Skip to content
EMPOBase
en

How to give auditors access without emailing files

By the EMPOBase team · · 4 min read

Short answer

Give auditors time-limited, read-only access to a defined set of records in one place, in place of emailing files. Agree the scope with them first, set an end date, share only what the audit needs, answer their questions in one thread and keep a log of what they viewed. When the audit closes, remove the access and archive the exchange.

Key points

  • Emailed attachments spread copies you cannot control or recall.
  • Agree the scope, period and projects with the auditor before access starts.
  • Use read-only, time-limited access, and remove it when the audit ends.
  • Keep audit questions and answers in one place, with a record of who saw what.

What goes wrong with email?

During an audit, requests arrive as a stream: “Please send the March bank statements”, “Where is the signed agreement?”, “Can you resend the invoice list?” Staff attach files and send them. After a few weeks you have hundreds of attachments across many inboxes. Some are old versions. Some hold personal data. Some went to the wrong person. Nobody can say exactly what the auditor has.

Sharing access to the records in one place, with a boundary and an end date, solves most of this.

What should you do before the audit starts?

  1. Agree the scope in writing. Which period, which projects, which donors, which types of record?
  2. Name the contacts. One person on your side coordinates. The auditor names their team.
  3. Prepare the records. Check that documents are complete, signed and filed in the right place. Fix gaps before the auditor finds them.
  4. Remove what is not needed. Check files for personal or sensitive data that the audit does not require, and remove or redact it.
  5. Set the access window. Choose a start and an end date that match the audit plan.
  6. Set a query process. Decide how questions come in and who answers.

What should the access look like?

Good access to an auditor has five properties:

PropertyWhy it matters
ScopedThe auditor sees only the agreed projects and period
Read-onlyThey cannot change or delete your records
Time-limitedAccess ends on a set date
LoggedYou can see what was opened and when
RevocableYou can end it early if needed

Be careful when you promise what the auditor will find. A shared space gives access to the documents you have put in it. It does not build an evidence pack for you. Spend time before the audit checking what is available.

How should you handle audit queries?

Treat queries like a small project.

  1. One list. Log every request with a number, the date, the question and the requester.
  2. One owner each. Assign each query to a person with a due date.
  3. Answer in the same place. Attach the answer or point to the record, so the thread is complete.
  4. Close each query. Mark it answered and let the auditor confirm.
  5. Review daily during fieldwork. A short daily check stops items from going late.

This also gives you a record of the whole audit, which helps next year.

What happens when the audit ends?

  • Remove access on the agreed date, or earlier when the auditor confirms they are done.
  • Review the log of what was viewed, as a check that the scope held.
  • Archive the exchange. Keep the query list, your answers and the final report together. See how long an NGO should keep its documents.
  • Record lessons. Note what the auditor asked for that was hard to find, and fix your filing. Our guide to organizing NGO documents can help.

A short example

An NGO has a grant audit coming. A month ahead, the finance lead agrees the scope with the audit firm: two projects, one financial year. She checks that contracts are signed and bank statements are filed, then removes a folder of staff medical notes that has no place in the audit. Access is set for six weeks.

During fieldwork, the auditor sends twelve questions. Each goes on the shared list with an owner. Most are answered in a day by pointing to a record. Two need a new document, which is added to the shared space. At the end, access is removed, the log is read and the query list is filed with the final report.

Compare that with the email route: dozens of attachments, no log and no clear end. Whatever tool you use, the habits are the same: agree the scope, limit the time, keep one thread and close it properly.

Where EMPOBase fits

External Access (audits) lets you invite an external reviewer to a scoped, time-limited, read-only review workspace. You set the access window, the data period and the project scope, and you can review or revoke access. Reviewer activity is logged. Reviewers sign in with a password and an email verification code. Documents can be previewed or downloaded one at a time, and a complete bundled evidence pack is not guaranteed, so check the scope and what is available before the review starts. See the security page or contact us for a walk-through.

Questions people ask

Why is emailing files to auditors a problem?

Each attachment becomes a copy outside your control. You cannot take it back, you cannot see who forwarded it, and versions drift apart. Files may also hold personal data that should not travel by email.

Should auditors see everything?

No. Share what the audit scope covers, such as certain projects, a date range and relevant documents. Remove personal data that the audit does not need.

How should we handle audit queries?

Keep one list of questions, each with an owner, a due date and the answer. Do not scatter them across inboxes, so nothing is missed or answered twice.