Depending on how your company uses QuickBooks or other accounting software, it may contain:

This means access to QuickBooks can provide someone with a detailed look inside the financial condition and inner workings of your business. It may also give the person the ability to change that financial history.

For example, imagine that your bank account was reconciled correctly at the end of June. Later, someone edits or deletes a transaction dated in June without understanding what and how the change will affect past tax filings, registers, and reports.

Your current bank balance may still look reasonable, but the beginning balance on the next reconciliation may no longer match. Your financial reports may change, and the person preparing your tax return may receive numbers that are different from the reports you originally reviewed. The mistake may be fixable. However, finding the mistake and correcting it could take hours and cost a lot of money.

This is why user permissions should be treated and become a big part of the company’s internal control system.

QuickBooks Online currently distinguishes between the Primary Admin, Company Admins, and several other user roles. Primary and company administrators generally have broad access to your QuickBooks account, including important administrative functions. However, only the Primary Admin can perform certain ownership level actions, such as transferring the Primary Admin role.

Administrative access should generally be reserved for users who need to control the system settings, not simply people who need to work inside the account ledgers.

Administrators include users such as:

Even if the user has a role such as these, an important question should be asked:

Does this user need permanent administrative access, or do they only need it temporarily?

A bookkeeper helping with routine transactions may not need the ability to add users, change company settings, modify the chart of accounts, or control other high level functions.

QuickBooks describes its “Standard All Access” role as having significant bookkeeping authority. Among other things, that role may be able to reconcile accounts, create journal entries, manage the chart of accounts, categorize bank-feed transactions, and view reports. That is considerably more authority than basic data entry. QuickBooks’ user-role guide

A title such as “Standard User” may sound limited. As we’ll see, the underlying permissions matter more than the title.

One of the more useful approaches is to begin with the user’s intended responsibilities instead of beginning with QuickBooks’ list of roles.

These are not universal recommendations, because the correct permissions will depend on the user’s responsibilities, the QuickBooks subscription, and the internal controls already in place.

QuickBooks Online Advanced and Intuit Enterprise Suite offer more customizable roles than some lower tier plans. Businesses using those products may be able to control access to areas such as banking, expenses, sales, payroll, budgets, inventory, and reports more precisely. QuickBooks custom-role guidance

Before granting access, ask yourself:

The goal is to provide enough access for the user to perform the job without giving them unrelated authority.

This is commonly called the Principle of Least Privilege. It means a user of the account receives the minimum level of access needed to perform an assigned task. The Cybersecurity and Infrastructure Security Agency recommends applying this principle so that accounts only have the permissions necessary for their responsibilities. CISA security guidance

User permissions are useful, but they are not a complete internal control system.

Consider an employee who can create a vendor, enter a bill, approve the bill, and process the payment. Even if every individual action is part of that employee’s job, combining all four powers may create unnecessary risk.

When possible, separate important financial responsibilities in order to circumvent mistakes and even fraud from happening.

For example:

Small businesses may not have enough employees to divide every responsibility. In that situation, the owner can act as the reviewing control by examining all bank activity or at a certain level, new vendors, unusual payments, journal entries, and monthly financial reports.

The IRS’s examination guidance specifically identifies a lack of separation of duties as a weakness in internal controls. IRS Internal Revenue Manual

This does not mean every small company needs to act like the financial department of a large corporation. It means no one person should have unchecked control over every step of a sensitive transaction when a reasonable review process should be created.

What should you do if you see an unexpected transaction change?

You should start with the audit log.

QuickBooks’ audit log can show the date of a change, the user associated with it, and certain original transaction details. According to Intuit, the audit history remains available for two years. QuickBooks audit-log instructions

The audit log may help answer questions such as:

The audit log is useful, but it is mostly an after it happened type control. In other words, It helps identify what happened after whatever happened occurred.

Proper permissions are preventive controls. Not on my watch, so to speak. They may reduce the likelihood that an unauthorized or accidental change happens in the first place.

