Giving your accountant access safely

Three kinds of accountant, three kinds of access

Why not just share the owner login?

• You cannot tell who made an entry or deletion, you or the accountant.
• The accountant can change settings, add users or delete data you did not intend them to.
• When you part ways, you must change the password everywhere it was reused.
• If the accountant's device is compromised, your owner access goes with it.

Good accountants prefer their own login too; it protects them as much as you.

Sending data copies vs live access

Many businesses still send the CA a copy of the data at month end or year end. That is simple and limits access to a moment in time, but it has drawbacks: the copy goes out of date immediately, adjustments made by the CA on their copy must be carried back to yours, and data files travel by email or pen drive. If you send copies, send them through a secure channel, keep a note of what was sent and when, and agree that the CA's adjustments come back as a list of journal entries for you to post or approve.

Live access through separate logins avoids the back-and-forth but needs proper roles. The guide to user roles explains how to set them.

Agree the rules in writing

A short written understanding avoids most disputes:

• Which periods the accountant may edit, and which are locked (for example, months whose GST returns are filed).
• Whether they may create new ledgers and parties, or must ask.
• Whether they may delete entries, and if so, with a recorded reason.
• How year-end adjustments are communicated before they are posted.
• Confidentiality of your customer, supplier and rate data.

Review their work without micromanaging

Once a month, look at entries made or changed by the accountant: especially deletions, entries in earlier months, new supplier ledgers and changes to opening balances. Most of it will be routine. Unusual items, such as a payment to a new supplier just created, are worth a question. The guide to preparing for a meeting with your CA lists what to bring to these reviews.

A sample month with a visiting accountant

Consider a trader with ₹3 crore turnover who uses a visiting accountant twice a month. A workable setup: the billing clerk enters sales and receipts daily with a staff login; the visiting accountant has an accountant login and, on each visit, enters purchases and expenses, reconciles the bank, and checks the billing clerk's entries. Before the GSTR-1 due date, the accountant prepares the return data and the owner reviews the summary. Once the return is filed, that month is treated as closed, and any change after that needs the owner's approval and a recorded reason. At year end, the CA receives read access, sends a list of adjustments such as depreciation and provisions, and the accountant posts them. Everyone works in their own login, and every change can be traced.

Ending the engagement cleanly

1. Remove the accountant's login on the last day.
2. Ask for any data copies they hold to be returned or deleted, in writing.
3. Collect working papers for returns filed on your behalf: computations, challans, acknowledgements.
4. Change any shared passwords they knew, such as the GST portal or email, if those were shared.
5. Hand over to the new accountant through their own fresh login.

Accountant access with Tally and Cashflow OS

Inside TallyPrime, you can create separate users with different security levels, so your accountant does not need the administrator password; ask whoever manages your Tally to set this up. In Cashflow OS, you can invite your accountant by link with the accountant role for a specific company. They see the synced ledgers, reports and GST views on the web, and can create vouchers only if the owner has switched on writing into Tally for that company. The owner can see the team's activity and remove access at any time. See the page for chartered accountants.