Accounting document management software: what Australian firms should actually look for

In short: the right document management software for an Australian accounting firm captures every client document, email and approval into one record as the work happens, keeps that record intact and unchangeable for at least five years, and survives staff leaving and systems changing. The ATO's record-keeping rules, not a vendor's feature list, set the real requirement.

Every accountant in Australia can recite the five-year rule. Almost nobody quotes the sentences that come after it.

The ATO's record-keeping rules for business say the information in your records must not be changed, and must be stored in a way that protects it from being changed or damaged. Then comes the line that should be pinned above every software demo: you need to be able to reconstruct your original data if your record-keeping system changes over time.

Which means the regulator has already written your selection criteria. Not features. Survival. A client file has to survive an edit, a staff departure, an office move, and the software decision you make after this one.

What should an Australian accounting firm look for in document management software?

Look for six things: capture at the moment of creation, email filed against the client rather than the person, e-signatures that keep their evidence, retrieval in seconds, an audit trail the file keeps about itself, and continuity when someone leaves. Then test the seventh thing nobody demos: what happens when you change systems.

The rest of this guide takes each in turn, with the Australian rules that sit behind them and one boutique Australian firm's before and after.

What do the ATO's record-keeping rules actually require?

Most records must be kept for five years. The clock generally starts from when you prepared or obtained the record, or completed the transaction it relates to, whichever is later. So a record's life is usually longer than five years from the work itself.

Plenty of records go longer. Anything supporting a CGT position must be kept for at least five years after the asset is disposed of. Records for depreciating assets follow the asset for its whole life, then five more years. Carried-forward losses keep their supporting records alive until well after the loss is used. And the ATO's own guidance points out that other regulators' laws can require seven years.

Less quoted are the quality rules. Records must be stored so the information cannot be changed. You may be asked to show the safeguards you have in place. And if your record-keeping system changes, you are expected to be able to reconstruct the original data.

Here is what failing that test looks like. An ATO review asks a firm to evidence that a client's June super contribution reached the fund on time. The payment happened; the proof was a clearing-house receipt attached to an email in the inbox of someone who left in March. The record existed once. The firm just cannot produce it now, and "we had it" is not a category the ATO recognises.

The direction of travel is firmer, not softer. This month the federal government directed ASIC to tighten its oversight of accounting and audit practice, and since 1 July payday super has turned super contributions into a per-pay-run evidence job. Scrutiny at the top of the profession has a way of flowing downhill.

Tidy is how a client file looks. Defensible is whether it holds up on the day someone asks.

The six jobs the software has to do

Picture the last week of a BAS quarter. A client's fuel receipts arrive as photos in a text message. The draft activity statement goes out by email and the approval comes back as a scanned page, slightly on an angle. The working paper behind the GST adjustment is saved on someone's desktop as FINAL_v3_USE_THIS_ONE.

Every one of those is a record the ATO expects you to produce, unaltered, five years from now. That is the standard the software has to meet, job by job.

1. Capture at the source

The working paper should land in the client file at the moment it is created, not be reconstructed at year-end. Look for add-ins that file directly from Word, Excel and Outlook, so the save-locally-and-reupload dance never starts. Detail decays; the version captured as the work happens is the only one that holds.

2. File email against the client, not the person

Client correspondence scattered across personal inboxes and shared mailboxes is the most common gap in an otherwise tidy practice. The test: when a staff member leaves, does their client correspondence stay with the firm, threaded against each client, or does it walk out the door with the login?

3. Signatures that keep their evidence

Engagement letters, tax returns and financial statements need more than a squiggle. Look for signing that timestamps every step, records who viewed and approved what, and files the signed document back to the client record automatically. A signature you then have to find and file manually is half a control.

4. Find anything in seconds

The retrieval test is a question, not a feature list: when did we last do a risk review on this client, and has the signed engagement letter been filed? Search should read inside document content, so a phrase finds the file even when nobody remembers where it was put.

5. An audit trail the file keeps about itself

Who viewed it, who changed it, which version was sent, when it was approved. This should be a log the system writes automatically, not a report someone assembles under pressure. Proving what happened two years ago should be a scroll, not a search party.

