A Twelve-Person CA Firm Fixes Its Data Practices
A twelve-person chartered accountancy firm keeps its client ledgers in one spreadsheet stored in a free cloud account. Three articled assistants share a single login, so edits made at the same time silently overwrite each other; last month 40 minutes of entries for a GST client were lost. The same account holds a folder of scanned PAN cards and bank statements, shared as "anyone with the link can edit". The only backup is the office manager's laptop, on which the file is downloaded nightly. Last week an articled assistant emailed a client contact list to a personal Gmail address so he could work from home. The partners have approved ₹20,000 for fixes this quarter. Options and costs: cloud backup with 30-day versioning ₹4,800 a year; password manager with individual logins ₹1,200 a year; two-factor authentication, free; antivirus renewal ₹3,500 a year; a one-day data-protection training session ₹8,000. The partners want to fix the two problems most likely to cause a client-visible loss.
1. Rank the four incidents by likelihood multiplied by impact, and choose the two fixes to fund. Justify the spend.
Read the worked answer
Ranking by likelihood × impact:
- Open "anyone with the link can edit" folder of PAN cards and bank statements. Likelihood high (one forwarded link is enough), impact severe and irreversible - a data breach that must be reported and that ends client relationships. Personal data cannot be un-leaked.
- Shared login with silent overwrites. Already occurring (40 minutes lost), and it is client-visible the moment a GST filing is wrong. Recoverable if versioning exists - which it does not.
- Single laptop as the only backup. Moderate likelihood (theft, disk failure), catastrophic impact, and cheap to remove.
- Client list to personal Gmail. Real, but a one-off policy failure whose damage is limited by the fact that a contact list is less sensitive than PAN and bank data.
The two client-visible problems are therefore 1 and 2, and one purchase covers both: password manager with individual logins at ₹1,200 plus free two-factor authentication ends shared credentials and lets permissions be set per person. Add cloud backup with versioning at ₹4,800, which both restores overwritten sheets and removes the laptop as single point of failure. Total ₹6,000, well inside ₹20,000; hold the rest for training once the controls exist.
2. Why is antivirus renewal a weaker first fix than the two you have chosen, even though it is a recognised control?
Read the worked answer
Antivirus addresses malware arriving on a device. None of the four incidents here is a malware incident: the losses came from concurrent editing on a shared credential, from an over-permissive sharing link, from having one copy of the data, and from an employee deliberately emailing a file out. A fully updated antivirus suite would have prevented none of them, so spending ₹3,500 on it first buys reassurance rather than risk reduction.
The general test is whether a control sits on the causal path of the loss you have actually observed. Individual logins and access permissions do; versioning and off-site backup do; antivirus does not, though it remains reasonable to keep it once the real gaps are closed. There is also an opportunity-cost argument: ₹3,500 is nearly three times the cost of the password manager that fixes the most frequent failure. If the partners later want layered defence, antivirus is a fine third purchase - but it should not displace measures aimed at the incidents that have already happened.
3. Which zero-cost change to the spreadsheet workflow most reduces silent overwrites, and what does it not solve?
Read the worked answer
The strongest free change is to stop editing a link-shared file and instead use named-user sharing with edit rights for the ledger owner only and view or comment rights for everyone else, with version history switched on. Restricting the sharing link to specific accounts removes anonymous editing entirely; a single designated editor per ledger removes the simultaneous-edit race; and version history makes any remaining overwrite recoverable to a named point in time. All three settings exist in the free tier.
What it does not solve: version history is not a backup. If the account is compromised or the file is deleted, the copies go with it - that is why the ₹4,800 off-site backup is still needed. It does not stop an authorised person from exporting data to a personal mailbox, which requires a written policy and, eventually, the training session. And it does not audit who viewed the PAN folder. Free controls fix access and recoverability; they do not fix human behaviour or provide an independent copy.