Who can see your client data? A quarterly access review for small RIAs
An access review is a regular check of who can see and change client data in each system your firm uses. For a small RIA, a quarterly review means listing every system that holds client information, checking each person's access against their current role, removing access that isn't needed (especially for people who have left), confirming no shared logins are in use, and recording what you checked and changed.
A part-time assistant left in the spring. In September, the firm notices she still has a login to the document storage service and the CRM. Nothing happened, but nobody could say for certain, because nobody had checked. A quarterly access review makes sure that question has a quick, dated answer.
What is an access review?
A regular check of who can see and change client data, in every system your firm uses, compared with what each person actually needs for their role.
Which systems should be on the list?
| System | Why it matters |
|---|---|
| Practice software or CRM | Client records, notes, accounts |
| Custodian portal | Account access and trading |
| Client communications and attachments | |
| Document storage | Statements, IDs, signed agreements |
| Billing tool or spreadsheet | Fees and account values |
| Archiving and backup services | Copies of everything above |
How do you run the review?
- List each system and who has a login.
- Check each person against their current role: do they need this access, and at this level?
- Remove what isn't needed, starting with anyone who has left.
- Look for shared logins and replace them with individual ones.
- Check admin rights: as few people as possible should be able to add users or change settings.
- Record the review: date, who did it, what changed.
A worked example
Take a hypothetical two-person RIA with a part-time assistant who left in the spring and an outside compliance consultant.
| System | Finding | Action |
|---|---|---|
| CRM | Former assistant still active | Removed; date recorded |
| Document storage | Former assistant still active; one shared folder link with no expiry | Removed; link expired |
| Custodian portal | Both advisers have full trading access | No change; matches roles |
| Consultant has a shared mailbox login | Replaced with a separate guest account |
Twenty minutes, four findings, all fixed, and a dated record that shows it.
What should the record show?
- Date and reviewer.
- Each system checked.
- Access removed or changed, and why.
- Any shared logins found and how they were replaced.
- The next review date.
When is this overkill?
A solo adviser with no staff still has vendors and old contractors to check, but the review may take ten minutes. Do it anyway, and do it the day anyone stops working with you.
How Advorra fits
Advorra keeps each firm's data separate from every other firm's at the database level and encrypts it in transit and at rest. Your own access review still applies to every user you give a login to. See the product page, or read Regulation S-P for small RIAs and sharing client documents securely.
One thing to do this week: list everyone who has stopped working with your firm in the past year, and check every system for their logins.
A practical routine, not legal or compliance advice.
Questions advisors ask
How often should a small firm review access?
Quarterly works for many small firms, plus immediately when someone joins, changes role or leaves. Your written procedures should set the cycle.
What about former employees and contractors?
Remove their access on their last day, across every system, and record it. Old accounts left open are a common gap.
Are shared logins acceptable?
Avoid them. Each person should have their own login so you can see who did what and remove one person's access without affecting others.
Does this include vendors?
Yes. Note which vendors can access your client data, and review that alongside your vendor due diligence.
Is this compliance advice?
No. It is a practical routine. Your procedures and compliance consultant decide what your firm must do.
See it on a demo firm
Advorra is practice software for independent RIAs: clients, models, IPS, billing and compliance records in one place, on top of the custodian you already use. Built by The CollabHub.
Get in touch