External Bookkeeping requires access to documents, account allocation information, master data and authorised system areas. Access will be viable if roles, the scope of data and responsibilities are clearly defined prior to authorisation.
In many companies, security vulnerabilities arise due to overly broad permissions, shared user accounts, or multiple transmission paths. A documented approval links the specific task requirement with appropriate controls.
A robust security model leads from role clarification through the permission matrix to regular rights reviews and the managed revocation of access.
Role determination depends on actual performance and decision-making powers. The controller determines the purposes and essential means of the processing. A processor processes personal data on behalf of and on documented instructions.
This functional perspective is particularly important for outsourced bookkeeping. Depending on the mandate, the scope of services can range from strictly instruction-bound processing to activities involving independent professional decision-making authority. Therefore, each service is assigned to its actual workflow.
The scope of work sets out which tasks the service provider will undertake, which decisions remain with the company, and which systems or data areas are affected. The contract title provides the framework. The practical allocation of tasks provides the decisive classification.
When processing data on behalf of a controller, the company chooses a service provider with sufficient guarantees regarding appropriate technical and organisational measures. The processing is specified by an agreement pursuant to Article 28 GDPR.
For operational implementation, each access authorisation requires a designated internal role. Depending on the organisation, this responsibility may lie with senior management, the commercial management team, Bookkeeping, IT or the data protection officer. It is essential that the roles of review, approval and subsequent monitoring are clearly defined.
Six steps to safety clearanceClarify roles, define data requirements, assign authorisations, approve data transfer channels, verify supporting documentation, and organise monitoring and the revocation of rights.
The General Data Protection Regulation (GDPR) principle combines the processing of personal data with data minimisation, integrity and confidentiality. For accounting data, this means that each role is granted the scope of data and the rights it requires to carry out its specific task.
A specialist appointed to manage the ongoing Bookkeeping typically requires different data to someone with approval responsibilities or a system administrator. The matrix therefore begins with tasks and data areas, followed by technical rights.
A real-life example illustrates the effect: a clerk requires incoming invoices, posting texts and account allocation information. Payment authorisation remains the responsibility of an internal role. This separation minimises the scope of authorisations and makes responsibilities clear.
Read permissionsAllow access to shared data areas and documents.
Processing rightsPermit recording, modification or assignment within the agreed scope of tasks.
Authorisation rightsAssign technical or payment-related decisions to a named role.
Administrator rightsManage accounts, role profiles and system settings that require a higher level of security.
The completed matrix contains person or role, system, data area, authorisation type, business purpose, approving body, setup date and review date. Every subsequent change can thereby be traced back to a specific trigger.
Article 32 GDPR requires a level of security appropriate to the risk. The assessment takes into account, amongst other things, the state of the art, the cost of implementation, the nature and scope of the processing, and the potential consequences for the data subjects.
A authorised transmission channel safeguards confidentiality and integrity during transmission. This includes unambiguous authentication, a clearly defined group of recipients, a secure connection, traceable storage locations and a regulated procedure for handling transmission errors.
The protection requirement increases when extensive personal data, banking information, employee data or far-reaching system access are affected. The chosen measure corresponds to the specific risk and the system used.
The approval specifies the permitted channel, the roles involved, the authentication, the filing location and the escalation path. This creates a binding standard for the ongoing accounting process.
The technical architecture of portals, exports, imports and interfaces is discussed in the article on digital document workflows and interfaces explained in more detail. The security criteria for the relevant data path are decisive for authorisation.
release criterionA data path is considered viable if the need for protection, the recipients, authentication, transmission, storage and the response to discrepancies are all documented together.
The Federal Office for Information Security (BSI) describes identity and access management as a combination of unique identification, authentication, the granting of rights, monitoring and revocation. A clear set-up process can be derived from this for outsourced accounting.
Each user is assigned their own user account. This ensures that activities, permissions and changes are linked to a specific individual. Shared accounts obscure this link and make it more difficult to apply targeted restrictions.
The rights profile is documented and cross-checked against the authorisation matrix. The combination of a personal account and a role-based profile supports transparent access control.