6. Continuity when someone leaves

The client file belongs to the firm. Role-based access, a clean handover view, and nothing lost when a person or a laptop goes. For a sole practitioner the same job has a sharper edge: if something happened to you tomorrow, could someone pick up every client file cold?

Does it connect to the software your firm already runs?

Australian practices run a stack: a ledger and practice manager (for many firms, Xero and XPM), tax and BAS software, corporate compliance tools, Microsoft 365. A document system that does not connect to that stack does not reduce the number of places things live. It becomes the sixth.

So make the integration list before the shortlist. Write down every system a client document touches between arriving and being lodged, then ask each vendor to show the connection working, not to say it exists. The firms that switch successfully switch around their stack, not away from it.

The question to ask before you sign: what happens when you change systems?

Here is the uncomfortable data point. Switching research gathered by practice-technology commentator Jason Staats, from thousands of firms reporting what they moved from and whether they would recommend the move, found firms abandoning a newly adopted tool within a year is common, and even the best-retained app in his dataset kept only 88% of firms after twelve months. His conclusion: trust peer switching behaviour over vendor claims.

Now put that next to the ATO rule from the top of this article: you must be able to reconstruct your original data if your record-keeping system changes. The market says you may well change systems. The regulator says the records must survive it. Which means exit quality belongs at the top of your selection criteria, not the bottom.

Ask these in the demo, before price:

• How do our records come out, and in what structure?
• Do version histories, audit trails and captured emails survive an export, or just the documents?
• Who runs the migration in, and how long does it take?
• Does our old system stay live during cutover?
• What does support look like in month eleven, not week one?

You are not choosing a home for your documents. You are choosing what survives the next change.

What it looks like when it works: a boutique Australian firm

Cantor Carnevale, a boutique Australian practice serving 420+ businesses and individuals, runs 400 to 600 BAS and tax returns a year. Getting one document to a client used to mean printing it into one system, filing it into another, then publishing it through a third: up to three minutes per document, hundreds of times a season. Portals and passwords tripped up less tech-savvy clients, so e-signing was sometimes avoided altogether and the work reverted to email.

After moving to one continuous flow, documents go from preparation to signature in a single step, filing happens automatically, and signature status is visible without asking. The results: payment cycles more than 25% faster, because work is billed sooner, and around 50 hours a year saved per accountant, worth $5,000+ per accountant at $100+ an hour.

"It's so intuitive - we never get questions back asking how to use it," says Laura Carnevale, the firm's director and principal.

Which means the return on a document system is not tidiness. It is billed work leaving the building faster, and evidence that files itself.

Where Workiro fits

Workiro is document management built for accounting and professional-services firms. Each client gets one record holding their documents, emails, tasks, approvals and signatures, with the audit trail written automatically as work happens. It connects to the tools Australian firms already run, including Xero, and clients sign and share through secure links with no portal, password or account. Migration is assisted, firms are typically up and running within 21 days, and your old system stays live during cutover.

Book a demo and bring a real client, ideally a messy one. We will show you what their file looks like when the documents, emails and approvals live in one place, and what you would hand the ATO if they asked. Not demo-ready yet? Read how Cantor Carnevale went from three minutes per document to one continuous flow, or start with what a document management system actually is.

Common questions

How long do accountants need to keep client records in Australia?

Most business records: five years, starting from when the record was prepared or obtained, or the transaction completed, whichever is later. CGT and depreciating-asset records run longer, sometimes fifteen years or more across an asset's life, and the ATO notes other regulators can require seven. If your firm builds working papers that link evidence as they are made, the retention question mostly answers itself.

What is a defensible client file?

One that can prove itself: the documents, the emails around them, who approved what and when, all in one auditable record. The distinction that matters is tidy versus defensible; a folder structure can be tidy and still unable to show who signed off a set of accounts. More in our guide to document management systems.

Does document management software work with Xero Practice Manager (XPM)?

Purpose-built systems connect to the Xero ecosystem so client records stay linked rather than re-keyed. Workiro integrates with Xero Practice Manager, which lets a firm keep its practice stack and add one place where the documents live.

Do clients need a portal login to sign documents?

Not any more. Modern systems send a secure link; the client opens it and signs, with nothing to remember. That is consistently what wins over less tech-savvy clients, and it is why firms that had given up on e-signing pick it back up. See how it works in client onboarding.