Give an outside adviser access

Auditors, outside counsel and corporate service providers often need to see part of the group's records for an engagement: the audit firm for the year-end, the law firm for a transaction. External Access in Administration is where you give that access across several entities at once, and where you review everyone outside the organisation who can reach its data.

Two questions decide the grant. How much personal data does the engagement need? And when does the engagement end? An auditor rarely needs directors' home addresses, and access that outlives the engagement is access nobody is watching.

Grant access

1. In Administration, open External Access and choose Grant access in bulk. The page lists everyone outside who already has access, by person, with the level each grant gives and when it expires.

   

2. Enter the adviser's Email, then search the register under Entities and tick each entity they need. The line beneath the list names what you have picked.

   

3. Choose a level under Sensitivity. The Permissions below show what it gives, area by area, and you can change any of them.

   The engagement	What to choose
   Outside counsel preparing filings who needs to change records	Full access
   Needs to see everything, including personal data	Full view
   Needs to see everything except personal data, such as an auditor	Redacted
   Needs the entity record only	Limited

4. Set Expires (optional) to the end of the engagement. Tick Include group companies when you are sharing a parent and want the adviser to reach the companies it controls as well, including subsidiaries recorded later.

5. Choose Grant access to the number of entities you picked. The adviser receives one invitation email for the set.

   

Review and revoke

1. Read the list by person, or switch to By level, By entity or By data room. The tile Expiring in 30 days filters the list to access that lapses soon.

2. To change or end one grant, open its actions menu at the end of the row.

   

3. Choose Edit access to change the level or expiry, or Revoke to end it. When revoking, add a reason in Reason (optional); it stays on the grant and cannot be edited later. Access ends on the adviser's next request.

   

To end everything one person holds, choose Revoke all beside their name. Data room memberships are separate and are not affected.

Tips from practice

• Set an expiry on every grant to an outside firm. The Expiring in 30 days tile then becomes the reminder to extend or let it lapse.
• Choose Redacted for auditors unless the engagement needs personal data. It is easier to widen a grant than to explain why it was wider than needed.
• Give the reason when you revoke ("engagement ended"). Months later it answers the question of why their access stopped.
• If your firm gives the same level often, save it as a preset with New preset under Your presets on Roles & Permissions.

Related: Create a role for a team for people inside the organisation, and Give directors access automatically.