Accounting security and controls

Company Accounting permissions are distinct from project tool permissions. Company administrators can grant accounting roles and flags with optional entity restrictions; access to a project does not by itself grant access to company books. The Project manager role is project-scoped: its forecast, job cost, WIP, job profitability, financial statement, trial balance, general ledger detail and journal views, account balances and the accounting home show only the projects the user is a member of. Receivables, payables, vendor profiles, banking (bank accounts, transactions, statements, reconciliations, cash position and cash forecast), accounting imports and the journal export file, budgets, ACH returns and NOCs, recurring journal templates, leases, the fixed-asset register (assets, depreciation runs, equipment rates and unit recovery), aging, reconciliation, integrity, CECL, fixed-asset roll-forward, audit log and accounting analytics views have no project dimension, so the Project manager role cannot open them. Its journal entry attachments, equipment usage and approvals inbox cover only its projects, and journal entries show their source document (bill, invoice, asset, pay run) as plain text rather than a link it cannot open. A Project manager grant cannot be given AP, AR, banking or payroll permissions (enter, approve, release payments, vendor banking, bank reconcile, payroll view, run or PII); saving one is refused. A grant saved with such a flag before this check keeps its project-scoped reads, but the flag has no effect: the AP, AR, banking and payroll pages, files and actions refuse it. Importing ACH return files, applying NOCs and resolving a manual NOC need vendor banking or payroll run permission; a read-only role is refused before anything is recorded. With an entity restriction, the journal report, journal list and entry page show every entry with a line in your entities, and only those lines.

Financial workflows use company and entity checks, approval separation and audited actions. Preparers and other tracked contributors must not approve their own accounting inputs. A company with one or two bookkeepers can switch Segregation of duties to Small team on the Settings page (a user with chart of accounts permission and access to every entity; the change is audited). The preparer can then approve their own bill or journal entry, or release their own payment run, only with a written reason. Each self-approval is flagged in the audit trail and listed on the Periods page for close review. Strict, the default, never allows it. Posted journal entries are protected and corrected through supported reversals or adjustments. Closed periods restrict posting; authorized reopening requires a reason, and a hard-closed period needs a second person to confirm the reopen. Payroll follows the entity restrictions on a grant. A new direct-deposit employee is confirmed by someone other than the run’s preparer before their first paid run. Revealing personal or bank data through the API needs a token with write access, and reveals are rate limited.

The availability of controls varies by workflow and source coverage. A review or unavailable tie-out is not a passing result. Direct database administration is a trusted operational boundary and is not equivalent to normal application access. See Accounting overview and Close the month.

End-to-end workflow checks

Five complete workflows run in the accounting database test suite, each on its own new company, and each step is checked against hand-computed ledger, subledger and report amounts:

• Billing to cash: contract schedule of values, certified pay application, AR invoice with retainage, receipt, bank deposit, statement import and reconciliation, AR aging, retainage release.
• Commitment to 1099: subcontract bill with retainage held for a lien waiver and certificate of insurance, independent approval, payment run with checks and ACH, check print, NACHA and positive pay files, a voided check, reconciliation, AP aging and 1099-NEC.
• Payroll to statements: approved timecards, a union member’s prevailing-wage pay run (CBA fringe counted toward the wage determination fringe, dues withheld), payroll posting and job cost, certified payroll, WIP snapshot, close checklists with independent approval, hard close, then trial balance, income statement and balance sheet with net income in equity.
• Fixed assets: acquisition, monthly depreciation, equipment usage charged to a job, disposal at a gain and the roll-forward.
• Multiple entities: intercompany entry and bank transfer, the intercompany-nets-to-zero check as close evidence that blocks the close, year-end close per entity, reopening for a late adjustment and closing again.

Seeded books are also checked through the screens: an invoice and its receipt change the AR aging, balance sheet and income statement by their exact amounts.