What is document management for accountants?

Firms used to keep documents on a file server or a standalone document management system. Many now use the document module inside practice management software, such as TaxDome or Canopy, so files sit on the client record next to jobs and messages, with a portal for clients to upload and sign. Document management is separate from document capture: capture tools such as Dext read invoices and receipts and post the data to the ledger, while document management keeps the files themselves. Retention rules set how long files are kept: UK companies must keep accounting records for six years from the end of the financial year they relate to, and the IRS generally expects records supporting a US return to be kept for three years after filing, longer in some cases.

Practice management software runs the work of a firm: client records, jobs, deadlines, workflow and billing. Document management holds the files that the work produces and relies on. The two overlap on the client portal, e-signature and file storage, which is why many practice management tools now include a document module. Karbon is a practice management platform, and its integration with SuiteFiles shows where the line sits: Karbon holds the contact and organisation data, and SuiteFiles uses that data in its templates, client portal and document signing, so an engagement letter can be filled in from the Karbon record and sent for signature. IRIS OpenSpace covers a narrower part of the job: sharing documents, tracking approvals and e-signatures, and sending automated client reminders at 7, 14 or 30 days. Practice management itself sits in the IRIS Accountancy Suite, which OpenSpace integrates with. A dedicated document management system is still the choice when a firm wants the file store, templates and signing to be a product in their own right, connected to whichever practice management tool holds the jobs and contacts.

In the UK, GOV.UK requires companies to keep records for six years from the end of the last financial year they relate to. The period is longer if a transaction spans more than one accounting period, the company bought an asset expected to last more than six years, the Company Tax Return was filed late, or HMRC has opened a compliance check into the return. In the US, IRS guidance sets three years from filing as the default. It extends to six years if a return omits income of more than 25% of the gross income shown, seven years for a claim involving worthless securities or a bad debt deduction, and at least four years after the due or payment date for employment tax records. The IRS says records should be kept indefinitely if no return is filed or the return is fraudulent.

Under the EU GDPR, Article 5 requires personal data to be kept in identifiable form for no longer than necessary, to be processed securely, and requires the controller to be able to demonstrate compliance. Article 30 requires controllers and processors to keep written records of processing, including the envisaged time limits for erasure of each category of data, and to make them available to the supervisory authority on request. Organisations with fewer than 250 employees are exempt unless the processing is likely to risk people’s rights and freedoms, is not occasional, or involves special category or criminal conviction data. Erasure requests under Article 17 do not apply where a legal obligation requires the data to be stored. A firm’s document management system therefore needs to apply retention periods by document type and jurisdiction, hold records past a standard period when a rule requires it, delete or anonymise files when the period ends, restrict access by role, and produce a log of what was kept, shared and deleted.

Firms with clients in more than one country keep several clocks running at once, because the period depends on the type of record as well as the place. In the UK, company accounting records are kept for six years under the rule set out above. Anti-money laundering records follow a separate clock: regulation 40 of the Money Laundering Regulations 2017 requires customer due diligence records and transaction records to be kept for five years from the end of the business relationship. Transaction records do not need to be kept for more than ten years, and personal data obtained for the regulations must be deleted once the period expires, unless another law, court proceedings or the data subject’s consent requires it to be kept.

In the US, the IRS periods of three, four, six and seven years apply to tax records, as listed above. Audit work has its own rule: Section 103 of the Sarbanes-Oxley Act directs the PCAOB to require registered audit firms to keep audit documentation for at least seven years, which the PCAOB sets out in Auditing Standard 1215. A US firm that prepares returns for some clients and audits others therefore holds files with different clocks in the same system.

In the EU, the fourth Anti-Money Laundering Directive, Directive (EU) 2015/849, requires obliged entities, which include accountants, to keep customer due diligence documents and transaction evidence for five years after the end of the business relationship or an occasional transaction. Member States may allow or require further retention of up to five additional years after a necessity and proportionality assessment. The directive also requires personal data to be deleted when the periods expire unless national law says otherwise. Periods for tax and commercial records are set by each Member State, so a firm with clients in several countries needs a schedule per country, and GDPR storage limitation applies on top.

Software enforces these rules through retention policies attached to folders, document types or labels. Microsoft Purview, which applies to SharePoint, lets administrators use retention policies and labels to retain content, delete it, or retain it for a set period and then delete it. In any system, the practical test is whether a firm can set a period per document type and jurisdiction, place a hold when a compliance check or dispute opens, and export a log showing what was deleted and when.

The five products below are the ones accounting firms most often shortlist. Prices are the vendors’ published list prices and change often, so confirm them on the vendor page before buying.

The choice follows the rest of the firm’s stack. A firm already on the IRIS Accountancy Suite gets OpenSpace connected to its modules. A firm on Karbon can pair it with SuiteFiles. A firm that wants one system for jobs, billing and files looks at TaxDome. SharePoint is a general file platform, so folder templates, client portals and signing workflows for accountants need to be configured by the firm or a partner rather than arriving ready made.

Storage, client portal and e-signature are the three features that decide most shortlists. The table covers SmartVault, SuiteFiles, IRIS OpenSpace, Karbon and TaxDome as the vendors describe them on their own pages. Prices are published in US dollars and change often, so confirm them with the vendor.

A move from a shared drive is safest when the old drive stays untouched until the new system is proven. The steps below keep the audit trail intact.

First, inventory the drive. List every top level folder, its owner, its size and the date it was last changed, and note which clients and years each one covers. Second, apply the retention schedule before moving anything. Files past their retention period and not under a hold can be deleted or archived, which shrinks the migration, but files tied to an open compliance check, dispute or investigation must stay. Third, design the target structure: one folder template per client, split by year and by document type, with permissions set by role rather than by person. Fourth, map old folders to new ones in a spreadsheet and agree the naming convention, so that searches and retention labels work from day one.

Fifth, run a pilot with a few clients and compare file counts, sizes and dates against the source. Microsoft’s free SharePoint Migration Tool moves file shares to SharePoint, OneDrive and Teams and produces migration reports, and other systems provide their own import tools; whichever is used, check in the pilot which properties arrive intact, including created and modified dates and authors. Sixth, export the old drive’s access and change logs, where they exist, and store them with the archive, because the new system’s log starts on the day of the move and cannot describe earlier activity. Seventh, migrate in batches by client or year, run the same checks on each batch, and freeze writes to migrated folders so changes are not made in two places. Finally, make the old drive read only, keep it for the retention period or until a verified archive replaces it, and record the date, the person who signed off each batch and the reconciliation results in the firm’s file.