Your accountant set you up with QuickBooks Online. They walked you through the chart of accounts, hooked up your bank feed, and showed you how to invoice. Great. Here's what they probably didn't mention — the IT side that protects you when something goes wrong.
Most of these are 5–10 minute tasks. All of them are free or near-free. Together, they're the difference between "QuickBooks works" and "QuickBooks works AND someone can't drain your account if they phish your bookkeeper."
The 10-item IT checklist
- Multi-factor authentication on the QuickBooks Online primary admin account. Settings → Security → Two-step verification. Use an authenticator app, not SMS. The QuickBooks Online account has full access to your books, your bank feeds, your payroll. Treat it like a banking app.
- MFA on the email address used as your QuickBooks login. Almost as important as MFA on QuickBooks itself. If someone owns your email, they can reset your QuickBooks password.
- A separate "primary admin" account from daily-use bookkeeping accounts. The primary admin (usually the owner) shouldn't be reconciling daily. Create a separate Standard User or Accountant role for whoever actually does the books. Keep the primary admin login locked away — used only for company-level changes.
- An accountant invitation, not a shared password. QuickBooks has a free Accountant role. Use it. Never give your accountant or bookkeeper your primary login — invite them as Accountant Users. When they leave, you revoke access in two clicks instead of changing every password they ever knew.
- User permissions sized to actual job. Bookkeeper doesn't need to manage users. Sales rep doesn't need to see payroll. QuickBooks has Custom roles in Plus/Advanced — use them. Time spent here once saves you from a "wait, why did the receptionist export my entire chart of accounts?" moment later.
- Audit log review on a calendar. Once a quarter, look at the audit log (Settings → Audit log). It shows every change made and by whom. Most small businesses never look at this. The 10 minutes it takes is the cheapest fraud-detection control you can buy.
- Connected apps audit, twice a year. Settings → Apps → Connected. Every app integrated with QuickBooks has data access. Half the apps small businesses connect get used twice and forgotten. Disconnect anything you're not actively using.
- Backup exports — yes, even though it's "in the cloud." QuickBooks Online doesn't give you a one-click full backup, but you can export reports and lists. Once a quarter, export Profit & Loss, Balance Sheet, Trial Balance, Customer/Vendor lists, and Chart of Accounts to a folder you back up. If your QuickBooks subscription ever lapses or your account gets compromised, you have data.
- Bank-feed validation. QuickBooks bank feeds occasionally drop, double-post, or miss transactions. Reconcile monthly, not quarterly. Catching a bank-feed issue at 30 days is annoying; catching it at 90 days is hours of cleanup.
- 1099 contractor records collected on day 1, not in January. Not strictly an "IT" task, but it lives in QuickBooks. Get a W-9 before you cut the first check, save it in QuickBooks, and you'll thank yourself when 1099 season comes.
Common QuickBooks-related small-business breaches
The pattern is consistent enough we can name it. It usually goes:
- Owner uses the same password for QuickBooks and a personal account that gets breached
- Attacker logs into QuickBooks, doesn't change anything visible
- Attacker creates a new "vendor" with the same name as a real one but a different bank account
- Bookkeeper pays an invoice without verifying the bank details against the master vendor record
- Wire goes to the attacker; takes 30+ days to spot in reconciliation
Items 1, 5, and 6 above stop this entire chain. MFA blocks the initial login. Limited permissions stop the bookkeeper from creating vendors without admin review. Audit log review catches the new vendor in week one.
If you only do three things: turn on MFA (#1 + #2), invite your accountant properly (#4), and look at the audit log once this month (#6). That's 30 minutes. It's also more than 90% of small businesses bother with.
QuickBooks Desktop users
If you're still on QuickBooks Desktop instead of Online, the IT picture is different — your file lives on a workstation or server, not in the cloud. The big questions become: where is the file, who has access to that machine, is it backed up, is it encrypted, and what happens if the workstation dies during tax season. Most of those answers are "do you have an IT person" and right now you're reading our website, so we'd start there.