“Multi-user accounting software” was once a simple feature — could two people log in at the same time without crashing each other’s session? In 2026 the question is more useful than that. Multi-user really means: who can see what, who can change what, who approves what, how do you audit who did what, and how does the software keep an accountant working from another office (or another country) productive without giving them keys to the kingdom. The headline “supports multi-user” tells you almost nothing about whether the product actually solves these problems.
This guide covers what HK accounting software’s multi-user features actually need to handle for a typical SME — what concurrent multi-user means in 2026, role-based access control as the central mechanic, the remote-accountant access pattern that’s almost universal in HK, the audit trail that makes “who did what” answerable, security and authentication considerations, and the demo questions that surface real capability. The framing is the SME with 2–10 people touching the books, not the listed-company finance department with 50 seats.
What “multi-user” actually means in 2026
Three structurally different things hide under the “multi-user” label in vendor marketing.
Concurrent logins. Multiple users can be authenticated and active in the software at the same time. The minimum viable multi-user. By 2026 every cloud accounting product handles this well; some on-premise legacy products still struggle, particularly with concurrent edits to the same record.
Per-user identity and audit trail. The software knows which user did each transaction. Postings, edits and deletes are stamped with the user’s identity and timestamp. This is what lets the auditor — or you, when investigating an error — answer “who entered this and when?” Identity is the prerequisite for any meaningful permission control.
For an SME owner-operator, the per-user-identity check is the single most important multi-user feature. A common pattern is that everyone shares a generic “admin” login because it’s simpler — and then when something goes wrong, no one can tell who did what. The fix is uncomfortable but cheap: every regular user gets their own login.
Role-based access control. Different users see different parts of the software, and can do different things, based on the role assigned to them. The bookkeeper can post invoices but not edit master data; the director can see all reports but not enter day-to-day transactions; the external accountant has read-only on the master data with full access for journal entries during month-end. This is where the productivity gain actually lives.
Role-based access control
The standard role set that most HK SMEs end up with after some experience:
- Director / Owner — full read access to all reports, ability to approve high-value transactions, ability to manage user permissions. Often does not enter day-to-day transactions; the value of the role is oversight, not operations.
- Bookkeeper — full posting access (invoices, payments, expenses, journals), read access to most reports, no ability to change user permissions or modify GL chart of accounts. The day-to-day operator.
- Sales / AR clerk — invoice creation and AR-side workflows, read access to customer records, no access to bank or supplier-side data. Useful when sales and finance are separate teams.
- Approver / Manager — read-only on most data, with the ability to approve or reject pending transactions above a threshold. Useful for SMEs that have implemented purchase-approval workflows.
- External accountant / auditor — read-only on most data, plus the ability to post journals to a defined set of accounts (typically year-end accruals, depreciation, deferred tax). The pattern that lets your accountant work without you handing over the master password.
- System admin — manages user accounts and permissions but doesn’t see transaction-level data. For larger SMEs that separate IT administration from finance.
The accounting software requirement is that these roles can be configured (not just chosen from a fixed list), that permissions can be set at a useful level of granularity (per-module is fine; per-transaction is overkill), and that changing a user’s role is straightforward. SMEs whose software offers only “all access” or “read-only” are forced to over-share or under-share.
Remote accountant access — the standard HK pattern
The single most common multi-user pattern in HK SMEs is the “external accountant” arrangement. The SME has its own books in its accounting software; the external CPA firm or bookkeeper accesses the software to do month-end work, year-end audit prep, and tax-return preparation, without anyone shipping data files back and forth.
The three approaches in 2026:
- Cloud accounting native multi-user. The cleanest option. SME pays for the seats; accountant logs in with their own credentials; the access is logged and revocable. Default for Xero, QBO, Giga and most modern cloud products.
- On-premise with VPN access. Legacy desktop products where the accountant connects to the SME’s network via VPN and runs the software remotely. Workable but creates security and version-management headaches.
- Email-attached data files. The “send me your QuickBooks file” approach. Common for older sole-practitioner accountants. Manageable for small workloads but breaks down at any scale, and loses the audit-trail benefit because changes happen in different file copies.
For an SME choosing accounting software in 2026, native cloud multi-user with role-based access is the default to look for. The marginal cost of an additional accountant seat (typically HK$50–200/month) is trivial compared to the operational benefits.