Multi-factor authentication provides an additional layer of protection for sensitive or far-reaching online access. Its specific implementation depends on the risk, system and organisational security policy.
The security audit links contract documents, service specifications and security documentation with the specific access decision. The scope depends on the role, types of data, system access and protection requirements.
In data processing on behalf of a controller, the data processing agreement pursuant to Article 28 GDPR governs, among other things, the subject matter and duration, nature and purpose, types of data, categories of data subjects, as well as the rights and obligations of the controller. In addition, there are specifications regarding instructions, confidentiality, security, assistance, subcontractors, and the handling of data after the end of the services.
The description of the technical and organisational measures is subsequently related to the actual performance. A general document only acquires a reliable audit value through its assignment to systems, data paths, user accounts and controls.
The audit covers contact persons for technical queries, access management, data protection and security incidents. In the case of subcontractors used, their role, share of services and intended data processing are included in the approval.
The security check is being carried out in Project plan and onboarding anchored as a binding milestone prior to activation. The article further explores the ongoing role and coordination logic in Collaboration with external accounting.
Access management only ends with the revocation of access. Between setup and termination lie regular reviews, ad-hoc adjustments and the evaluation of relevant logs.
The review cycle is determined by the protection requirement and the scope of the access rights. In addition, changes of duties, changes of personnel, new systems, modified services and security events trigger an immediate audit.
The audit compares current task requirements with user accounts, role profiles and approved data areas. Discrepancies are assigned a person responsible and a deadline for adjustment.
Upon the departure of an individual, a change of task or the end of the cooperation, access is blocked, role profiles are removed and remaining permissions are reviewed. The documentation shows who initiated, implemented and confirmed the revocation.
For security incidents, the company needs a short escalation path: secure access, inform the responsible departments, isolate affected systems and data areas, document measures and reassess approval after clarification.
Authorisation arises from several interrelated decisions. A single contract or technical measure only partially covers the entire access lifecycle. The following matrix connects the inspection area, decision, evidence and responsible role.
| test bench | Concrete decision | Required proof | Responsible role | Status |
|---|---|---|---|---|
| Rolls | Who determines the purposes and essential means? | Role and Performance Description | Management or data protection | open, fulfilled, to be revised |
| Data volume | What data does every task require? | Data and task list | Department | open, fulfilled, to be revised |
| Permissions | Who is allowed to read, edit, approve or administer? | Permissions matrix | Business department and IT | open, fulfilled, to be revised |
| User accounts | How is each actor uniquely assigned? | User and account list | IT or system administration | open, fulfilled, to be revised |
| Transfer | Which data path is approved for the protection requirement? | Description of the transmission path | IT or Data Protection | open, fulfilled, to be revised |
| Test documentation | What agreements and measures are in place? | contract and measure documentation | Management or data protection | open, fulfilled, to be revised |
| Control | When are rights checked and adjusted? | Inspection and modification process | named internal role | open, fulfilled, to be revised |
| Termination | How are rights and access revoked? | offboarding rule and completion certificate | IT and the business | open, fulfilled, to be revised |
Three possible decisionsApproval when roles, rights and controls are fully clarified. Remediation for clearly defined gaps. Rejection in the event of unclear decision-making powers, far-reaching access or insufficient protective measures.
Data protection in accounting outsourcing is made visible in everyday work through specific responsibilities. Role definition, data minimisation, an authorisation matrix, approved transmission channels and a complete access lifecycle together form the foundation.
The security clearance has a different purpose to the general Process of accounting outsourcing. It answers whether an already specified access model is viable for the launch and which points need to be added prior to activation.
A cleanly documented result makes ongoing monitoring easier. Every subsequent change receives a reason, a responsible role and a traceable conclusion.
Brasser Accounting Solutions GmbH is a specialised accounting service provider that supports companies with financial accounting, payroll accounting, and the structuring of modern digital accounting processes. The aim is a collaboration that is professionally sound, organisationally relieving, and reliably functional in everyday use.
Brasser Accounting Solutions GmbH is part of a corporate group with Quint GmbH Tax Consultancy & Auditing and the Swedish accounting and tax firm Service Place Årjäng AB.
