Industries: accounting and finance

IT support for accountants and finance firms in New Zealand

An accounting or finance practice holds its clients’ financial records, tax positions and identity documents, and it answers to the AML/CFT Act, the Financial Markets Authority and the Privacy Act 2020 for how they are handled. The busiest weeks of the tax year are when the systems have to hold. We run the IT, the security controls and the documentation for practices of 20 to 200 staff, so the team can work on client files and the partners can show the firm’s obligations are met.

Book the 15-Minute Founder Call

Or call 0800 242 206

The IT problems a growing practice runs into

A practice that adds partners, takes on a second office or moves its clients to a new platform is not only facing a technology problem. It is a client data problem, a compliance problem and a deadline problem at the same time, and the deadlines do not move. If any of the following sounds familiar, this page is for you:

Your systems pick the week before a filing deadline to fail, and your current provider takes a day to respond.
Client records live in more places than your privacy statement says they do, including personal email and staff laptops.
Your AML/CFT customer due diligence records are held in a shared folder that half the office can edit.
Your cyber insurance questionnaire was answered from memory, and you would struggle to prove the answers.
An accountant left last month, and you are still not sure their access to Xero and the client portal has been cleanly revoked.

These are the problems we solve. The assessment further down this page is where we start.

What working with OxygenIT looks like

Managed IT and helpdesk

Monitoring, patching and a New Zealand team that answers your support line, 0800 101 095, in under 11 seconds on average during staffed hours. No call centre and no ticket black hole. We respond to P1 critical issues within 15 minutes during New Zealand business hours, and that target does not change in March or at the end of a GST period. The full response and resolution targets are on the published SLA. After-hours cover is a paid add-on delivered by our team in the United Kingdom, and early morning before 8.00am is uncovered.

Cyber security

The six controls insurers ask about: multi-factor authentication, endpoint detection and response, patch management, email security, DNS filtering and tested backups. Set up as the default for every login and every device, including the partners’ laptops. A virtual Chief Security Officer report sets out where the practice stands and what to fix first. See cyber security services.

Microsoft 365 and cloud

Setup, migration, backup and disaster recovery for the platforms the practice runs on, with secure file sharing and a client portal in place of email attachments, and client records kept where your privacy statement says they are.

Accounting software support

We support MYOB and Xero, and we work with the other platforms New Zealand accounting and finance practices use day to day. Supporting the software your practice runs on is part of the helpdesk, not a separate engagement, so there is one number to call when a client file will not open.

Staff onboarding and offboarding

A single device standard, with each new staff member’s laptop imaged, secured and ready before their first day, and a documented offboarding step that revokes access to every client system the day someone leaves.

Strategy when you need it

Fractional virtual CIO and virtual CSO input for practices that need a technology roadmap and a security owner, not only a helpdesk. See managed IT services.

The AML/CFT Act, the FMA and the Privacy Act 2020

Accounting and finance practices are regulated on several fronts at once. The Anti-Money Laundering and Countering Financing of Terrorism Act 2009 has applied to accountants since 2018, with customer due diligence, record-keeping and reporting obligations. Firms that give financial advice answer to the Financial Markets Authority. The Privacy Act 2020 applies to everyone. Three of those obligations land directly on your IT:

Storage and security. Client financial records and identity documents must be protected against loss, unauthorised access, use, modification or disclosure. In practice that is multi-factor authentication on every login, encrypted devices, tested backups and an audit trail of who accessed what.
Records and retention. AML/CFT customer due diligence records and the working papers behind a return must be kept for the periods the rules set, and be retrievable when a regulator or a client asks. You have to know every system they live in.
Breach notification. The Privacy Act 2020 requires a privacy breach likely to cause serious harm to be notified to the Office of the Privacy Commissioner and the people affected. Every practice we support has a documented breach response plan, not only a backup.

We are an IT provider, not a compliance adviser. We build and document the controls the rules expect. Your partners and your compliance officer decide what the practice’s obligations are.

The cyber security and compliance risk assessment

If you saw your practice in the list at the top of this page, the assessment is the starting point. We take your actual cyber insurance policy wording and your AML/CFT and privacy obligations, and we check your practice against them, control by control. It is not a sales call with a checklist stapled to it.

