Standard cover works for contained risks
A partner spots a payment instruction from a long-standing client. The email thread looks genuine. The bank details have changed. The transfer is due before close of business.
Meanwhile, the practice holds payroll files, tax records and login details across several cloud systems. This creates more than one type of cyber risk.
For Accountants: bespoke cover vs standard, standard cyber cover can suit simple risks. However, its limits and fraud exclusions may not suit your data and payment processes.
A cheap policy can leave a costly gap.
A standard cyber insurance policy can suit a practice with limited payment authority. It can also suit firms with few cloud platforms. Your controls must match the insurer's requirements.
Do not choose standard cover on price alone. Choose it only if your payment and data risks fit its stated limits.
Fixed packages can miss payment fraud
Standard policies often cover data-breach response, forensic work and ransomware within set terms. Social engineering fraud may have a lower sub-limit. Funds transfer fraud may also have a lower sub-limit.
This matters when a fraudster sends a convincing email. The email may ask staff to change bank details or release payroll.
Do not assume the full policy limit applies. The schedule may show £1 million, while a payment fraud sub-limit may be £25,000 to £100,000. The wording and quotation decide the actual amount.
Choose standard cover if your largest likely payment loss falls within its fraud sub-limit.
Compare the usable cover, not the headline limit
The usable value of cyber cover comes from sub-limits, excesses, exclusions and waiting periods. It does not come from the large number on the front page.
| Measure | Standard policy | Bespoke cover | Decision point |
|---|
| Indicative annual premium | Often £300 to £1,500 | Often £1,000 to £5,000+ | Compare like-for-like limits and controls |
| Social engineering fraud | May be excluded or capped | Can be set around payment exposure | Check each payment workflow |
| Business interruption wait | Usually 8 to 24 hours | Can be agreed at quotation | Test against tolerated downtime |
| Cloud supplier outage | May be narrowly defined | Can include named dependencies | List accounting and IT suppliers |
Supplier outages are often overlooked
A cloud accounting platform can stop your practice. A managed IT provider can also stop it. This can happen even when hackers never breach your own systems.
Check dependent business interruption cover carefully. It should address named suppliers, unnamed suppliers and loss of access, rather than being restricted to physical damage.
A £1 million limit matters only after you check legal, forensic and public-relations costs. You must also check whether fraud and outage sub-limits match your worst credible loss.
Cyber insurance, PII and crime or fidelity insurance answer different questions. Map each policy before assuming one will respond.
PII may cover claims about negligent advice or service failures. Crime or fidelity cover may cover stated theft by employees or third parties. Cyber insurance may fund breach response and system recovery.
Social engineering fraud is the difficult area. A staff member may approve a transfer after a false bank-detail email. An insurer may call this a voluntary payment. Cover must expressly include payment fraud or funds transfer fraud.
Check the trigger, payee and client-money position. Check cyber insurance sub-limits too. Do not rely on the policy label.
Choose the policy with clear cover for your payment route. Avoid any policy that offers only a large headline limit.
Bespoke cover earns its cost when exposure demands it
Bespoke cyber cover is worth considering when your risks exceed standard assumptions. Payment processes, sensitive data and supplier reliance can all change the answer.
Payment authority changes the answer
A common case starts with an email from a known client. It changes bank details. Staff make payment before anyone spots the fraud.
The dispute may turn on the type of loss. It may be social engineering, funds transfer fraud or an excluded voluntary payment. The policy wording decides this point.
Bespoke wording can set fraud limits around your largest likely transaction. It can reflect dual approval and independent call-back checks. It may not pay if staff ignore an express condition.
A call-back to the suspicious email number is not independent verification.
Choose bespoke cover if a single wrong payment could exceed a standard fraud sub-limit.
Choose by the exposure map
Choose bespoke cover if you hold more than 1,000 client records. It may also suit firms with special-category personal data. Other signs include outsourced IT with administrator access.
