Custom user permissions in QuickBooks Online Advanced for nonprofits

Custom user permissions in QuickBooks Online Advanced for nonprofits

As a QuickBooks ProAdvisor® focused on nonprofits, I am always interested in exploring changes to the software and how these changes can benefit my clients. It can be an exciting challenge to stay up to speed with the rapid improvements in the QuickBooks® Online product lineup, while brainstorming how these improvements can make a difference for nonprofits, either by streamlining workflows, increasing the strength of internal controls, or some combination of the two.

There are a lot of things I am excited about in QuickBooks Online Advanced, including the vast increase in the number of users and the addition of custom user permissions. Giving the right people the right access to JUST the right tools increases productivity and internal control – so it’s a win WIN WIN!!

QuickBooks Online Plus allows for five users plus two accountant users. Advanced blows this up, giving us THREE accountant users. This is helpful for those awkward transitions from one firm to another, or when working with both an auditor and a bookkeeping firm that hasn’t yet figured out how to manage their team in QuickBooks Online Accountant. Advanced also allows a full 25 organizational users. Reports-only and time tracking-only users don’t count against these limits (I know, WOW!!).

For most nonprofits, just the sheer number of users in Advanced may seem like an embarrassment of riches. We may have a hard time getting our heads around the idea of a finance department that would need 25 users simultaneously accessing the data file. It could seem absurd!

But, think about this: Having 25 users opens up the new Receipts feature to a world of possibilities. Organizations that aren’t already using an add-on app such as Tallie or Expensify to manage expense reports can set up each of their credit card holders as at least a standard user with vendor permissions, and get them registered to email-in or upload their own receipts by downloading the QuickBooks app and snapping images of their receipts right from their phones.

The Executive Director has yet another meeting at the corner coffee shop? She can forward the Square receipt directly to QuickBooks Online. The Program Director can capture the image of his parking receipt while heading into his meeting. The entire team saves the time they had been spending managing piles of crumpled receipts, and the data is increasingly real-time and actionable. Having receipts and other source documents attached directly to transactions in QuickBooks Online Advanced (and Plus) is exponentially easier than digging through the file cabinet – or, let’s face it, the foot-high stack in the corner – when someone has a question about an entry.

In addition to the number of user seats available with QuickBooks Online Advanced, we also get access to custom user permissions. These allow us to get a lot more granular in what our users are allowed to do.

QuickBooks Online Plus has a few different kinds of Users that count against the active limits. Admin users, who can access all parts of QuickBooks (because of their full access, these users should be extremely rare), and standard users, who can have full access, no access, or limited access to either customer or vendor activity, or to both. Complete information on what these Plus users can and cannot do can be found here.

QuickBooks Online Advanced gives us the same user permissions we had in Plus, as well as the ability to create custom user permissions. It’s interesting to consider these custom permissions and where they might be a good fit. While full details can be found here, let me give you an overview and some use cases for the different options.

Bank Deposits Only That’s it. That is all this user can do. They can see the bank deposit screen and nothing else.

  • Sales
    • No access. Simple enough. This user has no access to any sales activity. They can’t create or edit customers, create or edit products & services, or enter any sort of sales form.
    • All access. This user can create customers, enter sales receipts, invoices and estimates, and receive payments, but they can’t record deposits unless they are ALSO given access to Bank Deposits. They can record credit memos or refund receipts, but they can’t print checks – not even refund checks. They can adjust and even overwrite sales tax in transactions, but they can’t set up sales tax or file sales tax returns. This separation of duties is interesting. I think it is a good control that they are unable to actually cut refund checks or checks of any kind. Unlike a standard user with all access to customers, this user cannot access reports unless also granted that permission.
    • Invoice. This user has full access to products, services, and customers. While they can invoice, they can’t add billable time or expenses or apply delayed charges or credits. They can’t receive payments, make deposits, or access any reports. The inability to add billable time and expenses limits the functionality of this user type when it comes to invoicing reimbursable grants. Still, this would be a useful user type in situations where an organization does a lot of invoicing for program revenue: schools invoicing for tuition, or membership organizations sending out dues invoices. It creates a clearly delimited user, and is work that could be given to a volunteer without concern of them accessing the organization’s larger financials.
    • Estimates. This user can only create, edit, and send estimates. It’s rare that nonprofits create estimates in the traditional sense, but many do use them to do progress invoicing on reimbursable grants. I can see the benefit of giving this sort of access to a Grants Manager, who could be made responsible for entering the estimate in alignment with a grant budget.
  • Expenses
    • Full access. This user can enter bills and cash or credit card transactions. They can pay bills and write and print checks, although they also cannot print refund checks. (That would require at least a standard user with all access.) They can pay sales tax, but cannot set up new agencies or adjust sales tax settings. They can create and edit vendor records, as well as products and services. The limitations on this user make it an excellent choice of role for an Accounts Payable Clerk. They can enter all expenses, without accessing bank registers or overall income and expense information. While from a control standpoint, I’d like the option to separate the ability to manage vendors from that of entering and paying bills (we know that A/P fraud – creating fictitious vendors who submit plausible invoices that are then paid – is an area of significant risk), I’m optimistic that we may see that in a future iteration.
  • Reports
    • Sales and customer reports. With Advanced, you can keep the right information in the right hands. This user has access to common sales and customer reports, but NOT to overall company financials. This could be the user profile of someone in the Development Department. They would be able to pull their own sales reports, filtered for contribution services, to reconcile with the donor database.
    • Expense and vendor reports. This user has access to all the common vendor reports such as unpaid bills, bills and applied payments, or purchases by vendor, but NOT to overall company financials.The key with the menu of custom user permissions is to realize that they can be used alone or in conjunction to create the perfect level of access for different team members.One person might only be able to invoice. Another might have all access to Sales plus Bank Deposits, so they can create sales receipts and receive payments as well as record the deposits, but might not need access to reports. One might have full Vendor access, plus the ability to review purchasing reports. There might be a situation where a contractor is given access to Expense and Vendor reports in order to review the organization’s purchasing and make recommendations on more inclusive procurement.

If you are like me, you may have struggled to understand specifically what was different between say, a standard user with customer access and a custom user with some level of Sales access. In this case, pictures are worth a thousand words.Below you can see what the Dashboard looks like for a standard user with access limited to customers. While they have a full list along the left hand side, they don’t have access to the Expenses tile, and the Banking tile doesn’t even show up. Also below is what you would see for this user in the Quick Create menu:

Note that a standard user with customer access does NOT have access to Bank Deposits, Transfers, or Journal Entries. They would need to be an admin user for that.

Below is what the Dashboard looks like for a custom user with Sales, Bank Deposit, and Customer Reports access. Notice that they don’t even see the Banking, Expenses, or Accounting Centers along the left-hand side of the screen. Their options in the Quick Create menu look like this:

Unlike a standard user with customer permissions, this user is able to make bank deposits without having admin access to the full data file.

Historically, our clients have been limited with access to only five users, and our sense of what they should have access to has, necessarily, been fairly broad. With the seeming plethora of users available in QuickBooks Online Advanced, we have the freedom to give more limited access to a larger number of people. A thoughtful application of these new options will improve internal controls, and leave us, the nonprofit ProAdvisor pros, helping as the heroes!