TECHNICAL NOTES · SECURITY AND ACCESS
Who can see what in reporting?
Reporting is where information from across the firm comes together, which makes it one of the easiest places for confidential information to escape the controls set everywhere else.
Decisions that are easy to skip
- Whose figures can each person see? Their own, their team's, or the whole firm's? Some firms value openness; others treat individual performance as confidential.
- What about sensitive values? Charge-out rates and cost rates can reveal salaries.
- Do reports respect ethical walls? A restricted matter that appears in a work in progress report is not restricted.
- Where do reports go? Scheduled reports emailed to a list, and exports to spreadsheets, leave the system's security behind.
- What can external tools see? Business intelligence tools connected to the system need their own row-level security, or everyone with access to the dashboard sees everything.
Agree a reporting policy first
Decide who should see what, at what level of detail, before reports and dashboards are built. It is far easier to configure an agreed policy than to retrofit restrictions after people have grown used to seeing everything.
What to ask, and what to see
- Run the same report as a partner, a team leader and a fee earner, and compare.
- Show a restricted matter's absence from firm-wide reports for someone outside the wall.
- How is security enforced in connected business intelligence tools?
Technical notes: small decisions, big consequences
Start with the overview: The details that decide the project
Accounts and finance
- Core accounting is still the gold standard
- One-way or two-way sync? Connecting your legal system to Xero
- Units or minutes? How time is recorded
- Your matter and nominal structure
- Making Tax Digital: the firm and its clients
Workflow, data and documents
- Workflow: deep, basic or none?
- Client onboarding and matter inception: portal, e-signature and ID checks working as one
- Custom data: what you rely on, and how you move it
- Precedents, merge codes and macros: your document bank in a new system
Your types of work
- Legal aid: your records, not just the Legal Aid Agency’s
- Litigation: Precedent H starts with time recording
- Family: Form E and financial disclosure
- Private client: where does the tax software fit?
Security and access
- Roles or individuals? How user permissions are set up
- Why manage security twice? Linking application security to Microsoft Entra
- How granular is the security inside the system?
- Who can see what in reporting? (you are here)
- Shared platform, your data: separation, restore and erasure
- When the supplier is the target: where your data lives, who can reach it, and your real risk
Microsoft 365
- How does it connect to Outlook?
- What did you just give it permission to do?
- What happens behind the scenes? Background integrations with Microsoft 365
- OneDrive is not a document management system
- Microsoft 365 is not a backup
Data and decisions
Where does your firm stand?
Our free practice management review shows how much of your current system you really use and, if you are thinking of moving, builds an independent requirements specification that takes your reasons into account. Nothing is sent to us.
Start the free review Talk to us