# Accounting Firm Document Management: Handling Hundreds of Clients' Records Without Losing or Mixing Them

> How to set up accounting firm document management: client folders, permissions and version history in one place, plus Turkish retention rules, in 6 steps.

Source: https://digitalbridge.com.tr/en/blog/accounting-firm-document-management.html
Publisher: Digital Bridge Teknoloji (https://digitalbridge.com.tr)
Topic: Business Email & Documents
Published: 2026-10-23 · Updated: 2026-10-23

Accounting firm document management is the practice of storing every client's invoices, bank statements, contracts, payroll files and tax returns in one system, organised by client and period, with access permissions and version history. Done well, an emailed invoice is filed to the right client's month folder in one click, and nobody asks "where is that invoice?" at filing time.

## Key takeaways

- The most sustainable folder layout is Client → Year → Month → document type; permanent records such as contracts and powers of attorney sit in a separate folder.
- Client paperwork should arrive through one door, such as a single published `documents@` address, which ends the WhatsApp and USB sprawl.
- In Türkiye, the Tax Procedure Law (Article 253) requires five years' retention of books and records; the Commercial Code (Article 82) sets ten years.
- Under KVKK, folders holding payroll and identity data should be open only to the responsible adviser, and only a few people should be able to delete.
- According to the Turkish Revenue Administration's 2025 Annual Report, e-Invoice users reached 1,937,308 taxpayers at the end of 2025.

In a well-run accounting firm document management set-up, everyone also knows who can open which client's files. A scattered set-up costs hours and puts clients' financial and personal data at risk. For the sector-neutral basics, see our [document management system guide](https://digitalbridge.com.tr/en/blog/business-document-management-guide.html); for how a similar structure works for client matters, see [law firm document management](https://digitalbridge.com.tr/en/blog/law-firm-document-management.html).

## Where do documents come from in an accounting practice today?

An accounting practice exists to put other people's paperwork in the right place at the right time. Yet documents never arrive through a single door. One client emails a month's invoices in bulk, another sends photos over WhatsApp, a third posts bank slips by courier. Starter and leaver details for payroll turn up in one email, a scanned lease agreement in another thread.

Inside the practice, records are no tidier. A junior saves attachments to the desktop, a senior moves some to a shared drive, and three copies of the "final" Excel working paper circulate while a return is being prepared. When staff change, nobody is quite sure which client's records are still sitting on whose laptop.

The cost of scattered records arrives at filing time: chasing clients for missing invoices, processing the same document twice, or posting it to the wrong period. And by the nature of the work, the practice holds sensitive data for many businesses — bank transactions, employees' identity numbers and salaries.

In Türkiye, these practices are run by licensed financial advisers (*mali müşavir*) who handle bookkeeping, tax returns and payroll for dozens or hundreds of client companies. The same problems apply to any accounting or bookkeeping firm with a large client base.

## What does a scattered document set-up cost an accounting firm?

Document volumes at accounting practices keep growing. According to the [Turkish Revenue Administration (GİB) 2025 Annual Report](https://cdn.gib.gov.tr/api/gibportal-file/file/getFileResources?objectKey=arsiv/fileadmin/faaliyetraporlari/2025/2025_faaliyet_raporu.pdf), the number of taxpayers using [e-Invoice](https://digitalbridge.com.tr/en/glossary.html#e-fatura) (*e-Fatura*, Türkiye's mandatory electronic invoicing system for businesses above certain thresholds) reached 1,937,308 at the end of 2025. Electronic invoicing removes the paper, but it does not reduce the number of files, emails and PDFs landing at the practice; the integrator and accounting-software side is covered in [e-invoice integration in Türkiye](https://digitalbridge.com.tr/en/blog/e-invoice-integration-turkey.html).

