Showing a filed document has not changed
How an advice practice can show a filed client document is the file it received, using SHA-256 fingerprints, versions and signing certificates.
By Achekam · · 4 min read · For Financial services businesses in South Africa, Nigeria, Kenya
A client says the signed form you hold is not the one they signed. A reviewer asks whether the bank statement on file is what the client sent or a copy someone tidied up. A complaint turns on what a record of advice said on the day it was given. Each time the question is the same: can you show that the document in your file is the document you received?
Advisers seldom think about this until someone asks. By then, the answer depends on decisions made when the file was first stored, which is why it is worth understanding now.
Why an unaltered record matters in advice work
Advice work runs on two kinds of document: those the client supplies, such as identity documents, statements and payslips, and those the client signs, such as mandates and records of advice. In a dispute, a complaint or a review of your files, their value rests on being able to say they have not changed since they came in.
"It has been in our system the whole time" is a weak answer. "Here is how anyone can tell it has not changed" is a strong one. In South Africa, section 16 of the Electronic Communications and Transactions Act sets out when keeping a record electronically satisfies a legal duty to retain information, including requirements on accessibility, integrity and origin.
What a file fingerprint is
A SHA-256 fingerprint is a long value calculated from the exact contents of a file. Two properties make it useful:
- the same file always produces the same fingerprint;
- any change to the file, even a single character, produces a completely different fingerprint.
So a fingerprint taken when a file arrived, compared with one taken later from the file you hold, tells you whether the contents are identical. Fingerprints can be calculated with standard tools on any ordinary computer, which means a third party can check a match without relying on your word or on any particular software.
The fingerprint every stored file gets
In Achekam's Document Centre, every stored file gets a SHA-256 fingerprint when it is stored. That gives each document a reference point fixed at the moment it entered the practice's store.
The habit that goes with it is to store client documents as soon as they arrive, in the form they arrived. A file that sat in someone's downloads folder for a week, or was opened and re-saved in the meantime, gets a fingerprint that dates from when it was stored, not from when the client sent it. If you want your own independent record as well, calculate the fingerprint with a standard tool when the document comes in and note it on the client's file.
Versions instead of overwrites
Documents change for legitimate reasons: the client sends an updated statement, a draft plan is revised. Document Centre keeps earlier versions when a new one is uploaded, so the original is not overwritten. The version the client first sent is still there beside the later one.
That is the behaviour you want for evidence. Never "fix" a client-supplied document and upload it in place of the original. If something needs annotating, add a separate note or a new version, and leave the received file exactly as it was.
Malware checks and refused file types
Two checks apply to every upload. Executable files are refused by default, so programs posing as documents are kept out. And every upload is checked for malware: with ClamAV where the server is configured for it, and otherwise with a built-in heuristic check. Your administrator can tell you which applies to your workspace.
Signed documents and their certificate
Documents signed electronically through Achekam carry a second record. When everyone has signed, Achekam produces the signed PDF together with a completion certificate listing each signer's e-mail address, the times, the IP address and browser used, and the document's fingerprint. Both are filed in the client's Signed documents folder.
That certificate is what you produce if a client later questions a signed record of advice or mandate. It ties the signatures to one specific document, identified by its fingerprint, and it was created at the time of signing rather than assembled afterwards. Any document can be sent this way, whether an uploaded PDF, one composed from text blocks, or a saved template.
Sharing without losing control of copies
When a document must go outside the practice, to the client, a product provider or a reviewer, share it from the store instead of attaching it to an e-mail. Achekam sends a personal link with an expiry, an optional one-time code and a choice about whether downloading is allowed, and the share can be revoked. Fewer loose copies means fewer arguments about which copy is the real one.
A filing routine for client documents
- Store client documents in Document Centre on the day they arrive, unaltered.
- Never replace a received document; add a new version or a separate note.
- Send documents that need signatures through e-signing, so the certificate is filed with them.
- Share with outsiders by link rather than attachment.
- When a signed document is challenged, start from its completion certificate.
- When any other document is challenged, compare its fingerprint with the one noted when it arrived.
The same idea, that a record once settled should stay settled, applies to your books: see locking a month once its figures are reported. If an accountant or reviewer is going to rely on your files, giving your accountant review-only access explains how to let them look without letting them change anything.
Begin with new clients: store what they send on the day it arrives and leave it untouched. The fingerprint does the rest.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
