Access control

What it means

Access control decides who can reach which systems and data and what they may do there. The base rule is least privilege: everyone has exactly the rights their work requires.

Identity belongs to a person, not to a shared account. A shared login makes it impossible to say who did what, and with it the audit log stops being evidence.

Access control has two parts that are often confused: authentication, meaning whether the person logging in really is who they claim, and authorisation, meaning what they may do once inside. Neither a strong password nor single sign-on stops a bookkeeper from seeing the director’s salary - that is a matter of how roles are set, not of how people log in.

How it works in practice

In the accounting function three circles are separated: who enters documents, who approves payments and who confirms them at the bank. That separation is the core of internal control in a small company.

Access rights are documented and reviewed every six months. When someone leaves they are revoked on the last day as part of offboarding, not at the next convenient moment.

When we take over the books we agree with the client which access we genuinely need: online banking usually read-only for statements, and electronic filing with the Financial Administration under a power of attorney with our own login, not the director’s password. When the engagement ends, everything is revoked in one step without changing any passwords in the company.

What to watch out for

Three gaps recur: a live account for a former employee, a shared banking password, and an external supplier’s access nobody ever removed. Access to personal data must also be demonstrable under GDPR and protected with two-factor authentication.

The second risk is privilege creep: someone moves from invoicing to purchasing, gets new rights and keeps the old ones. After a few years one employee can both set up a new supplier and approve its payment, and segregation of duties exists only on paper. After a fraud it is hard to explain why the internal policies did not catch it.