Documenting Account Ownership for Auditors

Sooner or later, most businesses that hold verified accounts face the same question from an auditor, a bank, or a regulator: who owns this account? The question sounds simple, and that is exactly why it catches businesses off guard. The person who opened the account may have left, the account may have been opened in a personal name for a business purpose, or the team may simply have never written down who is responsible for it. What the auditor is really asking is not about a name on a screen. They are asking whether the business can show, from its own records, that it controls its accounts, knows who can act on them, and can prove it when asked.

Ownership questions arise in ordinary situations, not only in formal audits. A bank reviewing a business account may ask for evidence that the account holder is authorised to act for the company. A new finance manager may need to know which accounts belong to the business and which are personal. A dispute about a payment may turn on who authorised it and whether they had the authority to do so. In each case, the business that can produce a clear record answers the question in minutes, and the business that cannot spends days reconstructing history from emails and memory. The record is not bureaucracy. It is the difference between a question and a problem.

The habit to build is simple: every business account gets a written ownership record, kept in one place, reviewed regularly. This guide explains what that record should contain, what evidence should sit behind it, and how to keep it honest as people join, leave, and change roles. It is written for operators and small teams, not for lawyers, and it does not replace professional advice. But a business that follows it will be able to answer the ownership question the same way every time: with a document, not a memory. The quarterly account hygiene review on the /blog index covers the routine that keeps records like this current.

Ownership, for an account, is not one fact but several, and the record needs to hold all of them. The first is the legal owner: the person or company in whose name the account is registered. The second is the named administrator: the person who manages the account day to day and holds its credentials. The third is the deputy: the person who can act if the administrator is unavailable, on leave, or has left. The fourth is the contact details on file: the email address and phone number the service uses, and who monitors them. A record that holds only the legal owner is incomplete, because the auditor's next question is always who actually acts on the account, and that person may not be the owner.

The distinction between owner and administrator matters most when they are different people. An account opened in the founder's name but run by an operations manager belongs to the business in practice, but on paper it belongs to the founder, and if the founder leaves, the business may find it cannot prove it controls the account. The same problem arises in reverse: an account opened by an employee in their own name, for business use, is the employee's account in the eyes of the service, whatever the business believes. The ownership record should state the position plainly, even when it is uncomfortable, because an auditor will find the gap anyway, and finding it in your own record first is always cheaper.

Authorisation is the other half of ownership. The record should state who is authorised to do what: who can view balances, who can move funds, who can change security settings, and who can close the account. These are not the same permission, and they should not belong to the same person by default. The access control guide on the /blog index explains how to think about who should hold which keys, and the ownership record is where those decisions get written down. If the record says that only the finance lead can move funds, and the auditor finds that three people can, the record is wrong, and the review that finds that is doing its job.

One page per account is enough, and that is the point. The ownership record for a single account should fit on one page, and it should contain the same fields for every account, so that anyone in the team can read any record and understand it. Start with the account itself: the service, the account name or identifier, the date it was opened, and its business purpose in one line. Then the people: legal owner, administrator, deputy, and the contact details on file. Then the authorisations: who can view, move, and change settings. Then a short note on where the credentials live, usually a reference to the password manager entry, not the credentials themselves.

The format matters less than the consistency. A spreadsheet with one row per account and one column per field works well for a small portfolio. A shared document with one section per account works for a handful of accounts. What does not work is a record scattered across emails, chat messages, and one person's memory, because that is not a record at all. Keep the ownership records in the same place as the rest of the account documentation, and make sure more than one person knows where that place is. If only one person knows where the records live, the business has a single point of failure, and the handover playbook on the /blog index explains why that is the first thing to fix.

Each record should also carry a short history: the date it was created, the date it was last reviewed, and a line or two about what changed at the last review. A record that has never been reviewed is a record nobody trusts, and an auditor will notice. The history does not need to be detailed. A single line, such as the date the administrator changed and who approved it, is enough. Over time, those lines become the audit trail that shows the business has been paying attention, which is exactly what an auditor is looking for. The bookkeeping guide on the /blog index covers the same habit applied to transactions, and the two records reinforce each other.

A record is only as good as the evidence behind it, and auditors will ask for that evidence. The strongest evidence is the document that created the account in the first place: the registration confirmation, the contract with the service, or the email that confirmed the account was opened. Keep a copy, or a reference to where it is filed, attached to the ownership record. For accounts opened in a company name, the evidence may include the company registration, a board minute authorising the account, or a letter appointing the administrator. These documents do not need to be elaborate. They need to exist, and they need to match what the record says.

Payment records are useful evidence too. An invoice showing that the business paid for the account, or a bank statement showing the business funded it, supports the claim that the account belongs to the business, even when the name on the account is a person's. Keep those references with the record, or keep them in the bookkeeping system where the auditor can find them. The point is not to build a legal case in advance. It is to make sure that when someone asks for proof, the proof is a short search away rather than a week of digging through old inboxes.

