The Access Register: Delegating Admin Without Becoming the Bottleneck

Delegation rarely fails because a virtual assistant lacks capability. It fails because the business owner remains the only person who knows where the digital keys are kept. When a invoice query, payroll deadline or HMRC letter needs attention, the assistant has to wait for a call back, a forwarded email or a password sent by text message. The admin slows, the owner is interrupted, and the firm becomes dependent on one person being available.

An access register solves that problem. It is a controlled inventory of the systems your virtual assistant needs to use, the level of access required, and the route by which access is granted and recovered. It is not a password spreadsheet. It is a continuity document that makes delegation possible without turning every routine task into an escalation.

For a small UK firm, building a usable first version is a one-hour defensive exercise. The aim is not perfection. The aim is to identify the digital spare keys, record them responsibly and test whether someone else could keep the admin moving if you were unavailable.

An access map is a continuity document, not a password list

Most owners already hold the necessary information in their heads. They know which bank account feeds the accounting software, which email address receives Companies House correspondence, and which payroll portal needs a code sent to their mobile. That knowledge is useful until it is needed by anyone else.

An access register records the map, not the secret itself. For each system, it should say what the system is for, who owns it, what access the assistant needs, and how access is granted. Passwords and recovery codes belong in a secure password manager, not in the register. The register tells a competent person where to look and what to request; the password manager controls the credential.

This distinction matters for UK data protection and cyber security. A document listing every password in plain text is a liability. A register that names systems, roles and review dates is a management tool. It supports the principle of least privilege: the assistant receives the access needed for the task, not the keys to the entire business.

What to record for each system

A practical register can sit in a spreadsheet or a secure internal note, provided it is itself access-controlled. The following fields are usually sufficient:

• System or account: the bank, accounting platform, payroll portal, shared drive, email, calendar, CRM, e-signature tool or social media account.
• Business purpose: why the firm uses it and which recurring tasks depend on it.
• Owner: the person accountable for the account, usually the director or a named manager.
• Assistant access level: read-only, standard user, approver, or no access.
• Authentication method: password manager entry, single sign-on, two-factor authentication app, or hardware key.
• Recovery route: the nominated email address or mobile number used for account recovery, recorded without exposing the code itself.
• Review date: a fixed date for checking that access is still appropriate.
• Notes: known restrictions, such as bank accounts that require dual approval or HMRC authorisations that sit with the agent rather than the assistant.

Not every system belongs on the list. Include what the assistant genuinely needs for admin support. Exclude personal banking, personal email and any platform unrelated to the delegated work. For finance, read-only bank access is often enough for reconciliation preparation. For payroll, the assistant may need to prepare changes but not approve the final run. The register should make those boundaries explicit.

A one-hour build for a small UK firm

Start with thirty minutes of inventory. List every system that touches the admin workload: email and calendar, shared files, accounting, payroll, VAT, Companies House filings, HMRC correspondence, customer records, e-signatures and any sector-specific portal. Mark each as essential, occasional or unnecessary for the virtual assistant.

Spend twenty minutes completing the fields for the essential systems. Do not attempt to document every login in the business. Focus on the accounts that would stop work if the owner disappeared for a week. For each one, decide the minimum access level and the secure sharing method. If two-factor authentication is available, record how the second factor will be handled without the assistant relying on the owner's mobile phone.

Use the final ten minutes to test the map. Ask a simple question: if the assistant needed to download a bank statement, raise a sales invoice or check a Companies House filing deadline today, could they do it without calling me? If the answer is no, the register has identified the next task.

Sharing access without creating new risk

Secure sharing begins with named accounts. Shared logins make it impossible to audit who did what, and they become dangerous when someone leaves. Where the platform allows it, create a named user account for the virtual assistant and assign the minimum role required.

Use a reputable password manager with a shared vault rather than sending credentials by email, text message or chat. Grant access to individual entries, not the entire vault, and remove access when the task ends. For banking, request read-only access where possible. For accounting software, separate preparation from approval. For HMRC and Companies House, use the official authorisation routes rather than sharing personal Government Gateway credentials.

Two-factor authentication should be enabled on important accounts. The register should state whether the second factor is an authenticator app, a hardware key or a code sent to a nominated business phone. Avoid making the director's personal mobile the only recovery route. That arrangement works until the director is on a train, in a meeting or on holiday.

Finally, record the offboarding step. When an engagement ends, the owner should know which accounts to revoke, which vault entries to remove and which authorisations to cancel. A register without an exit process is only half a control.

Removing the owner as the single point of failure

The test of an access register is not whether it looks tidy. It is whether the business can continue when the owner is unavailable. A useful addition is a break-glass procedure: a short, approved route for urgent access when normal channels are unavailable. This might involve a second director, a nominated family member or a professional adviser holding sealed recovery information. The procedure should be documented, limited to genuine emergencies and reviewed regularly.

Keep the register current at natural change points: a new starter, a change of bank, a payroll transition, a software migration or the end of a tax year. A quarterly review is usually enough for a small firm. The review should confirm that named users are still correct, that leavers have been removed and that recovery details still work.

For UK firms handling personal data, the register also supports accountability. It shows that access is deliberate, documented and reviewed. If a device is lost or an account is compromised, the firm can quickly identify what was accessible and take action. That is a more defensible position than discovering that a former assistant still had access to the customer database.

The practical outcome

An access register is not an administrative luxury. It is the difference between a virtual assistant who can keep invoices, filings and correspondence moving and one who has to wait for permission. The one-hour investment produces a clearer division of responsibility, safer credential handling and a business that is less dependent on the owner's memory.

Start with the systems that would cause immediate difficulty if you were unreachable for a week. Record the map, store the credentials securely, test one task and set a review date. The digital spare key should be available to the right person, under the right controls, without a phone call to the director.