> According to Microsoft's 2025 Work Trend Index special report, the average worker receives **117 emails a day**, and is interrupted every 2 minutes during focus work by a meeting, email or notification. ([Microsoft Work Trend Index 2025](https://www.microsoft.com/en-us/worklab/work-trend-index/breaking-down-infinite-workday))

In an accounting practice, a large share of those emails carry attachments, and every attachment has to be filed somewhere. [Atlassian's State of Teams 2025](https://www.atlassian.com/blog/state-of-teams-2025) survey of 12,000 knowledge workers and 200 executives found that teams waste 25% of their time just searching for answers. In the week before a deadline, that lost time means overtime and the risk of filing late.

A scattered set-up also invites fraud. Practices that sit close to their clients' payments are natural targets for fake invoices and "our bank details have changed" emails. The [FBI IC3 2025 Internet Crime Report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf) records 24,768 business email compromise (BEC) complaints in the US in 2025, with total reported losses of $3.05 billion.

As of 2026, Türkiye does not publish a comparable regular statistic, but the method is the same. Verifying the invoice itself is covered in [fake invoice email scams](https://digitalbridge.com.tr/en/blog/fake-invoice-email-scams.html), and confirming a "bank details changed" instruction received on a client's behalf with a callback in [bank detail change email fraud](https://digitalbridge.com.tr/en/blog/bank-detail-change-email-fraud.html).

## How long must accounting records be kept in Türkiye? VUK, TTK and KVKK

An accounting practice in Türkiye has to weigh three pieces of legislation when it keeps records. The [Tax Procedure Law No. 213](https://www.mevzuat.gov.tr/mevzuat?MevzuatNo=213&MevzuatTur=1&MevzuatTertip=4) (VUK, Article 253) requires books and records to be kept for five years from the start of the calendar year after the one they relate to, and the [Turkish Commercial Code No. 6102](https://www.mevzuat.gov.tr/mevzuat?MevzuatNo=6102&MevzuatTur=1&MevzuatTertip=5) (TTK, Article 82) sets a ten-year retention period for commercial books and records.

The [Personal Data Protection Law No. 6698](https://www.mevzuat.gov.tr/mevzuat?MevzuatNo=6698&MevzuatTur=1&MevzuatTertip=5) ([KVKK](https://digitalbridge.com.tr/en/glossary.html#kvkk)) requires personal data to be accessible only to authorised people and disposed of properly once its purpose ends. A practice therefore has to keep records for a long time *and* keep access narrow; a written [data retention and disposal policy](https://digitalbridge.com.tr/en/blog/data-retention-disposal-policy.html) is where the two duties meet. A payroll folder that anyone can open on a shared drive is not just untidy; it is a compliance gap.

## How do you set up accounting firm document management? A six-step framework

Every practice works differently, but accounting firms whose document management runs smoothly share the same skeleton.

1. **Structure folders by client and period.** A proven layout: Client → Year → Month → document type (purchases, sales, bank, payroll, returns). Permanent documents — contracts, powers of attorney, incorporation papers — live in a separate "Standing Documents" folder.
2. **Receive documents through one door.** Set up a shared address such as `documents@` for client paperwork and tell your clients to use it. Our guide to [shared mailbox management](https://digitalbridge.com.tr/en/blog/shared-mailbox-management.html) covers how to run it, and [managing invoices in a shared inbox](https://digitalbridge.com.tr/en/blog/accounts-payable-shared-inbox.html) shows the same routine for invoice mail.
3. **Grant access by portfolio.** Each adviser and staff member sees only the clients they are responsible for. Payroll folders get an extra restriction.
4. **Switch off deletion and overwriting.** Only a few people can delete; a file uploaded under an existing name becomes a new version instead of replacing the old one. Our article on [document version control](https://digitalbridge.com.tr/en/blog/document-version-control.html) shows why this matters.
5. **Put client-facing emails through approval.** An email containing a tax assessment, a payment reminder or bank details should not go out without sign-off from the responsible adviser. How to set up that sign-off step is covered in our [email approval workflow](https://digitalbridge.com.tr/en/blog/email-approval-workflow.html) guide.
6. **Write down retention and disposal rules.** Record how long each document type is kept and how it is disposed of when the period ends. For the email side, see [email archiving compliance](https://digitalbridge.com.tr/en/blog/email-archiving-data-protection.html).

