Requiring two-factor sign-in for staff and advisers
How an advice practice turns on two-factor sign-in, requires it for every member, and makes its outside accountant's people meet the same rule.
By Achekam · · 4 min read · For Financial services businesses in South Africa, Nigeria, Kenya
An advice practice's books hold more than its own figures. Client names sit on invoices, fee arrangements reveal who has money invested where, and payroll holds staff ID numbers and bank details. All of it sits behind a sign-in screen, and most sign-in screens are protected by nothing more than a password someone chose in a hurry.
Passwords leak. They are reused on other websites, typed into convincing fake login pages, and written on sticky notes beside the reception computer. Two-factor sign-in means a stolen password is no longer enough on its own. This article covers turning it on in Achekam, making it compulsory, and extending the rule to the accounting firm that works in your books.
Why passwords alone are not enough
With two-factor sign-in, a person proves who they are with something they know, the password, and something they have, a code from an app on their phone that changes every few seconds. Someone who has stolen the password but not the phone cannot get in.
For a financial practice, the cost of a break-in is not only the information itself. In South Africa, the Information Regulator's step-by-step guide to reporting a security compromise shows what notifying the Regulator of a data breach under section 22 of POPIA involves through its eServices portal. Nigeria's Data Protection Commission and Kenya's Office of the Data Protection Commissioner have their own breach rules. Avoiding the breach is far cheaper than reporting one.
Turning on an authenticator app
Each user can turn on two-factor sign-in for their own account with an authenticator app. The setting is under Settings, Security & SSO.
Start with yourself and whoever administers the workspace. Then ask each colleague to turn it on, at their desk, with someone available to help. The first set-up takes a few minutes: install an authenticator app, scan the code shown on screen, and enter the first code the app produces to confirm it works.
Encourage people to use an authenticator app on a phone they always carry, rather than a shared office tablet. The point is that the second factor belongs to one person.
Requiring it for everyone in the workspace
Once the team has had a chance to set it up, make it compulsory: the workspace can require two-factor sign-in for all members. After that, nobody signs in with a password alone.
Give a date in advance, so the requirement does not catch someone out on the morning a client is waiting. Check with each person the day before that their app works.
Single sign-on with Google or Microsoft
If your practice already runs its e-mail on Google Workspace or Microsoft 365, members can sign in with Google or Microsoft Entra ID once the workspace has set up single sign-on. People then use the same account, and the same second factor, that protects their e-mail.
Single sign-on has a practical advantage when someone leaves: closing their Google or Microsoft account closes off that route into Achekam too. Still remove them from Achekam itself, as described below, so access does not depend on one system alone.
Your rules apply to your accountant's people
An outside accounting firm gets into your books only when you appoint it, by its Achekam address or firm code, as accountant, auditor, tax practitioner, payroll provider or adviser, with an access level, and the firm accepts or declines. Bookkeeping access covers the accounting but not your users, settings or payment gateways, and review access is read-only.
Here is the part that is easy to miss: a firm member opening your books must meet your own IP allowlist and two-factor rules. Your security settings travel with your books, not with the firm's. If you require two-factor sign-in, the junior bookkeeper at your accounting firm must use it too when they open your ledger, whatever their own firm's policy is.
People at your accounting firm often work across many clients' books. They switch books from the header, and a coloured bar shows whose books are open, which helps them see at a glance whose ledger they are in. Your two-factor rule adds a second safeguard: only people who meet your rules get in at all.
Lost phones and staff who leave
Two situations need a plan before they happen.
A lost or replaced phone. Decide now who a colleague contacts if they lose the phone with their authenticator app, and how you will confirm it is really them before their access is restored. A request by e-mail from a new address is exactly what an attacker would send.
Someone leaves. An administrator can suspend, reactivate or remove a member, and can invite new colleagues by e-mailed link with a role. Remove a departing member on their last day. If the person who leaves is your contact at the accounting firm, tell the firm; if you change firms, either side can end the appointment, the firm loses access, and the books stay with you.
A short checklist for this week:
- Turn on two-factor sign-in for yourself and your administrator.
- Help each colleague set it up, then require it for all members.
- Consider single sign-on if you use Google or Microsoft for e-mail.
- Tell your accounting firm that your rules apply to its people.
- Write down what happens when a phone is lost or someone leaves.
To limit what your accountant can change once they are in, see giving your accountant review-only access, and for splitting who does what inside the practice, read separating duties in a small advice practice.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
