Roles: who may do what

The four roles

Role	May do
Owner	Everything, including settings, backups and who can sign in
General manager	Run the books: invoices, bills, bank, GST, reports
Accountant	Read everything and prepare the tax numbers; change nothing
Auditor	Read the books and the assurance work; no settings, change nothing

Two of those roles cannot change a number, and that is the feature.

The rule that keeps it honest

Turning on another person's access requires the owner's own password first. That single rule prevents the obvious failure: nobody can hand out a login that locks the owner out of their own books.

It also means every role that exists was created deliberately, by someone who holds the highest level of access. If a question arises later about who let whom in, there is a record and a person.

Why an auditor should not be able to edit

The ethics standard states the requirement plainly. An assurance practitioner shall comply with the principle of objectivity, which requires exercising judgement without being compromised by bias, a conflict of interest, or undue influence PES 1 R112.1. An assurance practitioner shall also comply with the principle of integrity, which requires being straightforward and honest in all professional and business relationships PES 1 R111.1, and with professional competence and due care PES 1 R113.1.

An auditor who holds the ability to change the records they are auditing is in a position where objectivity cannot be demonstrated, however honest they are. The read-only role removes the question rather than asking anyone to be trusted about it.

The same logic runs through the whole quality management system in a firm. The objective of that system is to provide the firm with reasonable assurance that the firm and its personnel fulfil their responsibilities and perform engagements in accordance with professional standards PES 3.14. Access control is a small, concrete piece of the same idea.

Access is also an assurance question

ByteBook's A13 procedure reports who can sign in, when the books were last backed up, and whether anything failed quietly while people were working. It is the least glamorous procedure of the fourteen and one of the most useful, because the questions it asks are exactly the ones an engagement team asks about any system they are relying on: who has access, is the record protected, and would anybody have noticed if something went wrong.

A practical training routine

When you work through a simulation that is meant to be audited:

1. Set the owner password first.
2. Add an accountant login and use it to prepare the tax figures.
3. Add an auditor login and run the assurance procedures from it.
4. Try to change something as the auditor. Notice that you cannot, and that the program does not offer you the option.
5. Switch back to the owner and void something deliberately. Then look at the audit trail as the auditor and find it.

Step five is the exercise that makes the rest of the design make sense.