The HK-specific consideration: the external accountant may be working from a different jurisdiction (mainland China, Singapore, UK, etc.) for an HK-incorporated SME. Geographic restrictions on the software’s access — some products geo-block by IP — can be a real problem. Verify in the demo.
Audit trail — what “who did what” actually requires
Multi-user without audit trail is worse than single-user with no audit trail, because the dispersion of who-did-what creates the illusion of accountability without the substance.
The audit-trail features to verify:
- Every transaction has a created-by + created-at stamp that cannot be edited.
- Edits are versioned — the original transaction is preserved, the edit is shown as a new version with edited-by + edited-at, and a third party can reconstruct the original.
- Deletes are soft, not hard — a deleted transaction is marked deleted but retained, with a deleted-by + deleted-at stamp, so the record exists for audit even when the live ledger doesn’t show it.
- User access logs — who logged in, from where, when, and what they viewed. Often a separate log from transactional audit trail.
- Reports cannot be silently edited — a report run today and again tomorrow on the same period should produce identical numbers unless the underlying data has changed (in which case the change is documented).
For Section 51C records-retention purposes (see our profits tax guide for the underlying obligation), the audit trail itself is part of the records that must be preserved for 7 years. Software that allows transactions to be edited without retaining the original edit history is technically at risk on this point.
Security and authentication
Multi-user expands the attack surface compared to single-user; the security model has to compensate.
The security features to verify:
- Mandatory or optional two-factor authentication (2FA). By 2026 mandatory 2FA on at least the admin role is the expected standard. Software that doesn’t offer 2FA is genuinely behind.
- Password policy. Minimum length, complexity, expiry, can-be-reset-by-self-or-admin. SMEs often want central admin control over password resets to avoid the support load of users locked out.
- Session timeout. Idle session times out and re-authentication is required. Typically configurable (15 min for high-security shared computers, longer for trusted personal devices).
- IP whitelist / geo-blocking. Some SMEs want access restricted to office IP ranges or HK / a specific list of jurisdictions. Useful for high-sensitivity engagements but can become a friction source if remote work is normal.
- Single sign-on (SSO). For SMEs already using Microsoft 365 or Google Workspace, SSO via SAML or OAuth removes a credential to manage and centralises access control. Increasingly common in 2026.
- Data residency. Where the data is physically stored. PDPO compliance for personal data; some HK regulated entities have stricter residency requirements. See our API and integrations guide for the broader data-residency framing.
Demo questions to surface real capability
A 30-minute demo with the following test set surfaces real multi-user capability:
- “Set up three users with three different roles.” Create a director (full access), bookkeeper (posting access), and external accountant (read-only with journal access). Watch how granular the permissions actually are.
- “Show me the audit trail on a transaction that’s been edited.” Vendor should produce both the current state and the edit history with user stamps. If only the current state is available, the audit trail is thin.
- “Walk me through the 2FA setup.” Mandatory or optional? How does the recovery flow work if a user loses their authenticator?
- “Show me a deleted transaction.” Vendor should be able to retrieve a soft-deleted record. If “delete” is permanent, audit trail is incomplete.
- “What’s the access pattern for an accountant working from Mainland China?” Geo-blocking, VPN requirement, performance over slower connections.
- “Show me the user-access log.” Last 30 days of logins, successful and failed, with IP and timestamp.
How Giga Accounting by 凌峰會計 can help
Giga Accounting by 凌峰會計 ships role-based access control with configurable role definitions, per-user identity with full audit trail (created/edited/deleted stamps with user + timestamp, version history on edits, soft-delete preservation), mandatory 2FA on admin roles, optional 2FA on standard roles, configurable session timeouts and IP whitelist, SSO integration via SAML, HK-resident data storage as standard, and the external-accountant role pre-configured for the typical CPA-firm engagement pattern. Multi-user is included in the standard licence — the calculation is that an accounting product that gates its security and access model behind a higher tier is letting the wrong constraint drive an SME’s compliance posture.
Get in touch for a 30-minute demo focused on multi-user setup against your team structure, or see our flat per-company pricing. For the related mobile-UX feature where multi-user identity matters across devices, see our mobile apps for HK accounting software guide; for the broader API + data-residency context that frames remote-access security, see accounting software API and integrations; and for the features-checklist hub where role-based access sits as a 7th-modern-feature must-have, see essential features of accounting software for HK SMEs.
