Sharing records with an accountant should make review easier without creating a second, uncontrolled copy of every sensitive document.

The safest workflow gives the accountant access only to the right Business, the right records and the right period. It also leaves a clear record of what was shared and when access ended.

Agree on the scope first

Before sending anything, ask the accountant what they need, for which Business and reporting period, and in what format. A focused request is safer and faster than exporting an entire account.

Confirm:

• the legal or operating name of the Business;
• the exact month, quarter or year;
• the requested reports and supporting documents;
• whether the accountant needs view-only access or must add review notes;
• the deadline and secure delivery method.

When an owner runs more than one Business, never combine their records merely because the same person owns them. The CRA says separate records should be kept for each business.

Prefer controlled access over email attachments

Where possible, invite the accountant to a Business-scoped workspace with the minimum permission required. That is easier to revoke and audit than a folder link or long email chain.

Use accountant-ready records to keep review activity connected to the correct Business. If a file must be exported, use a protected transfer method, confirm the recipient and remove access when the work is complete.

Do not send passwords, one-time codes, card details or login credentials. An accountant should use their own identity.

Apply need-to-know access

The Office of the Privacy Commissioner of Canada says personal information should be protected according to its sensitivity and access should be limited on a need-to-know basis. Financial records often contain customer, supplier and employee information, so share only what is relevant.

Before sharing, remove or mask information that is not needed for the engagement. Check especially for:

• personal addresses and phone numbers;
• complete banking or card information;
• unrelated customer receipts;
• identity documents;
• credentials or authentication codes;
• records belonging to another Business.

Review the federal guidance on safeguards for personal information.

Build a complete but bounded package

A useful package may include period reports, bank reconciliation support, open invoice and bill lists, owner contribution or repayment records, and source documents for exceptions. Use monthly review to resolve obvious gaps before sharing and year-end readiness for the final annual package.

Name files consistently and include a short index. Do not rename documents in a way that hides their original date or source.

Keep an access and delivery record

Record:

1. who received access;

2. which Business and period were included;

3. the permission level;

4. the date access began;

5. files or reports exported;

6. the expected end date;

7. when access was revoked.

Review permissions after the engagement, staff change or accountant change. Revoking access should not delete the historical Business records.

The CRA notes that a business remains responsible for adequate records even when an accountant, bookkeeper or service provider keeps them. See Keeping Records.

Frequently asked questions

Should I email a ZIP file of all receipts?

A secure, access-controlled workspace is generally safer and easier to audit. If a file transfer is necessary, confirm the method and recipient with the accountant and protect the file appropriately.

Should the accountant use my login?

No. Shared credentials weaken the audit trail and make revocation difficult. Each person should use their own authorized identity.

Can the accountant see all of my Businesses?

Only if each Business has separately authorized that access. Access to one Business should not expose another.

Does SilaTrail decide what my accountant needs?

No. SilaTrail organizes and shares authorized records. The accountant determines the professional requirements for the engagement.