| Area | Scattered set-up | Structured document management |
|---|---|---|
| Receiving documents | Email, WhatsApp, USB, courier | One shared address, one repository |
| Finding a document | Ask a colleague | Client → year → month folder |
| Permissions | Everyone sees everything | By portfolio, payroll restricted |
| Accidental deletion | Gone for good | Restored from bin or version history |
| Invoice checks | Each PDF opened by hand | Fields extracted from the attachment |
| Staff leave | Records stay with the person | Access revoked from one place |

For official correspondence handled on a client's behalf, decide who monitors the KEP (registered electronic mail) inbox and how sent letters are stored; the details are in our [KEP guide](https://digitalbridge.com.tr/en/blog/registered-electronic-mail-kep-turkey.html).

## How does Digital Bridge set up document management for accounting practices?

Digital Bridge does not impose a ready-made package on accounting practices; we start by understanding how yours works.

- **Needs analysis:** together we map how many clients you serve, which channels documents arrive through and who is responsible for which portfolio, and turn that into a written proposal.
- **One structure for email and files:** we set up business email and document management on [Smart360](https://digitalbridge.com.tr/en/smart360.html), with a folder structure and permission matrix built around your portfolios.
- **Data protection:** we address access and retention rules for payroll and identity documents through our [data protection compliance consultancy](https://digitalbridge.com.tr/en/consultancy/data-protection-compliance.html).
- **High-volume paperwork:** where a practice handles large volumes of paper or photographed documents, we assess [document OCR](https://digitalbridge.com.tr/en/technology-hardware/document-ocr.html) solutions; where formal records registration and e-archiving are needed, we look at [document management system](https://digitalbridge.com.tr/en/software-solutions/document-management-system.html) projects; the difference is explained in our [paperless office guide](https://digitalbridge.com.tr/en/blog/paperless-office-document-management.html). How field extraction from invoices works is explained in [OCR invoice processing](https://digitalbridge.com.tr/en/blog/ocr-invoice-processing.html).
- **Security awareness:** we provide [cyber security](https://digitalbridge.com.tr/en/consultancy/cyber-security.html) training against fake invoices and payment diversion emails, and assess your email infrastructure against the [eight criteria for choosing business email](https://digitalbridge.com.tr/en/blog/business-email-how-to-choose.html).

## A filing week at an accounting practice with Smart360

Accounting and bookkeeping firms are among the sectors that [Smart360](https://digitalbridge.com.tr/en/smart360.html), developed by Digital Bridge, is aimed at. In a typical week before returns are due, correspondence runs through [SmartMail business email](https://digitalbridge.com.tr/en/smart360/smartmail.html), client records through [SmartFiles document management](https://digitalbridge.com.tr/en/smart360/smartfiles.html), and staff sign in to both with one identity (SmartID).

**Morning: the documents inbox.** Client emails collect in a shared `documents@` mailbox in SmartMail and are classified without any rules being written as first contact, invoice/payment, quote/tender, official correspondence, promotion or update. When an invoice PDF arrives, SmartMail extracts the parties, issue and due dates, subtotal, VAT, grand total, document number and tax number without the file being downloaded. A staff member checks the amount and saves the attachment in one click to that client's month folder in SmartFiles.

**Midday: dividing the work.** In SmartMail, every email is given an owner and a status (Open, Pending, Resolved), so it is clear which email sits with whom; team notes and mentions keep information such as "this client's rent withholding is missing" next to the email itself. Actions are logged, so it is clear who did what and when. Each staff member can be given nine separate permissions per mailbox, and delete and quarantine management are off by default for new assignments.

