Handling client data securely during fieldwork comes down to three practical habits: controlling how data moves in and out of the firm (pen drives and personal email being the two most common leak points), controlling who inside the firm can actually open a given client's shared drive, and having an actual, followed procedure for what happens to the client's data once the engagement closes rather than leaving it indefinitely on laptops and drives. None of this requires specialised security tooling — it requires a habit the whole team actually follows.
Why this is a firm-level habit, not a one-off decision
A statutory audit routinely involves full ledger extracts, bank statements, payroll data with employee PAN and salary details, and sometimes customer or vendor data with commercially sensitive terms. None of this is the firm's data, and the client's willingness to hand it over at all rests on a reasonable expectation that it will be handled carefully and not simply sit around indefinitely on whichever laptop happened to be used that week.
Most data handling failures in audit firms are not dramatic breaches. They are a pen drive left in a laptop bag, a shared drive folder that an article who left the firm two years ago can technically still access, or a client's data still sitting in someone's downloads folder three audits later because nobody ever went back to delete it. Fixing these does not require a security budget; it requires the habit being specified and followed.
Pen-drive and removable-media discipline
- Treat a pen drive as the least traceable way data leaves or enters the firm, because there is usually no record of what was copied, when, or by whom once it is unplugged.
- Where client data must move by pen drive — a client's own IT policy sometimes insists on it — use a drive dedicated to that engagement, copy the data off it onto the firm's system the same day, and wipe it rather than reusing it with the next client's data still on it.
- Prefer a controlled transfer method over a pen drive wherever the client will allow it — a shared drive link with an expiry, or a direct upload to the engagement's working folder — specifically because these leave a record that a pen drive does not.
- Never let client data reach a personal device — a personal laptop, a personal cloud drive, a personal email account — even temporarily, even for convenience, even by someone senior who means to delete it right after.
Access control on shared drives
A client's folder on the firm's shared drive should be visible only to the people actually on that engagement, for as long as they are on it, and not to the rest of the firm by default. This sounds obvious and is routinely not how firms' shared drives are actually configured — folder structures accumulate over years, access gets granted and never revoked, and nobody owns the job of checking.
| Check | Why it matters | How often |
|---|---|---|
| Who currently has access to each client folder | Access tends to accumulate and rarely gets revoked on its own | At least annually, or whenever the engagement team changes |
| Whether departed staff still have access | The most common and most avoidable exposure | Immediately on exit, not on the next review cycle |
| Whether a client folder is visible firm-wide by default | Confidential client data should not be browsable by people with no reason to open it | Checked when a new client folder is created, and periodically after |
| Whether any client data has drifted onto a personal or local folder | Local copies are invisible to any access control on the shared drive | Spot-checked during the engagement and at close |
An access list that has never been reviewed is not evidence that access is controlled — it is evidence that nobody has looked. Treat a periodic access review as a specific, assigned task with an owner, not an assumption that the folder structure is taking care of it.
What happens to client data after the engagement closes
An audit file does not end the firm's obligation to the client's data — it starts the retention period, and most firms handle this worse than the fieldwork itself because by the time the engagement closes, attention has already moved to the next client.
- 01Decide, in advance, what gets retained and for how longThe working papers themselves are retained per the firm's documentation policy and applicable requirements. Raw client extracts used only to get to the working papers often do not need the same retention and should be deliberately purged on a schedule, not left indefinitely because deleting them did not feel urgent.
- 02Remove client data from individual devices at closeLaptops used during fieldwork should have the client's raw data removed once it has served its purpose and been superseded by the working papers, rather than carrying it forward, untracked, into the next engagement's folder structure.
- 03Revoke engagement-specific access promptlyIf access was granted specifically for this engagement, remove it when the engagement closes rather than waiting for the next periodic review to catch it.
- 04Keep a record of what was purged and whenIf a client or regulator later asks what happened to data provided for a closed engagement, the firm should be able to answer from a record, not from memory.
Common practice, not a requirement
Firms that handle this well tend to build it into the engagement close-out checklist, as a specific line item next to filing the signed report, rather than treating it as a separate IT task that happens eventually.
How we think about this
None of this is a claim that any particular tool makes client data safe — it is a description of habits a firm can actually run every engagement: control how data moves, control who can see it, and have a real answer for what happens to it afterward. A tool can make those habits easier to follow consistently; it cannot substitute for the firm deciding to follow them.
This is practical guidance written for audit teams, not an authoritative statement of any standard or statute. Standards, forms and timelines change. Check the current text issued by the ICAI and the relevant authority before relying on anything here in an audit file.
Related resources
- Audit data & extractsGetting clean audit data out of TallyThe export paths that actually work, what each one loses, and how to handle the three problems that break most audit imports: blank ledger names, duplicated vendor masters, and opening balances that do not tie.
- Audit data & extractsConsolidating multi-branch data for a single auditSeparate company files per branch, inter-branch transfers that need eliminating, and vendors shared across branches that look like duplicates. Consolidating multi-branch data before testing starts.
- Audit data & extractsValidating an audit population before you draw a sampleA sample drawn from an unvalidated population tells you something precise about the wrong set of transactions. The checks that establish a population is actually a population, before any sampling begins.
Free tools, no signup
Each one reads a file entirely in your browser — or, for two of them, just answers a few questions — and nothing is ever uploaded.
- Purchase register checkDuplicate payments, round-sum amounts, weekend-dated invoices, incomplete records.
- GSTR-2B reconcilerMatches your purchase register against GSTR-2B — missing invoices either side, amount mismatches.
- Bank reconciliation checkerMatches your cash book against a bank statement — what's outstanding on each side.
- Fixed asset register checkDuplicate asset codes, missing location or useful life, negative net book value.
- Payroll red-flag scannerBank accounts shared across employees, and records missing an ID, PAN or salary.
- CARO applicability checkerAnswer a few questions about the company and see which CARO 2020 clauses likely apply.
- MSME payment delay checkerMSME-flagged invoices paid — or still unpaid — beyond the 45-day Section 22 limit.
- Related-party transaction screenerTransactions above a threshold you set with no approval reference, grouped by counterparty.
- Depreciation useful life checkerCompares a useful life in use against the Schedule II, Part C indicative figure.
- Materiality calculatorOverall and performance materiality against PBT, revenue, assets or equity, with reasoning shown.
- Sample size calculatorStatistical sample size for a test of controls or a substantive test of detail.