You should have them both, you’ll need them.

After bank accounts have been reconciled and a financial period has been reviewed, the company should close or lock the books through a specified date.

QuickBooks Online allows an administrator to establish a closing date. The company can choose to display a warning when someone attempts to change an earlier transaction or require a password before the change is permitted. QuickBooks closing-date instructions

This matters because historical transactions affect historical reports and past tax filings.

Suppose you filed a tax return using financial reports generated from the company’s books. If someone later changes transactions from that tax year, the current QuickBooks reports may no longer match the reports used to prepare the return.

That does not automatically mean the tax return is incorrect. It does mean the difference may have to be investigated and documented. If you so happen to have to explain it to the IRS.

Closing the books cannot prevent every problem, particularly if too many people know the closing-date password. However, it creates a useful checkpoint and makes casual changes to completed periods less likely.

One of the easiest permission mistakes to make is leaving access active after the user is no longer with the company.

Former employees, temporary contractors, software consultants, and outside bookkeepers may remain listed as users long after their work is finished.

Businesses should consider reviewing users access:

QuickBooks allows administrators to edit roles or remove users. Although deleting a user is permanent, the user’s historical activity can still appear in the audit log. QuickBooks user-management instructions

The business should also require each person to use an individual account. Sharing one login may appear convenient, but it weakens accountability because the audit trail may no longer clearly identify who performed an action.

Multi factor authentication adds another layer of protection if a password is stolen or compromised. Responsibility is the key.  Even strong authentication cannot correct an overly broad permission assignment. Security helps confirm who entered the system; permissions determine what that person can do after entering.

You can begin improving access controls without redesigning your entire accounting system.

1. List every active user.
Identify employees, owners, accountants, contractors, and former service providers who currently have access.

2. Write down each user’s actual job.
Do not rely solely on the user’s title. Identify the transactions and information the person really needs.

3. Compare the job with the assigned permissions.
Look for access that is unrelated to the person’s responsibilities.

4. Review the audit log and closing-date settings.
Pay special attention to changes affecting reconciled or previously reported periods.

5. Establish a recurring review.
Revisit permissions quarterly and whenever someone’s employment or responsibilities change.

The safest QuickBooks file is not necessarily the one with the fewest users.

A business owner who refuses to delegate anything may slow down invoicing, bookkeeping, collections, and financial reporting. The owner may become so overwhelmed that important work is delayed.

At the same time, giving every user administrative access is not delegation. It is a dangerous practice of removing financial boundaries.

The objective should be balance.

Your employees and advisers should have enough access to complete their responsibilities. However, they should not automatically receive the power to change areas of the books that have nothing to do with their work.

You probably would not give every employee the keys to every door in your building simply because they work for the company, would you?

Your financial system deserves the same protections.

When all is said and done, before you invite the next person into your QuickBooks account, do not ask only whether you trust them.

Ask whether the permissions match the job.

That small decision today could help prevent a much larger financial problem tomorrow.

If you're unsure whether your QuickBooks user permissions have been set up correctly, or you'd like your messy books to be more organized so tax season becomes less stressful, I'd be happy to help. At The Smith Advisory LLC, we focus on two things:

One, we turn messy accounting processes into repeatable systems that save time and improve profitability.

Two, we configure and manage AI-assisted financial systems that allow businesses to serve more clients while reducing taxes and bottlenecks on their accounting systems such as QuickBooks Online, ProConnect Tax, Excel, and Google Sheets.

The result is building accurate financials through repeatable processes which help clients understand their financial numbers, so they can make the best financial decisions. The Smith Advisory LLC at [email protected]. A conversation today may help you avoid an unnecessary tax bill tomorrow.

This article is for general educational and informational purposes only. It is not individualized accounting, tax, legal, cybersecurity, or financial advice. QuickBooks features and user roles may vary by product, subscription, configuration, and future software updates. Consult the appropriate professional about your company’s specific circumstances.