**Afternoon: preparing returns.** In SmartFiles, client folders are protected with eight independent permissions, set per person or per department: read, write, edit, delete, create folder, AI, history and notes. A junior can read and upload but not delete; only the responsible adviser sees the payroll folder. When the trial balance is uploaded again under the same name, it does not overwrite the previous file but becomes a new version, and the earlier one can be restored if needed.

For every document uploaded to SmartFiles, AI produces a four-part report covering a summary, key points, structure and notable details. A staff member with the AI permission can put a question such as "what is the annual increase in this lease?" straight to the document; the general approach is explained in [AI document analysis](https://digitalbridge.com.tr/en/blog/ai-document-analysis.html).

**Evening: the email to the client.** An email containing an assessment and payment details is sent through SmartMail's send approval to the responsible adviser. Approve, request changes with a reason, or reject — every step is logged with a date and time.

On the incoming side, SmartMail recalculates the SPF/DKIM/DMARC checks itself and also weighs signals such as look-alike domains, display-name impersonation and Reply-To mismatches, producing a security report that explains its reasoning.

When a staff member leaves, an administrator revokes their access from one place, however many products they use, and no client records remain on anyone's personal laptop. Each organisation's data is held in a separate database for each product, and documents are kept in S3-compatible object storage.

## Where should an accounting practice start with document management?

To start with accounting firm document management, take a quick inventory before your next filing deadline: how many clients, which channels documents come through, and who is responsible for which portfolio. [Get in touch](https://digitalbridge.com.tr/en/contact.html) with that list, and we will design a folder structure and permission matrix for your practice together, starting with one team as a pilot.

To buy the products directly, use the [SmartMail purchase page](https://smart360.com.tr/satin-al?urun=smartmail) and the [SmartFiles purchase page](https://smart360.com.tr/satin-al?urun=smartfiles); product details are on SmartMail.com.tr and SmartFiles.com.tr. The other topics in email and document organisation are gathered in our [Business Email & Documents guide](https://digitalbridge.com.tr/en/blog/topic/kurumsal-eposta.html).

## Frequently Asked Questions

### How should an accounting practice organise client folders?

The most common and sustainable layout is Client → Year → Month → document type. Documents that do not belong to a period — contracts, powers of attorney, incorporation papers — sit in a separate standing documents folder. What matters most is that the whole team uses the same structure and every document lives in one place.

### How long must accounting records be kept in Türkiye?

Article 253 of the Tax Procedure Law requires books and records to be kept for five years from the start of the calendar year after the one they relate to. Article 82 of the Turkish Commercial Code sets a ten-year period for commercial books and records. Documents containing personal data should be disposed of in line with KVKK and a written retention and disposal policy once the period ends.

### What should an accounting firm in Türkiye watch for under KVKK?

A practice processes personal data belonging to its clients' employees, such as identity numbers, salaries and bank details. Access should be limited to the responsible adviser, access should be logged, and documents should be disposed of properly once retention periods end. Payroll files on a shared drive that anyone can open are the most common gap.

### Can we read invoices received by email automatically?

Yes. SmartMail extracts the parties, issue and due dates, subtotal, VAT, grand total, document number and tax number from an invoice PDF without the file being downloaded. A staff member checks the amount and saves the attachment in one click to the right client's folder. If a practice processes very high volumes of paper or photographed documents, a tailored OCR solution can be considered as well.

### How do we stop a junior deleting client files?

Separate the right to delete from the right to read and write. In SmartFiles, delete is an independent permission, so a junior can be given read and write only, and payroll folders can stay closed to them altogether. Deleted files and folders come back from the bin, and overwritten files from version history. Limiting deletion to a few responsible people is enough.

### Does Smart360 need to be installed, and how do we buy it?

No server installation is needed; the account opens as soon as payment is confirmed and the organisation is managed from the tenant.smart360.com.tr panel. Expert help is available for setting up folders and permissions. Prices are shown monthly; current package, billing and payment terms are on the purchase pages at smart360.com.tr, and a practice can also request a quote.