The shared inbox at a small RIA: who can see it, what gets kept, and how requests don't get lost
A shared inbox at a small RIA works when four things are true: only the people who need it have access and every login uses multi-factor sign-in; every client request that arrives is moved onto a tracked list with an owner; anything that matters to a client's record is filed against that client; and the mailbox itself is archived so required business emails are kept. Review who has access each quarter, and never act on a money request from the inbox without a callback.
Most small firms have an info@ address that started as a convenience. Three years later, two current staff, one former assistant and an outside contractor know the password, client requests arrive there alongside newsletters and vendor invoices, and nobody is quite sure who's meant to answer what. It's one of the easiest places for a request to get lost and for client data to leak.
What should be true of a shared inbox?
| Rule | Why |
|---|---|
| Individual logins, not a shared password | You can remove one person without changing everyone's access |
| Multi-factor sign-in on every login | A stolen password alone isn't enough |
| One named owner who checks it daily | Every email has someone responsible for it |
| Client requests moved to a tracked list | They don't depend on the inbox being read |
| Important emails filed to the client record | The client's history isn't split across mailboxes |
| The mailbox is archived | Required business emails are kept |
| Quarterly access review | Former staff and contractors are removed |
What's the daily routine?
- The owner reads new mail once or twice a day.
- Each client request goes on the request list with an owner and a due date.
- Anything about a client's account, instructions or a complaint is filed to their record.
- Money requests are never actioned from email; they go through the callback routine.
- Junk and vendor mail is filed or deleted so the inbox stays readable.
A worked example
Take the info@ inbox above at a hypothetical two-person RIA. The owner moves it to a proper shared mailbox with individual logins and multi-factor sign-in, removes the former assistant and the contractor, and turns on archiving. The operations lead becomes its owner. The next week a client emails info@ asking for an address change; it goes on the request list, is verified by phone on the number on file, and is filed to the client's record with the date.
What are the common gaps?
- One password shared by everyone who's ever worked there.
- Requests answered by "whoever saw it first", or nobody.
- A complaint sitting in the shared inbox and never logged.
- No archive, so emails can be deleted without a trace.
When is this overkill?
If you don't have a shared inbox, you don't need one. If you do, these rules take an afternoon to set up.
How Advorra fits
Advorra keeps communications, tasks and the complaints and incidents log on each client's record, so what arrives in a shared inbox ends up with the client it's about. See the product page, or read about which client emails to keep and tracking client service requests.
One thing to do this week: list everyone who can log in to your shared inbox, and remove anyone who shouldn't.
An operations guide, not legal, compliance or IT advice.
Questions advisors ask
Is a shared inbox a security risk?
It can be, because several people share one account. Use your email provider's shared mailbox feature with individual logins rather than a shared password, and turn on multi-factor sign-in.
Do shared inbox emails need to be kept?
Business communications about advice, recommendations and similar matters generally need to be kept for advisers. Archive the mailbox and check your retention rules with your compliance consultant.
Who should own the shared inbox?
One person, usually operations, who checks it daily and makes sure every request has an owner.
Should client requests stay in the inbox?
No. Move each request onto your tracked list and the client's record, so it doesn't depend on someone remembering the email.
Is this compliance advice?
No. It is an operations guide.
See it on a demo firm
Advorra is practice software for independent RIAs: clients, models, IPS, billing and compliance records in one place, on top of the custodian you already use. Built by The CollabHub.
Get in touch