Deavo
Due diligenceExpert answer · 1 min read

What should I check in the way a bookkeeping practice stores client files?

Check where each client’s records live, who has access, how they are backed up and how old files are retired. Then ask what clients were told about privacy. Sloppy storage is both a security risk and a sign of how the practice is run.

Ask the seller to show you, not just describe, where client files sit. Are they in a shared cloud folder, on a laptop, in paper boxes at home? A mix of all three is common and tells you the practice grew without a plan. Next, look at access. List everyone who can open client files: staff, contractors, former employees, the seller’s family. Ask how access is removed when someone leaves. Shared passwords are a warning, because you cannot tell who saw what.

Ask about backups and whether anyone has ever tested restoring one. Ask how long records are kept and how old ones are destroyed. Your lawyer can tell you what applies to a practice like this.

Finally, check what clients were told about their information and whether their engagement terms allow a transfer to a new owner. Missing consent can slow the handover, even when the books themselves are clean. Do not skip the physical side. Ask where paper records and old hard drives are kept, whether they are locked and who holds the keys. A practice that has moved online may still have sensitive paper sitting in a garage or storage unit.

Key takeaways

  • See the storage with your own eyes, including paper and personal devices.
  • Get a list of everyone with access, past and present.
  • Confirm clients’ consent to a transfer before you rely on their files.
  • Ask where old paper records and retired drives are kept.

Sources

This answer is checked against primary sources. Links were last confirmed on the dates shown.

  1. 01
    Business Development Bank of CanadaGovernment
    How to conduct due diligence when buying a business
    bdc.ca·Checked Oct 21, 2026
  2. 02
    Business Development Bank of CanadaGovernment
    Understanding post-merger operational integration
    bdc.ca·Checked Oct 21, 2026
  3. 03
    Canadian Centre for Cyber SecurityGovernment
    Baseline cyber security controls for small and medium organizations
    cyber.gc.ca·Checked Oct 25, 2026

Deavo is an advertising and listings platform, not a brokerage, law firm or valuation firm. This page is general information, not legal, tax, accounting or valuation advice, and rules differ by province. Confirm anything you rely on with a qualified professional before you act on it.