It can also fit firms with more than two key cloud suppliers. Client-money work, payroll processing and high outage losses also matter. A standard sub-limit may not meet these risks.
Under UK GDPR and the Data Protection Act 2018, a breach can create early costs. These can include investigation, client contact and legal help. They can arise before any regulatory outcome.
The clearest choice is bespoke cover for firms with payment authority, payroll work or major cloud reliance. Standard cover can work for small, contained risks, but it can fail when its sub-limits sit below a realistic loss.
- Ask for every sub-limit: Check ransomware, data restoration, social engineering, funds transfer fraud, regulatory defence and supplier outage.
- Ask who responds: Confirm 24/7 legal, forensic and crisis support. Check whether their fees reduce the policy limit.
- Disclose the real set-up: State cloud tools, outsourced IT, payment authority and prior incidents accurately on the proposal form.
Insurers now assess controls as closely as turnover and client numbers. They often expect multi-factor authentication for email, remote access and cloud accounting platforms. They also expect supported and promptly patched software.
They may expect separate, tested backups and endpoint protection. Regular phishing training is also common. Cyber Essentials can show baseline controls, but it does not guarantee cover or security.
Weak controls can affect terms. They may lead to higher excesses or lower ransomware cover. An insurer may exclude a claim where a required safeguard was absent.
Ask about vulnerability scans, incident plans and staff awareness tools. Record backup restoration tests. Do not merely confirm that backups exist.
MTD and AI create risks beyond a normal data breach. MTD links can hold tax data and credentials across a small number of cloud platforms. One compromised administrator account can disrupt filings, payroll and client contact.
AI can make impersonation more convincing. It can create realistic email threads, cloned voices and tailored requests. These may appear to come from a partner or client.
A cloud outage can create operational delay and fraud risk. Staff may turn to manual workarounds. Check forensic costs, breach response and dependent business interruption cover.
Check whether cover applies when key suppliers become unavailable. Check whether the waiting period fits filing deadlines and peak-season work. Choose bespoke cover if those deadlines cannot tolerate 8 to 24 hours offline.
This comparison matters less if your firm holds no client data digitally. It also matters less if you do not depend on online systems or payments. It does not replace reading the full policy wording, getting tailored insurance advice, or seeking legal advice after an incident.
Before requesting quotations, list each cloud supplier and payment process. Include your highest realistic fraud loss. This gives insurers the facts needed for a useful comparison.
What people ask
Do accountants need cyber insurance?
Yes, cyber insurance is worth considering if accountants hold digital client data. It also helps where they rely on cloud systems or payment instructions. PII may not fund ransomware response, forensic work or an 8 to 24-hour outage.
Is cyber cover the same as professional indemnity?
No, PII addresses claims linked to professional work. Cyber cover can pay breach response, data recovery and cyber extortion. One incident can involve both policies, but neither replaces the other.
Are cyber add-ons enough for small firms?
Sometimes, if the add-on covers your data, outage and fraud risks. Its limits must be workable. It is unlikely to suit firms where social engineering fraud is excluded or capped below normal payment amounts.
How much cyber insurance does an accountancy firm need?
The amount should cover response, downtime, data recovery, legal help and the highest realistic fraud loss. Start by estimating the cost of a 2 to 4 week disruption. Then compare each sub-limit, not turnover alone.
Which option fits your practice?
Choose standard cover if your firm has limited payment authority and few key cloud suppliers. It can be a sensible choice when each fraud and outage sub-limit matches your realistic loss. Check the wording before you buy.
Choose bespoke cover if you process payroll, hold client money or rely on several cloud systems. It is also the stronger choice where one fraudulent payment could harm the practice. The extra cost is justified when standard limits leave a clear gap.
Neither option fits well if the insurer will not cover your real payment route. In that case, change the controls, ask for different terms or seek tailored advice. A policy that excludes your main risk is not protection.
The right choice is the one that pays for your most credible bad day. For many accountancy firms with payment authority, that points to bespoke cover.
