Professional services
Keeping client documents accessible to the right people
Decide where the current documents belong and who should be able to use them. Then check permissions and external sharing against that decision.
A colleague is away and a client needs the latest document. Someone can find a copy in an email, another version is on a laptop and the shared folder contains three files labelled “final.”
For a professional services firm, document access has to support the work while protecting client confidentiality. People need to find the right version, understand who can use it and share it without creating unnecessary exposure.
Choose the working location and name its owner
Agree where current client documents belong. Make that location part of the normal workflow so staff are not forced to reconstruct a file from personal inboxes when someone is absent.
Assign a business owner who understands the engagement and can approve access. IT can configure permissions, but it needs a decision about who should be able to read, edit or share the material.
Agree on folder names and where each kind of document belongs. Where the system supports version history, teach people how to use it rather than creating an endless series of separately named copies.
Base access on the work people do
A person working on one engagement may not need every client file. An administrator may need billing documents without needing confidential working papers. Discuss those distinctions when setting up access groups.
The Office of the Privacy Commissioner of Canada's safeguards guidance recommends limiting access to sensitive personal information on a need-to-know basis. Consider the information involved and confirm the requirements applicable to your practice.
Test the intended permissions with representative accounts, including someone who should not have access. A folder name such as “Confidential” does not establish that its permissions are restricted.
Make external sharing a deliberate step
Before sharing, confirm the recipient, the document and whether they need to view or edit it. Use the firm's approved sharing method and prefer access restricted to identified recipients where appropriate. Check what the actual link allows; a copied link may have different permissions than the sender expects.
If an outside adviser needs one report for a short engagement, share that report through the approved process. They may not need the rest of the client workspace. Agree when access should end.
A restricted link cannot undo a copy someone has already downloaded. Keep that limitation in mind when choosing what to share and which controls the engagement requires.
Plan for absences and staff changes
Ensure an authorized colleague can continue important work without using another person's credentials. Keep document ownership and administrative recovery arrangements from depending on one individual.
Review access when people join an engagement, change roles or leave. Include guests and outside advisers. Client closure should also trigger a decision about ongoing access and retention, based on the firm's obligations and agreed policies.
Try one client-file review
Choose an engagement and trace a document from creation to external sharing. Confirm its working location, owner, access list and current version. Ask whether a colleague could continue the work during an absence.
Record gaps and assign the changes. Use the findings to improve access on that engagement, then review the next set of files.
Make client-file access work for your team
We review document storage, permissions and external sharing with your firm. Tell us where access is getting in the way or causing concern.