Your auditor usually needs to see the accounts, but should not be able to change anything. You solve this by inviting the auditor as a Member and adding them to an access group that only has read permissions.
For more about roles and access groups in general, see Access control and user permissions in Catacloud.
Why not just give the auditor the Accountant role?
The Accountant role gives almost as broad access as Administrator – including Administration. A Member without an access group gets broad default access to all business modules. Neither is read-only access. Only when the member is placed in an access group does the group decide exactly what they can see and do.
1. Invite the auditor as a Member
Go to Administration → User access → Members.
Click Invite person, enter the auditor's email address and select the role Member.
The auditor appears with the status Invited until they log in for the first time.
2. Create an access group with read permissions only
Go to Administration → User access → Permissions and click New access group.
On the General tab, give the group a name, for example Auditor. Leave the All permissions toggle off.
Then go to the Access tab. Click Show all … sub permissions under the module and turn on only the sub permissions that give insight. Don't turn on the toggle for the whole module – that also gives the group permission to make changes.
These sub permissions cover what an auditor usually needs:
Accounting: Open and read vouchers, See accounting reports, See and export VAT-returns
Bank: Read bank accounts, transactions and balances, See bank statements and transactions, Read bank payments
Customers: Read customers, See customer balance reports
Suppliers: Read suppliers, See supplier balance reports
If the auditor needs more, there is also Read attestations under Approvals and See and export budgets under Budget.
The module shows Partial access when only some of its sub permissions are on – that is correct for an auditor group.
Rule of thumb: sub permissions that start with See, Read or Open and read only give insight. One exception should stay off: Read and bill invoice basis data under Invoice lets the user invoice. Also leave Import and export data under Administration off – it lets the user import.
3. Add the auditor to the group
On the Members tab, tick the auditor and click Create group. If you add the auditor to a group that already exists, the button is called Save changes. You can also drag the member card from the member overview into the group.
The auditor is missing something
If the auditor can see a module but cannot open what they need, a read sub permission is almost always missing. Example: the auditor sees the voucher list but cannot open the vouchers – turn on Open and read vouchers. Changes to the group apply immediately to everyone in it.
When the audit is done
Remove the auditor from the access group, or remove the membership under Administration → User access → Members. You can keep the group for next year.
When should you contact us?
You manage access yourself as an administrator. Contact us if the auditor still cannot see what they need after you have checked the sub permissions. Include the client, the auditor's email and what the auditor is trying to open – a screenshot helps.