A redaction checklist for accounting and audit teams

Accounting and audit work runs on documents full of other people's data: payroll extracts, bank statements, invoices, expense claims, contracts. Much of it has to leave the firm, to a client, an auditor, a regulator, a lender or a buyer. This checklist is a starting point for sending only what's needed.

Before you start

• Confirm what the recipient needs. An auditor sampling payroll may need ten employees' records, not the full extract. A buyer's adviser may need totals, not names.
• Agree on the format. A PDF of the visible pages is safer than a live spreadsheet, which can carry hidden tabs and rows.
• Work on copies, named so it's obvious which version is safe to send.

What to look for

Document	Usually hide	Usually keep
Payroll extracts	Employee IDs, national ID and tax numbers, bank details, home addresses	Pay figures, cost centres, the sample being tested
Bank statements	Account numbers, IBANs and sort codes (except the last digits), counterparties not in scope	Dates, amounts, the transactions being evidenced
Invoices and expenses	Personal card numbers, home addresses, personal phone numbers	Supplier, amount, date, VAT or tax details
Contracts	Signatures, personal contact details, unrelated pricing or schedules	Parties, key terms, dates
Ledgers and reports	Names of individuals where codes would do, hidden columns	Account codes, balances, the period

The redaction routine

1. Search, don't scan by eye. Search for names, account numbers and the last digits of IDs to find every instance, including headers and footers.
2. Redact consistently. If the same document appears in several packs, redact it once and reuse that version.
3. Remove, don't cover. Use a tool that removes content. A box drawn over text, or black highlighting, often leaves the text in the file.
4. Clean hidden data. Run a document inspector on Office files, and check PDFs for comments, attachments and metadata. See removing hidden metadata.
5. Have someone else try to break it. Select all, copy and paste each file, and check the properties, before anything leaves.
6. Keep a record of what was sent, to whom and what was removed, without copying the sensitive values into the record.

After it's sent

• Track where copies went, so you can ask for them back or deleted if something was wrong.
• Fix mistakes fast. Agree in advance who can recall a file and how.

Where Ombly fits

Ombly suggests names, account numbers, IBANs, national IDs and your own reference patterns across every page, lets a reviewer accept each one, and exports copies rebuilt from pixels, with nothing hidden underneath. For firms, it runs on your own servers and logs what was removed, by category and page. Book a call to try it on a real pack.