How to back up your accounting data, and test the backup

We make AcboBooks, one of the products discussed here.

Why this matters more on desktop

With cloud accounting the vendor makes the backups. With desktop software the books are a file on your computer, and the only backups are the ones you make. A failed disk, a stolen laptop, ransomware or a coffee spill can take years of records with it. It is the main trade-off of keeping your own books (see desktop vs cloud), and it is easy to get right.

The 3-2-1 rule

CISA, the US Cybersecurity and Infrastructure Security Agency, calls the 3-2-1 rule a trusted guideline:

• 3 copies of important files: the working file plus two backups,
• on 2 different types of storage, for example an external drive and a cloud storage service,
• with 1 copy off-site, away from your office.

CISA also recommends being able to roll back at least seven days, so keep several dated copies rather than one that is overwritten every night. Ransomware or a bad edit is often noticed days later, and by then last night's backup may be just as damaged.

A simple plan

For a small business, this is enough:

1. Every day you work: let the program make a copy on the same computer. In AcboBooks, turn on Automatically back up each time this company closes in Company Settings. It keeps the last five copies in a Backups folder beside the file. This protects against mistakes, not against losing the computer.
2. Every week: use Back Up Company File to save a dated copy to an external drive, and unplug the drive afterwards so ransomware on the PC cannot reach it.
3. Every month, after you close the books: put a copy off-site. A cloud storage folder works, or a second drive kept at home.
4. Every year-end: keep a permanent copy of the closed year, plus PDF and Excel exports of the trial balance, general ledger and financial statements.

An AcboBooks company file is encrypted with your file password, and backups made with Back Up Company File are encrypted copies too, so a copy in cloud storage or on a lost drive cannot be read without the password. Each backup carries the small .recovery file used with your recovery key. There is also Export Encrypted Backup, which wraps a copy in a separate password of your choosing; that password cannot be recovered, so write it down. If no backup has been made for seven days, AcboBooks shows a reminder.

How long to keep backups

Your backups and exports are part of your business records, so keep them at least as long as the tax authorities expect:

Sources: the IRS page "How long should I keep records?" and the CRA page on where to keep your records and for how long. Canadian records must generally be kept in Canada unless the CRA gives permission otherwise, which is worth knowing before you choose where your off-site copy lives. Lenders, insurers and your own accountant may want longer. Keeping every year-end copy for seven years covers most small businesses.

Keep the software too. A backup is only useful if a program can open it. AcboBooks keeps working after the updates period, so an old company file stays readable.

Test the restore

A backup you have never restored is a hope, not a backup. CISA advises testing so you can restore both fully and partially. Once a quarter, and after any change to your setup:

1. Take the newest backup from the external drive or cloud storage, not the copy on the PC.
2. Open it, ideally on a different computer. In AcboBooks a backup is a complete company file: close the company and use Open an existing company. Never restore over the file you are working in.
3. Enter the file password, or the recovery key if you are testing that too.
4. Run the trial balance as of the last month-end and compare it with the report you saved then. Run Check Data.
5. Open a recent invoice and a recent paycheque to confirm the latest work is there.
6. Close the test copy and write down the date you tested.

If any step fails, you have found the problem on a quiet afternoon instead of the day the disk dies. The security page lists what AcboBooks does for you; the month-end checklist is a good place to add the off-site copy.