Hi KatieLee
This is good stuff and just the logical summary needed for the argument to pushed back onto MYOB.
However, there is a slight spoiler to your argument that MYOB will exploit - a big online only accounting software provider does not any ability to back up your data, recover your data, restore your data or do anything that suggests that some sort of back up has been done for businesses using it and their clients (assuming an accounting business has both MYOB and competitor software user clients) - this becomes a huge problem.
We are fully ISO accredited 27001, DOC2, and numerous other ISO accreditation and we use this competing software, (though we are not an accounting firm) but a cloud hosting business specialising in medical practices, but not exclusively.
There seems to be a grey area where, if a back up is not available ( either you don't use this software) or it is risk factor to be managed in the assessment.
The Doc