The State of Secure Document Sharing in Accounting Firms (2026)

Post 5 of 10: Workflow Realities Inside Accounting Firms

Part of the FileRecall Accounting Research Series

Secure document sharing isn’t just a technology problem — it’s a workflow problem. The best platform in the world won’t protect an accounting firm if the way documents actually move through the practice creates gaps, inconsistencies, and workarounds that bypass security controls entirely.

This post examines the day-to-day operational realities that shape document sharing behaviour in accounting firms — the pressures, habits, client behaviours, and system limitations that determine how documents actually get shared, as distinct from how they’re supposed to get shared.

Understanding these realities is essential for choosing a document sharing solution that accountants and their clients will actually use — because a secure platform that creates too much friction will simply be bypassed in favour of email.

The Volume and Variety of Documents

The first workflow reality is sheer volume. A mid-sized accounting practice might process hundreds of documents in a single week during peak periods — tax returns, BAS statements, payroll files, engagement letters, signed authorities, identity documents, bank statements, financial statements, and correspondence with the ATO and ASIC.

These documents arrive from multiple sources — clients via email, clients via post, clients via phone photos, software platforms via automated exports, regulators via online portals, and banks and third parties via their own systems. They need to be reviewed, annotated, filed, and in many cases sent back to clients for review or signature.

Any document sharing solution that adds meaningful steps to this workflow — requiring conversion, separate login, file format changes, or client registration — will create resistance. Staff under pressure will find the path of least resistance, which is usually an email attachment.

The Client Behaviour Problem

One of the most significant workflow challenges for accounting firms is client behaviour. Firms can implement the most sophisticated secure sharing infrastructure available, but if clients continue to send sensitive documents via unencrypted email, the firm’s security posture is only as strong as the weakest channel in use.

Client document sending behaviour tends to cluster around a few problematic patterns:

• Email attachments — the default for most clients, regardless of security implications. Clients email PDFs, scanned documents, and spreadsheets without giving security a second thought.
• Phone photos — clients photograph physical documents and send them via messaging apps, email, or even social media. Photo quality is often poor, and the transmission channel is rarely secure.
• Consumer cloud links — clients share Google Drive or Dropbox folders, often with open permissions that allow anyone with the link to access the contents.
• Physical documents — some clients still prefer to drop off physical documents, which then need to be scanned and filed — introducing handling steps that create their own exposure.

Changing client behaviour requires making the secure option easier than the insecure one. If a firm’s secure sharing platform requires clients to register an account, remember a password, and navigate an unfamiliar interface, most clients will revert to email within a week.

This is why the no-registration, no-download model of controlled-access links is so important in accounting workflows — recipients click a link, the document opens in their browser, no account required. The friction is low enough that clients actually use it.

Seasonal Pressure and Its Effect on Security Behaviour

Accounting work is intensely seasonal. Tax time, end of financial year, BAS quarters, and audit deadlines create periods of extreme pressure during which the volume of documents being processed can multiply several times over.

These peak periods are when security behaviour is most likely to deteriorate. Under time pressure:

• Staff send documents via whichever channel is fastest rather than whichever is most secure
• Documents get sent to the wrong recipient because there was no time to double-check the address
• Shortcuts are taken with client verification before documents are released
• Older, less secure workflows get used because the secure system is unfamiliar or adds steps
• Password-protected systems get bypassed by sharing the password in the same email as the document

Secure document sharing solutions that are genuinely useful during peak periods must work within the pace of that environment. Expiry controls and access revocation need to be set-and-forget rather than requiring active management. Watermarking needs to happen automatically. Audit trails need to be captured without requiring any additional steps from staff.

The practical test for any secure sharing platform is whether it can be used correctly at the busiest moment of tax season — not just in a careful, unhurried trial.

Version Control and Document Currency

Version control is a persistent and underappreciated workflow problem in accounting. Documents go through multiple iterations — draft financial statements, revised tax returns, updated BAS figures — and each version may be shared with clients or third parties during the review process.

