Your workspace
Inviting someone from outside
Accountants, auditors and advisers: what to give them and what not to.
Sooner or later someone outside needs to see something: the accountants, an auditor, a lawyer, a one-off collaborator. The temptation is to make them an administrator so they stop asking; it is also the costliest mistake.
What to give them, by role
| Who | What they need | What they do NOT need |
|---|---|---|
| Accountants or advisers | Read access to their scope, and downloads | Creating processes, deleting, seeing other clients |
| Auditor | Read access limited to the audited scope | Anything more, and only for a limited time |
| Lawyer | The specific case for the matter | The rest of the organisation |
| One-off collaborator | The team or project they work on | Organisation settings |
Three rules
- Never administrator. An outsider must not be able to change your permissions or settings.
- Scoped to their part, not everything. "Read-only" across the whole organisation is still too much.
- With an end date. When the engagement finishes, access goes that day, not when someone remembers.
Important
If you hold documentation for clients who compete with each other, a badly scoped external access is not an internal slip: it is a third party's information seen by someone they never authorised.
Worth knowing
Scoped read access usually beats emailing the documents: it leaves no loose copies and it records what was looked at and when.
Watch out
Review external accesses once a quarter. They are the most forgotten because they are not part of your team and nobody misses them.
›Can I grant access for a few days only?
Yes, and it is recommended for audits.
›Does an external user consume anything?
Viewing and downloading do not consume.
›Do they know I am watching?
Their accesses are logged like anyone else's; it is not surveillance, it is the same treatment.
A real case
The situation
A company gives its accountants administrator access to avoid emailing documents.
What you do
- Changes it to read access scoped to tax matters
- Reviews external accesses each quarter
What you get
The accountants work exactly as before and can no longer change the company's configuration.
The situation
Somebody who only had to provide one paper is invited as a user.
What you do
- Sends them a link instead of an invitation
What you get
No licence is consumed for a one-off contribution.
The situation
An external party needs to see several files for months.
What you do
- Grants limited access to what they need
What you get
They work without seeing the rest.
The situation
The external party finishes and their access stays active.
What you do
- Revokes access on completion
What you get
Access reflects who is collaborating today.
The situation
Nobody knows which external parties have access.
What you do
- Checks the list of external access
What you get
The picture exists without asking.
The situation
An external party asks for more access than they need.
What you do
- Grants the minimum for their task
What you get
The scope matches the work.
This article answers
- give my accountant access
- invite an external auditor
- temporary access for a collaborator
- share with someone outside the company