Backing up client bookkeeping files means keeping encrypted copies of statements, converted exports, workpapers and books in at least two places apart from the working copy, one of them offline. Back up daily during the working week and again after each month-end close. Then prove the copies work with a restore test every quarter.
What should backing up client bookkeeping files include?
A backup of client bookkeeping files should hold everything you would need to rebuild a client's month if your laptop and cloud account vanished today: source statements, converted exports, workpapers, engagement letters, and an export of the books themselves. The practice's own records, such as the access list and security plan, belong in it too.
It is easy to back up the obvious folder and miss the rest. Work through a client's month and list every file it produces. For a typical client the list looks like this:
- Source documents. Bank and card statements, loan statements, receipts the client sent.
- Converted files. The CSV or accounting imports produced from each statement.
- Workpapers. Reconciliation reports, review notes, adjusting entry support.
- Books exports. A periodic export of the client's general ledger and trial balance from the accounting software.
- Client correspondence. Answers to your questions, which explain why an entry was coded as it was.
- Practice records. Engagement letters, client contact list, access list, security plan.
The correspondence is the item most often left out, and it is the one you cannot recreate. A note from the client explaining that a deposit was money the owner put in is what justifies the entry described in recording owner contributions to a business. Lose the note and you lose the reason.
Password vaults need their own thought. A backup is useless if the passwords to open it are only inside the system that failed. The guide to setting up a password manager for a bookkeeping practice covers emergency access, so the vault itself can be recovered.
How often to back up client bookkeeping files
Back up client files at least once each working day, so a bad day costs at most one day's work. Add an extra copy after each month-end close, when a client's month is finished and signed off. That month-end copy is the one you keep longest, because it captures the books as you handed them over.
The table below is an example schedule for a small practice. Adjust it to your volume.
| What | How often | Where the copy goes | How long to keep it |
|---|---|---|---|
| Working folders for all clients | Daily, automatic | Cloud backup service | 30 days of daily versions |
| Closed month, per client | After each month-end close | Cloud backup plus offline drive | Per the practice retention policy |
| Books export, per client | Monthly, after close | Cloud backup plus offline drive | Per the practice retention policy |
| Practice records | Weekly | Cloud backup plus offline drive | Current plus previous versions |
| Full offline copy | Monthly | Encrypted drive kept off site | Rotate two drives |
The FTC's cybersecurity guidance for small businesses advises updating software and backing up files regularly, saving copies in the cloud or on an external hard drive. Automatic daily backups meet that without anyone having to remember.
Keep versions, not just the latest copy. If a file is damaged or encrypted on Tuesday and the backup runs Tuesday night, a backup that keeps only the newest copy now holds the damaged file. Thirty days of versions lets you step back to Monday.
Where backup copies of client bookkeeping files should live
Keep at least three copies of client files: the working copy, a cloud backup and an offline copy, on at least two kinds of storage, with one copy away from the office. This is the familiar 3-2-1 pattern. The offline copy matters most, because ransomware and stolen logins can reach anything that stays connected.
The CISA ransomware guide recommends maintaining offline, encrypted backups of critical data and testing them regularly. It notes that ransomware often goes after backups it can reach. For a small practice, "offline" can be as simple as an encrypted external drive that is plugged in once a month for the full copy, then unplugged and stored somewhere else.
A workable layout for one to five people:
- Working copy: practice cloud storage or the office computer, where staff do the work.
- Cloud backup: a backup service separate from the working storage, under a different login, with versioning on.
- Offline copy: two encrypted external drives rotated monthly, one always off site.
Separate logins are the detail that makes this work. If the same email and password open both the working storage and the backup, one phished password reaches both. Protect the backup account with its own strong password and multi-factor sign-in, as set out in the guide to two factor authentication for bookkeepers.
Is cloud accounting software already a backup of client books?
Cloud accounting software is not a backup of client books in the sense a practice needs. The vendor protects its own systems against hardware failure, but it will faithfully keep a bad change, a deleted transaction or a client's decision to cancel the subscription. Your own periodic export is the copy you control.
Think about the ways books are lost in practice, and most are not server failures:
- A staff member deletes a batch of transactions by mistake, and the deletion syncs everywhere.
- A client closes their subscription or removes your access, and the file goes with it.
- An import is run twice and nobody notices for weeks.
- A former bookkeeper's login is used to change records.
In each case, the vendor's copy faithfully reflects the problem. A monthly export of the general ledger and trial balance, saved with the closed month, gives you a fixed point to compare against.
The same goes for statement tools. AutoBankConvert lets you choose how long originals are kept after export, which means its storage is a working area with a retention setting, not an archive. Keep the statements and exports your retention policy requires in your own backed-up folders.
A restore test for client bookkeeping backups
A restore test means taking a real backup, restoring it to a separate place, and checking that the files open and match what you expected. It is the only proof a backup works. Run one each quarter, choosing a different client and month each time, and write down the result.
Here is an example test, using a made-up client:
- Pick the target. Example: Example Bakery LLC, March 2026, closed on April 6.
- Restore to a test folder. Never over the working copy. Use a separate folder or a spare computer.
- Check the statements. Confirm the March statement PDFs for each account are there and open.
- Check the exports. Open the converted file for the checking account and confirm the closing balance matches the statement.
- Check the workpapers. Open the March reconciliation and the client's emailed answers.
- Check the books export. Open the trial balance export and compare two account balances with the live books for March 31.
- Time it. Note how long the restore took from start to usable files.
- Record the result. Date, client, month, pass or fail, time taken, and anything missing.
- Clean up. Delete the test folder once you are done, so a second copy of client data does not linger.
The time in step 7 is easy to skip and worth having. If restoring one client's month takes two hours, restoring forty clients after a disaster takes most of a week. Knowing that number shapes how you plan the first days of an incident.
A failed test is a good outcome, as long as you find it now. Common failures are a folder left out of the backup selection, an offline drive whose password nobody can find, or a backup service that stopped running months ago without warning.
Backup habits that expose client bookkeeping files
A backup is one more full copy of every client's data, so a careless backup can leak more than any single laptop. The common mistakes are unencrypted drives, backups under a personal account, copies kept forever, and backups that staff who left can still open.
Watch for these:
- Unencrypted external drives. A lost drive with plain files exposes every client at once. Encrypt every backup drive.
- Personal cloud accounts. A backup in someone's personal storage leaves with them. Use an account the practice owns.
- No retention limit. Backups kept forever hold statements long past the date the practice policy says to delete them.
- Old access. A former staff member who still knows the backup password has a copy of everything.
- Backups in the same place as the original. An external drive left plugged into the office computer goes in the same fire, flood or ransomware attack.
Your duty of confidentiality covers backup copies exactly as it covers working files. The guide to client confidentiality in bookkeeping explains where that duty comes from and what clients can expect. A backup that is encrypted, owned by the practice, limited in age and tested every quarter keeps that promise.
Fewer stray copies make backups simpler. When statement conversion happens inside one tool rather than across downloads folders, the backup only has to capture the statements and exports you choose to keep. AutoBankConvert converts client statements in batches and exports files per client, ready to save into the folders your backup already covers.