Where the evidence is thin, say so in the record rather than pretending otherwise. An account opened years ago, before any record-keeping existed, may have no registration confirmation and no contract on file. The record should note that plainly, with the date the gap was found and what is being done about it. Auditors respect a business that knows its own gaps and is closing them. They are far less forgiving of a business that claims a complete record and then cannot produce it. Honesty in the record is itself a form of evidence, because it shows the business is managing its accounts rather than merely describing them.

A record that is never updated becomes wrong, and a wrong record is worse than no record at all, because it gives false confidence. The ownership record needs a review rhythm, and the simplest one is to tie it to events rather than to the calendar alone. Review the record whenever someone joins or leaves the team, whenever an administrator or deputy changes, whenever an account changes purpose, and whenever contact details change. The quarterly account hygiene review on the /blog index is a good moment to catch anything the event-driven reviews missed, and the two together cover most changes.

Each review should be short and should leave a trace. Check the people named on the record against reality: is the administrator still the administrator, is the deputy still in the business, does the contact email still reach someone who is watching? Check the authorisations against the service itself: sign in, look at who holds what permission, and correct the record where it has drifted. Then write the date of the review and your initials on the record, with a line about what changed. A record with a fresh review date and a short change note is a record an auditor can trust. A record dated two years ago is a record nobody has looked at.

Assign an owner to the records themselves, not just to the accounts. Someone in the business should be responsible for the ownership register as a whole: for making sure every account has a record, for chasing the reviews, and for filing the evidence. That person does not need to be senior, but they need to be named, and there should be a deputy for the register too, for the same reason every account has one. The business continuity guide on the /blog index covers what happens when the account holder leaves, and the same logic applies to the person who holds the records. If they leave and nobody knows where the register is, the business is back to memory.

When the audit actually happens, the questions are usually straightforward, and a good record answers most of them before they are asked. Expect questions like these: who is the legal owner of this account, and what is your evidence? Who is authorised to move funds, and who approved that authorisation? Who else has access, and when was that access last reviewed? What happens if the administrator leaves, and has that ever been tested? Can you show the payment records that connect this account to the business? None of these questions is a trap. Each one is asking whether the business knows what it owns and can prove it, and a complete record answers each one with a document.

The way to answer matters as much as the answer. Show the record first, then the evidence behind it, and keep the explanation short. If the auditor asks about an account whose record is incomplete, say so plainly, explain what is missing and why, and show what is being done to fix it. Do not guess, do not improvise an answer, and do not produce a document you have just created that morning and present it as an old record. Auditors can tell the difference, and a fresh document presented honestly as a fresh document is far better than a backdated one. The /buy-crypto-accounts pages on this site can help if the audit concludes that the business needs a different account type for a particular function, and the /blog index holds the guides mentioned here.

After the audit, treat the findings as a work list, not as a verdict. Auditors usually produce a short list of gaps: a record that is out of date, an account with no deputy, evidence that is filed in the wrong place. Work through the list in order, update the records, and note the date each item was closed. Then keep the audit notes with the register, because the next audit will start by checking whether the last audit's findings were addressed. A business that closes its findings promptly builds a reputation with its auditors, and that reputation makes every later audit faster and less disruptive.

Some accounts will resist clean documentation, and those are the ones that need the most attention. A shared account that three people use because nobody set up individual logins has no single owner in practice, and the record should say so, along with the plan to split it into named accounts. An account opened by a contractor for a project that ended may still be live, with nobody responsible for it, and the record should flag it for closure or transfer. A legacy account opened in the name of a founder who has moved on may hold balances or history the business needs, and the record should note the situation and the steps being taken to move it into the company's name.

For each of these cases, the record should state the facts, the risk, and the plan, with a date. The facts are what the account is and who can access it. The risk is what could go wrong: an unauthorised payment, a lockout, a dispute about ownership. The plan is what the business will do and by when. An auditor who sees a difficult account documented this way sees a business that is managing its problem. An auditor who discovers the same account by accident sees a business that did not know it had one. The difference is entirely in the record, and it is why the unclear accounts deserve the first pages of the register, not the last.

Start today with the accounts you can document easily, and work outward to the difficult ones. List every business account you know about, write one page for each, and mark the ones where the ownership is unclear. Then pick the unclear ones off one at a time, starting with the accounts that hold the most value or the most access. Within a few weeks, the business will have a register it can show to anyone who asks, and a short list of gaps it is closing. That is all an auditor wants to see: a business that knows what it owns, can prove it, and is honest about what it is still fixing. The ownership record is not the most exciting document a business keeps, but on the day someone asks who owns an account, it is the most valuable one.

This article is educational and does not constitute financial, legal, or tax advice. Ownership, authorisation, and audit requirements vary by service, jurisdiction, and business structure and change over time, so always check the current guidance of the services you use and consult a qualified professional for your situation.