What gets checked

The security controls your insurance questionnaire says you have, verified against what is actually configured.
Client data access and the audit trail that proves it.
Multi-factor authentication coverage across every staff login, including the partners.
Backup status, and whether those backups have actually been tested.
Patching, email security, DNS filtering and endpoint protection.
Where client records, identity documents and AML/CFT records live, and who can reach them.

What you get

A plain English report: compliant, at risk or non-compliant, control by control.
A prioritised fix list, so you know what to do first and what can wait.
Documentation you can put in front of your insurer at renewal and your auditor at review.

The assessment stands on its own. If your current provider has everything in order, you will have documented proof of it. If not, you will know exactly what to raise with them. The price is published on the cyber security audit cost guide.

Fully managed or co-managed

No two practices are the same, and the service is shaped to fit. A boutique practice with no IT staff and a mid-sized firm with an internal IT person need different things from us.

Fully managed IT. We take the whole environment: monitoring, patching, the helpdesk, security, backups and the roadmap. Priced in four bands by team size, and the band price is the price.
Co-managed IT. Your internal IT person keeps the roadmap and the relationship with the partners. We take the patching, the helpdesk overflow, the after-hours cover and the specialist security work. See co-managed IT services.
Security on its own. Regular audits, continuous threat detection and a named virtual Chief Security Officer, alongside the IT provider you already have.

Why accounting and finance practices choose OxygenIT

Published response targets. We respond to P1 critical issues within 15 minutes during New Zealand business hours, with a 2 hour resolution target. The targets are in the contract and reported on monthly.
A certified security practice. Independently certified to ISO/IEC 27001:2022 for information security and ISO/IEC 42001:2023 for AI management (as at May 2026), audited annually. The same controls we advise on, applied to ourselves.
A New Zealand team. Engineers in Auckland, Wellington and Christchurch, supporting practices across the country since 2005. Most work is delivered remotely, with on-site work where it is needed.
Clients who stay. 98% client retention rate (Canterbury clients, 2022 to 2025).
Sized for 20 to 200 staff. From a boutique practice to a multi-office firm. The managed IT bands are priced by team size, and every price is on the pricing page.

Other industries we publish a page for are on the industries hub.

Accounting and finance IT support, common questions

What makes IT support for accountants different from general IT support?

The data and the deadlines. An accounting practice holds client financial records and identity documents under the AML/CFT Act and the Privacy Act 2020, runs on MYOB, Xero and a client portal, and cannot lose a day in the week before a filing deadline. Our IT helpdesk is built around those three facts.

How does OxygenIT help accounting firms meet compliance requirements?

With a cyber security and compliance risk assessment, IT compliance support, and the documentation an insurer, an auditor or the FMA asks for. We build and document the controls. Your compliance officer decides what the practice’s obligations are.

What cyber security measures does an accounting firm need?

At minimum, multi-factor authentication on every login, device encryption, email protection, tested backups and staff security training, because invoice fraud and payment redirection start with an email. A managed SOC adds continuous threat monitoring for practices that want it.

Can OxygenIT work alongside our in-house IT person?

Yes. Co-managed IT sits alongside your internal team. They keep the roadmap and the strategic projects. We take the patching, the helpdesk overflow, the after-hours cover and the specialist security work.

How quickly are IT issues resolved during tax season?

The targets are the same in every month. We respond to P1 critical issues within 15 minutes during New Zealand business hours, with a 2 hour resolution target, and the support line, 0800 101 095, is answered in under 11 seconds on average. After-hours cover is a paid add-on delivered by our team in the United Kingdom.

How is OxygenIT different from other IT companies?

We publish our numbers. Support calls on 0800 101 095 answered in under 11 seconds on average, a response to P1 critical issues within 15 minutes during New Zealand business hours, a 98% client retention rate (Canterbury clients, 2022 to 2025), and ISO/IEC 27001:2022 and ISO/IEC 42001:2023 certification (as at May 2026), audited independently every year. Few New Zealand providers publish even one of those.

Fifteen minutes with the founder

Tim Clarkson founded OxygenIT in 2005. The first call is 15 minutes, with him, to work out whether we are the right fit for your practice. Bring your insurance questionnaire and the question that worries you most. If we are not the right fit, he will say so.