Keep Client Financials Out of Personal Storage

Staff sometimes save client payroll and pending transactions on personal drives, personal email, or home computers. After you read this, you can set a clear rule and check whether people already follow it.

What personal storage looks like

It includes a USB stick in a bag and a mailbox the company does not own. It also includes a home computer that still holds payroll files after hours.

People often mean well when they copy those files to finish work after hours. During busy weeks a partner may finish a return at the kitchen table, and a bookkeeper may forward a payroll file to a personal phone. A new hire may copy last year's workpapers to a private drive because the shared folder felt slow.

None of that makes the files safer for the client, and you cannot collect those copies when that person resigns. Here are common places client financials hide outside company control.

• Personal cloud. Copies live in a private Dropbox, Google Drive, or iCloud account.
• Portable drives. USB sticks and external disks travel in bags and cars.
• Phone photos. Pictures of checks or screenshots of pending transactions stay on a personal camera roll.

Why the owner has to decide

If you do not set a rule, each person will invent one. Some will keep everything on firm systems because that is how they were taught. Others will mix personal and company copies because it feels faster during busy season.

The risk is not only a lost stick or a stolen bag. Client payroll shows pay rates, bank account numbers, and Social Security numbers. Pending transactions show cash that has not posted yet, so a leak can confuse a client and a bank at the same time.

You can disable a company account on the last day. You cannot reach a personal mailbox or a drive in a kitchen drawer.

A written rule also protects honest staff who want to do the right thing. People should not have to guess whether a home laptop is allowed, and they should not feel they must break a vague custom to meet a deadline. Owners in accounting and CPA firms face this storage choice in tax season and at month end.

What a controlled system means

A firm-controlled system is one the company can see, lock, and take back. Company Microsoft 365, which is the paid Microsoft work suite, can hold mail and shared libraries if an admin owns the tenant. A tenant is the company Microsoft account that an admin manages for work.

Control means more than a shared password on a sticky note. It means a departing person loses those files on the last day because access ends with employment. If you are unsure which applications actually hold client work, an applications assessment is further reading on building that inventory. If you are unsure who can sign in as an admin, a Microsoft 365 tenant review is further reading on admin rights and sign-in.

Checks you can run this week

You do not need to buy a new product to start this review. You need a list of people, a list of systems, and a few honest conversations. Run these checks with your office manager or a trusted senior.

1. Ask each person where last week's payroll files live right now.
2. Ask where pending transactions sit while they wait for a client reply.
3. Look for personal email forwards of client spreadsheets in the company sent folder.
4. List every cloud account people use for work, including unpaid personal ones.

Then gather a short pack of facts before you write the rule.

• People. Write the names of everyone who touches client payroll or unposted work.
• Places. Write every system they named, including personal email and private cloud.
• Access. Note who can add or remove people on each company system.
• Leavers. Note whether any recent departure still holds copies at home.
• Clients. Note which clients would be harmed first if a file walked out.

Talk with staff about existing copies

Start from the client duty rather than from blame, because most people copied files to meet a deadline. If you open with blame, they will hide the rest of the copies. Ask where the files are, and then help move them onto firm systems.

Use these questions so you learn where copies still sit before you set the move date.

• Home files. Ask whether any payroll workbook still sits on a computer at home.
• Private mail. Ask whether any client still sends documents to a personal address.
• Family access. Ask whether anyone else in the house can open those same files.
• Old sticks. Ask whether a USB stick from last season still holds client work.

Offer to sit with someone while they copy payroll folders into the company library and delete the personal copy. Ask before you watch a deletion, because trust matters more than a surprise search.

Do not demand a home computer inspection as your first move. Ask for a written list of places and a date when those places will be empty. Follow up on that date, and if copies remain, treat it as a rule issue.

Partners need the same rule as bookkeepers and new hires. A partner who keeps client returns on a personal laptop teaches everyone else to do the same. Write the rule once and apply it to every person who touches client files. If a client already received a file from a personal address, note that fact.

Write a rule people can follow

A useful rule is short and literal so people can act on it. It should say where client payroll and pending transactions may live. It should say where they may not live, and what to do with copies that already exist.

Ban personal email, personal cloud, USB sticks, and phone photos for client files. Tell people how to finish after-hours work without taking a copy home.

Give a date to move existing copies back into company systems. Do not leave old personal copies in place because they feel convenient. After that date, a personal copy is a breach of the rule, even if the person meant well.

Explain what happens when someone leaves the practice so there is no guesswork. Company access ends on the last day, and the person must confirm that personal devices no longer hold client files. Put that confirmation in the exit notes so it is not a hallway promise.

Train the rule in the same words you wrote on the page. Repeat those words in staff meetings when busy season starts. A one-page note that names the allowed systems will help, because people can follow a named place.

During busy season, offer a real path for remote work. If the only way to finish a return is a home laptop with a USB stick, people will use the stick. Give them a company account they can sign into from home, or keep the work on company systems until they are back at work.

Key takeaways

• Treat personal email, personal cloud, USB sticks, and phone photos as off limits for client files.
• Ask people where the files live now, then set a date to move the copies.
• Partners and staff follow the same rule, including on the last day of work.
• Write the allowed places in one short note people can keep.

Keep the rule short, name the systems, and follow up on the date you set. Third Shift Group LLC prepared this for owners who must decide where client financials live. The next step is the staff conversation and the move of existing copies.