experience that guidance does not name a penetration test as a requirement, so check your own body’s current wording before you rely on it either way.

What does a client’s questionnaire actually ask for?

The wording varies, and you should read it before you buy anything. In our experience a client’s ask takes one of four forms. These are habits of buyers, not rules, and no client is obliged to use any of them.

• A yes or no question. “Has your firm had an independent penetration test in the last 12 months?” A dated report and a summary of what was fixed answers it.
• A request for evidence. Some clients ask for the report. Others accept a summary letter that names the scope, the date and the testing company.
• A certification. Some audit clients, corporate clients and referral networks ask a firm to hold Cyber Essentials Plus before they engage. That is an assessor-led technical audit and a different thing from a penetration test.
• An accreditation for the tester. The questionnaire may say the test must come from a CREST-accredited company. If it does, that is the requirement to follow.

Insurers ask too. One published cyber proposal form asks whether you conduct penetration tests of your network at least annually. Requirements vary by insurer and policy, and a broker will tell you which questions apply. Our guide to cyber insurance renewals that ask for penetration testing goes through them.

Who can carry out the test?

No public rule names an accreditation for a test a client has requested. Accountancy and professional services firms can use a CREST-accredited company or another provider, depending on what their requirement states. EJN Labs is CREST-accredited. Start with the client document and use the accreditation it names, if it names one.

Where a questionnaire asks for a CREST-accredited test, a CREST-accredited company such as EJN Labs meets it. Where it names a different scheme, use a provider approved for that scheme. If it names nothing, pick a company whose accreditation you can check on the scheme’s own register.

Two practical questions are worth asking of any company. First, how it will handle your clients’ data during testing, because your engagement terms with your clients may restrict who can see their records. Second, whether the report can be shared with a client without exposing other clients’ details.

What should an accountancy or professional services firm test?

Test the systems a client would worry about first: the places where their records are uploaded, shared and stored, and the routes an attacker could use to impersonate your staff. That covers client portals and tax upload, audit data rooms, practice management platforms, accounting integrations, Microsoft 365 and the internal network.

• Client portals and tax upload. Whether one client can see another client’s documents, and whether uploads are validated. See customer portal penetration testing.
• Audit data rooms and document sharing. Folder and engagement boundaries, share-link leakage, and invitations that still grant access after they should have expired.
• Practice management platforms. Partner review and sign-off stages, and the permission boundary between staff and partners.
• Accounting software and HMRC integrations. Token scope and client-account separation across the APIs that connect your systems. See API penetration testing.
• Payment-instruction and invoice fraud. Phishing aimed at finance and practice staff, lookalike domains and mailbox forwarding rules. See phishing assessments.
• Microsoft 365 and the internal network. Conditional access, MFA bypass, and separation between partner, audit, tax and admin teams. See Microsoft 365 security review and internal network penetration testing.

What evidence do you hand back to the client?

Hand back a dated report that states the scope, the method, each finding with a severity score, and what was fixed. No public rule sets a format for accountancy firms, so match the evidence to the question. This is practice, not a requirement, and a client may ask for more or less.

For a yes or no question, the useful evidence is the date of the test and confirmation that high and critical findings were fixed, which a retest provides. For a larger client, a letter naming the scope and the testing company often works, with the full report shared under a confidentiality agreement.

Keep the findings tracker as well as the report. A client who comes back a year later will ask what has changed, and a record of what was found, fixed and retested answers that faster than a new test.

What does it cost?

Price follows the number of testing days, and the number of days follows the scope. UK day rates for CREST-accredited penetration testing typically run £1,100 to £1,400. The pricing page shows typical engagement lengths for each type of test, and the quote form gives an exact figure for your scope.

How EJN Labs approaches testing for accountancy and professional services firms

EJN Labs is a CREST-accredited UK penetration testing company with a dedicated accountancy and professional services service. We test client portals, audit data rooms, practice management platforms, accounting and HMRC integrations, Microsoft 365 and the internal network, with client confidentiality as the starting point.

The work is done by UK-based, CREST-certified testers. Testing is safe by default on production, with no denial of service, and out of hours slots are available. You get a fixed price for a defined scope, findings in a client portal as they are confirmed, CVSS-scored findings with a walkthrough call, and the report on the last day of testing.

Retests are free until findings are resolved, so the evidence you give a client can show that issues were fixed as well as found. There are no out-of-hours, callout, cancellation or rescheduling fees.

Frequently Asked Questions

Does an accountancy firm have to have a penetration test?

No public rule names a penetration test for accountancy firms. A client’s due diligence is a private request with its own wording. UK GDPR Article 32(1)(d) separately requires a process for regularly testing your security measures, and does not name penetration testing as the method.

Is Cyber Essentials Plus the same as a penetration test?

No. Cyber Essentials Plus is an assessor-led technical audit of your devices and network settings. A penetration test is a hands-on attempt to break your systems, such as a client portal. Some clients ask for one, some for the other, some for both, so read the wording of the request.

Does the testing company need to be CREST-accredited?

Only if the requirement says so. Accountancy and professional services firms can use a CREST-accredited company or another provider, depending on what their requirement states. EJN Labs is CREST-accredited. Check the client questionnaire and use the accreditation it names.

Can we share the report with a client?

You can, but agree the format first. In our experience many clients accept a summary letter naming the scope, date and testing company, with the full report available under a confidentiality agreement. The report describes weaknesses in your systems, so share it only with parties you trust.

How often should a firm run a penetration test?

No rule for accountancy firms sets a frequency. One published cyber proposal form asks whether you conduct penetration tests of your network at least annually, so once a year, and again after a significant change such as a new client portal, is a common starting point.

Get a quote for your firm

Tell us which systems are in scope and which client has asked for the evidence. Request a fixed-price quote and we will come back with the number of days, the price and the earliest start date.

Related: Penetration Testing Cost for UK Accountancy and Professional Services Firms, Best Penetration Testing Companies for UK Accountancy and Professional Services Firms, penetration testing for accountancy and professional services, GDPR penetration testing, Cyber Essentials Plus and penetration testing for law firms.