Auditors collect evidence three ways: email, the portal bundled with their tax software, or a dedicated data room. Here's an honest risk comparison of all three, and when each one is defensible.
Walk into any accounting firm and ask how client documents arrive. You'll get some blend of three answers: email attachments, the client portal bundled with the practice management suite, and, at firms that have modernized their audit practice, a dedicated data room.
Most firms run all three at once, which means their real security posture is defined by the weakest channel in active use. This post compares the three honestly, across the dimensions that actually matter for audit evidence: security, evidence integrity, workflow fit, client friction, and cost.
| Dimension | Client Portal | Data Room | |
|---|---|---|---|
| Encryption in transit | Usually (TLS, not guaranteed end to end) | Yes | Yes |
| Encryption at rest | Depends on mailbox | Yes | Yes (AES-256 standard) |
| Access control | None after send | Per-client login | Granular, per-folder, per-role |
| Version history | None (versions = new attachments) | Basic or none | Full chains, uploader + timestamp |
| Activity logging | None | Login-level | Document-level, exportable |
| Request tracking | Manual (Excel) | Limited | Native PBC workflows on better platforms |
| File size limits | 20-25MB typical | Generous | Generous |
| Client friction | Zero | Low-medium | Low-medium |
| Evidence defensibility | Poor | Moderate | Strong |
| Incremental cost | "Free" | Bundled | $1,200-$20,000/year |
The rest of this post is the reasoning behind each row, plus the honest cases where each channel is fine.
Email persists because it has literally no adoption barrier. Every client contact can use it today. That's the entire case for it, and for low-sensitivity items it's a real case.
The risks stack up fast for audit evidence, though:
Security. TLS covers most hops in transit, but you control neither the client's mailbox security nor where the attachment gets forwarded. A payroll register emailed to the engagement senior now lives in at least two mailboxes, any phone synced to them, and every forward. Business email compromise remains the most common incident type reported by accounting firms' insurers, and attachments are exactly what attackers exfiltrate.
Evidence integrity. Email gives you no version chain and no reliable receipt trail. When the client sends "AR_aging_FINAL_v3.xlsx" after staff already tested v2, reconstructing which version supports the workpaper means archaeology in someone's inbox. Under PCAOB or peer review inspection, "we believe we received it around March 4" is a weak sentence.
Workflow. There is no workflow. The PBC tracker lives in Excel, separately, and is perpetually stale. Size limits mean large GL exports fail silently or arrive via whatever consumer file-sharing link the client reached for, which is worse than email.
Where email is defensible: scheduling, engagement letters going out for signature via a proper e-sign tool, and genuinely non-sensitive correspondence. As a channel for trial balances, bank statements, and payroll data, it fails any serious risk assessment, and most firms' own security policies already prohibit it. The gap between policy and practice is the finding.
The portals bundled with tax and practice management suites solved email's headline problem: files now travel and rest encrypted, behind per-client logins, on infrastructure with real certifications.
For a tax practice, that's most of what's needed: an organizer goes out, source documents come back, the return goes out for signature. Portals are genuinely good at this.
For audit evidence, three gaps remain:
Request tracking. A typical portal knows "files exchanged with Client X." It doesn't know that item 3.02 of a 280-item PBC list is still outstanding, who on the client side owns it, or that the version uploaded yesterday supersedes the one staff tested. The parallel Excel tracker survives, and with it most of the workflow cost, which is the actual expensive problem. (See our full walkthrough of running PBC lists through a data room for what request-level tracking replaces.)
Granularity. Portals typically offer one access level per client contact. Audit engagements need section-level separation: the AP clerk uploads bank items and shouldn't browse executive compensation; the component auditor sees their component only. Portals mostly can't express this.
Evidence-grade logging. Portals log logins and sometimes downloads. Data rooms log document-level events (view, upload, version, download, by whom, when) and export them, which is what turns the collection channel itself into part of the audit evidence.
Where portals are defensible: tax and CAS practices, small review and compilation engagements, and as the firm-wide default for routine document exchange. Firms doing real audit work usually keep the portal for tax and add a data room for the audit practice.
A virtual data room is what the portal becomes when you add granular permissions, version chains, document-level logging, and (on audit-oriented platforms) native request tracking.
Security. SOC 2 Type II and ISO 27001 certifications, AES-256 at rest, enforced MFA, watermarking, and access that can be scoped per folder, per role, per person, and time-boxed. How these certifications map to actual regulatory obligations is covered in our guide to data room compliance across GDPR, HIPAA, and SOC 2.
Evidence integrity. This is the decisive advantage. Every document carries a version chain with uploader identity and timestamps; every access is logged; the whole trail exports into the audit file. "Version 2, received March 4 at 14:32 from the controller, tested March 6" is a sentence an inspector accepts.
Workflow. On platforms with request tracking, the PBC list and the collection channel merge into one object: each item has a status, an owner, a due date, and automated reminders. The Excel tracker dies. Partners get a live completion dashboard. This, more than security, is what pays for the tool.
The honest costs. Money: roughly $1,200/year for small-practice tools like Digify or Papermark, up to $10,000-$20,000/year for firm-wide flat subscriptions from providers like Firmex. Friction: clients need one more login, so platform simplicity is a selection criterion, not a nice-to-have; a data room too clunky for the client's bookkeeper drives files straight back to email, and you've paid for security you're not getting.
Our guide to the best data room for audits and accounting firms ranks the providers by firm size and engagement volume.
Frame the decision the way you'd frame any control investment:
The control costs less than the waste it removes, ignoring the tail risk entirely. That's an unusual place for a security investment to be, and it's why the audit-practice migration to data rooms is happening quickly at mid-market firms.
Realistically, firms keep all three channels. The mature posture is explicit routing rules:
Write it down, name the channels, and audit compliance once a year by sampling engagement inboxes. The policy that exists only as culture is the one the newest staff member has never heard of.
Email is a correspondence tool, portals are an exchange tool, and data rooms are an evidence tool. Audit evidence has requirements the first two were never built to meet: version chains, document-level logs, section-level access, and request tracking.
The good news is that the upgrade pays for itself in recovered chase time before you ever count the risk reduction. The firms still running audits through inboxes aren't saving money; they're just paying in a currency that doesn't show up on an invoice until the day it very much does.
VDR'er håndterer dine mest følsomme dokumenter. Her er, hvad der faktisk kan gå galt, hvilke trusler der er overdrevne, og hvordan førende udbydere beskytter mod virkelige angreb.
Email er stadig hovedkanalen til at dele datarumsadgang med købere og investorer. Disse VDR'er integrerer med Outlook og Gmail, så du kan invitere reviewere og spore engagement direkte fra din indbakke.
Enterprise-sikkerhedsteams kræver Single Sign-On til alle cloud-applikationer. Disse VDR'er understøtter SSO- og Okta-integration, så IT kan administrere adgang, håndhæve MFA og bevare et rent audit trail.
Hvordan vil sikker dokumentdeling se ud i 2030? Vi udforsker nye teknologier - decentraliseret lagring, zero-knowledge proofs, AI-risikoscorer - og adskiller reel innovation fra sci-fi-spekulation.