Quick answer
Set up roles by grouping staff by what they need to see and do, give each role the fewest permissions required, require multi-factor authentication for every user and review access whenever someone joins, changes role or leaves. Keep admin rights to a small number of named people.
Written by Waqas Sagar ACA FCCA, Founder of Accotax and Remindoo · Last updated · 5 min read · Part of Security and setup guides
Why access control matters
Roles and permissions for accounting firms protect sensitive personal and financial data. Too much access increases the damage from a mistake or a compromised account.
Common set-up mistakes
Giving everyone admin rights to save time, sharing logins and leaving leavers' accounts active are the most common problems.
Step by step
List your roles, such as partner, manager, senior, junior and admin. For each, decide what they can view, edit and delete, including fees and reports.
Turn on multi-factor authentication for every user. Limit admin rights to two or three named people.
Review access at least annually and when anyone joins, moves or leaves. Record the review.
| Role | Client data | Fees and reports | Settings |
|---|---|---|---|
| Partner | All | All | Yes |
| Manager | Team clients | Team | No |
| Senior | Assigned | No | No |
| Junior | Assigned | No | No |
Setting up the rest of the system
Use settings, custom fields, data tokens and categories so the system matches how your firm works. Consistent categories make filters and reports meaningful.
How Remindoo solves this
Remindoo supports multi-factor authentication and detailed roles and permissions. Flexible settings, custom fields, data tokens and categories let you shape the system to your firm.
- Multi-Factor Authentication
- Roles & Permissions
- Flexible Settings
- Custom Fields & Data Tokens
- Categories
Frequently asked questions
What is multi-factor authentication?
MFA asks for a second proof of identity, such as a code from an app, as well as a password. It makes stolen passwords much less useful to an attacker.
How many admins should a firm have?
As few as practical, usually two or three named people, so there is cover without spreading powerful access widely.
Should juniors see fee information?
Many firms restrict fee and profitability data to managers and partners. Decide based on your culture and set permissions to match.
What should happen when someone leaves?
Remove or disable their access on their last day, reassign their work and review what they could access.