When documents are shared via email attachments, version control relies entirely on human discipline. If a client has received three versions of their financial statements via email, all three versions remain in their inbox permanently. The risk of a client referring to or acting on an outdated version — or sharing that version with a third party such as a bank or lender — is real and ongoing.

Controlled-access links solve this problem cleanly. When a revised version is available, the old link can be revoked instantly. The new version gets its own link. The client can only access the current version because previous links no longer work. This is version control without relying on clients to manage their own inbox.

The Portal Adoption Problem

Many accounting firms have invested in client portals — secure online environments where documents can be exchanged with clients. Portals are genuinely secure. But they suffer from a chronic adoption problem that undermines their security value in practice.

The adoption problem has several causes:

• Registration friction — clients must create an account and remember separate login credentials for each firm’s portal. Most clients work with multiple advisers and are reluctant to manage yet another set of credentials.
• Unfamiliarity — portals look and behave differently from the email interface clients use for everything else. The learning curve, however modest, creates resistance.
• Mobile limitations — many portal interfaces are not optimised for mobile, and clients increasingly want to handle administrative tasks on their phones.
• Notification failures — clients miss portal notifications in their inbox and revert to asking the firm to email documents directly.
• Reciprocal inconvenience — if a client needs to send a document to the firm, using the portal requires them to navigate to it, log in, and upload — all steps that email doesn’t require.

The result in many firms is a two-speed system. Internally, documents are managed through the portal. Client-facing, documents revert to email because that’s what clients actually use. The portal’s security value is only captured when clients engage with it — which, in practice, is less often than firms would like.

Controlled-access links offer a middle path. They provide genuine security without requiring clients to register, log in, or learn a new system. Recipients receive a link, click it, and the document opens. That simplicity is why adoption rates are significantly higher than traditional portal systems.

Internal Access Controls and Staff Permissions

Within accounting firms, document access controls present their own workflow challenges. Staff at different levels require access to different client documents — partners need access to everything, senior accountants to their own client portfolios, junior staff to specific engagements, administrative staff to certain document types only.

In practice, many firms implement access controls at the system level but not at the document sharing level. A staff member might be correctly restricted within the practice management system but then share a client document via their personal email, bypassing those controls entirely.

The Business plan tier on FileRecall addresses this directly — shared dashboards with multiple team seats allow firms to manage document sharing across the team from a single system, with full visibility into what each team member has shared and with whom.

What Good Document Workflow Actually Looks Like

For accounting firms, effective document workflow means security that fits within the existing pace of work rather than requiring work to slow down to accommodate security.

The practical markers of good document workflow in an accounting context are:

• Document sharing takes no more steps than sending an email attachment
• Clients can access documents on any device without creating an account
• Every document access is automatically logged without staff having to do anything
• Old versions are automatically inaccessible once revoked — no client management required
• Documents expire automatically when the sharing window closes — no follow-up required
• Staff can see the full status of every shared document from a single dashboard
• Watermarking happens automatically — not as an optional extra step

These are the workflow requirements that a secure document sharing platform must meet to actually be used correctly in an accounting practice under real conditions. A platform that meets these requirements doesn’t compete with email — it replaces it for sensitive documents, because it’s genuinely easier to use correctly than email is.

────────────────────────────────────────────────────────────

Next in this series: Post 6 — The Technology Landscape →

← Back to: Post 4: Regulatory & Compliance Environment

View the full series index →

Related Reading

• Secure File Sharing for Accountants — how FileRecall fits into accounting workflows
• Secure Document Viewer — documents viewed in browser, never downloaded
• Expiry Controls — automatically limit how long documents remain accessible
• Access Tracking — full visibility into when and how documents are viewed
• Password Protection — add authentication before documents can be opened
• Instant File Recall — revoke access to any document at any time
• Secure File Sharing Online — what genuine online document security looks like

FileRecall — Secure document sharing for accounting firms. filerecall.com