Outsourcing your finance and accounting work gives your business time to focus on critical activities, access skilled resources, scale up operations during peak demand, and improve overall business efficiency.
But it also carries the risk of leaks or misuse of clients’ or the business’s financial information.
In this blog, let’s answer the 5 critical questions for any business that has outsourcing in mind, and how SBS cater to your data privacy needs.
1. How safe is my data?
At SBS, our data protection framework combines policy, ownership and practical analysis of where personal information lives.
Our framework includes:
- A data protection policy, breach response plan and privacy policy that management and staff are expected to follow.
A Data Protection Officer who oversees data protection across SBSL and is the point of contact for privacy matters.
- Alignment with the Australian Privacy Principles and the DPDP Act, 2023.
We keep clients’ personal data secure and follow data flow diagrams, privacy impact analyses, and risk registers.
2. What if a data breach happens? How quickly can you act?
We have streamlined security and incident monitoring in place in case of any data breach.
SBSL runs a formal security incident management system and a breach management process. Each event is logged, classified by severity, assigned an owner, contained, investigated and closed with corrective actions.
Our security incident and breach management lifecycle starts with promptly detecting the breach, classifying it, containing it, eradicating the cause, notifying the customer, and ends with a root cause review, corrective actions, and an update to the risk register and, where relevant, to training.
3. How about the audits? Do external auditors audit your processes?
At SBS, our own auditors and external auditors repeatedly test the controls.
- The internal ISO audits are performed at half-yearly intervals, and they test whether the controls operate as documented, which helps in early gap identification.
- The third-party international certification audit is a yearly audit, where an independent certification body assesses SBSL against ISO/IEC 27001:2022.
- Yearly BCP tests confirm whether the site and city outage recovery meets RTO and RPO.
- Business impact analysis review keeps recovery objectives aligned to business criticality.
- Security awareness assessment is performed yearly, alongside mandatory training, plus phishing simulations.
- Risk register review is done on a regular basis to keep risks, owners and mitigation actions current.
- By agreement. SBSL welcomes customer due diligence and audit requests.
4. Apart from cybersecurity, how is our data safeguarded physically?
SBSL delivery centres operate from premises where the company holds legal rights to do business under a registered lease agreement. The facilities are securely enclosed, and physical security is designed so that a person must pass several independent checks before getting anywhere near customer information.
- There are 4 access zones, each controlled by an approval matrix so that only authorised people can enter each area.
- Dual authentication at all entry points, using biometrics and an access card.
- 24×7 security personnel and closed-circuit cameras.
- Video recorded continuously across all areas except the cafeteria and personal comfort rooms, with recordings archived for 30 days.
5. How safe is access to customer systems and data transfers?
Many engagements require SBSL staff to work inside customer systems, whether those are hosted in the customer’s network, in a public environment or in the cloud. SBSL’s model is designed so that credentials and data never rest with individuals.
Our secure tunnels, hidden credentials, location control, restricted email transfer, and customer-approved internet are key to how we safely access client systems and transfer data.
Outsourcing finance and accounting is not simply about how and where the work gets done. It is also about how information is accessed, protected, monitored and managed throughout its lifecycle.
The right outsourcing partner should be able to give you clear answers before you hand over your first client data.
Sign up for our newsletter
Add your email to receive our monthly newsletter.
