Making your accountant meet your sign-in rules
How a non-profit's own two-factor and IP allowlist rules apply to its accounting firm's people, how to set their access level, and how to review it.
By Achekam · · 4 min read · For Non-profit businesses in South Africa, Nigeria, Kenya
A non-profit's books hold more than numbers. The donor ledger names the people who give and how much. Payroll shows what every staff member earns, and sometimes their medical aid, garnishee orders or loans. Grant files record which communities a programme serves. A board that has worked hard to tighten its own staff's access, with two-factor sign-in and access limited to the office network, can be uneasy when it learns that a whole accounting firm will be working in the same books.
The good news is that your rules do not stop at your own staff. In Achekam, the people from your accounting firm meet the same sign-in rules as everyone else when they open your books. This article explains how that works, how to choose what the firm can do once it is in, and the short review that keeps access tidy.
Why donor and payroll records deserve tighter access
Every organisation has a duty to protect the personal information it holds about donors, staff and beneficiaries. For a non-profit, a leak is not only a legal and financial problem; it damages the trust that brings in donations in the first place. A donor who reads about their gift in the wrong place is unlikely to give again.
In South Africa, the Information Regulator's page on the Protection of Personal Information Act covers registering Information Officers and their duties, along with its guidance notes and forms. Whoever holds that role in your organisation should be part of the conversation about who can open your books, and Nigerian and Kenyan organisations should involve whoever is responsible for data protection in the same way.
Practical risks to guard against:
- a firm's staff member signing in from a shared or public computer;
- a password reused from another service and leaked elsewhere;
- a staff member who has left the firm but still has a working login;
- broad access granted "for convenience" and never narrowed.
Your IP allowlist and two-factor rules apply to the firm's people too
When a member of an accounting firm opens a business's books in Achekam, they must meet that business's own IP allowlist and two-factor rules. Your rules travel with your books, not with the person.
That has two consequences worth knowing:
- If you require two-factor sign-in, the firm's people must use it to open your books, whatever their own firm requires of them elsewhere.
- If you limit access to listed network addresses, the firm's people can only open your books from addresses on your list. Talk to the firm before you switch this on, so their office addresses are included and nobody is locked out at month end.
Agree in writing how the firm will work: from its office network, on its own managed devices, with named staff.
Choosing the access level you grant the firm
You appoint your accounting firm in Achekam by the firm's Achekam address or firm code, in a role such as accountant, auditor, tax practitioner, payroll provider or adviser, and with an access level. The firm then accepts or declines.
The access level decides what the firm's people can do:
| Access level | What it covers | Suits |
|---|---|---|
| Bookkeeping | The accounting, but not your users, settings or payment gateways | A firm that captures, reconciles and posts monthly |
| Review | Read-only | An adviser or a reviewer who only needs to look |
Bookkeeping access is a useful boundary for a non-profit. The firm can do the accounting work you are paying for, while your own administrator keeps control of who has a login, the organisation's settings and the gateways donations come through. Give each firm the narrowest level that lets it do its job, and raise it only for a specific task.
Ending the appointment if the rules are not met
Rules only work if there is a consequence. Either side can end the appointment in Achekam; the firm then loses access, and the books stay with your organisation.
That gives the board a straightforward remedy. If a firm will not work within your sign-in rules, or a breach occurs on its side, you can end the appointment without losing a single record. Nothing needs to be exported or returned. If you are moving to a new firm, changing accountants: your books stay with you explains the handover.
A quarterly review of who can open your books
Set a recurring item on the finance committee's agenda. Each quarter, check:
- which firms are appointed, in which roles and at which access levels;
- whether each appointment is still needed, for example an auditor whose audit is finished;
- that two-factor sign-in is still required, and the IP allowlist still reflects the addresses in use;
- your own staff list, removing anyone who has left;
- with the firm, which of its staff work on your books, and confirmation that leavers have been removed on their side.
A review, in words
At its quarterly meeting, a children's charity's finance committee looks at the appointments in its books. The accounting firm holds bookkeeping access; the auditors, appointed for last year's audit, still have review access. The audit is signed, so the treasurer ends the auditors' appointment. The firm confirms one of its juniors has left, and the committee notes that the firm removed her on its side. The minutes record the review.
A first step
Confirm with your administrator that two-factor sign-in is required and, if you use one, that the IP allowlist is current. Then look at each firm's access level and narrow any that are broader than the work requires. If your firm set up your books for you, when your accountant sets up your books covers what changes when you take them over, and if your auditor is not on Achekam, see when your auditor is not on Achekam.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
