How do I prepare an access handover without sharing personal eFiling passwords?

Define the work and authority being handed over

Start with the reason for the handover. Changing accountants, replacing a public officer and moving work between employees are different events. Identify who will perform the work, who may approve it and which taxpayer records are involved. Do not assume that one change automatically completes all the others.

Prepare a scope statement listing the company, tax types, periods and tasks. For example, an adviser may handle company income tax while an internal payroll team handles employer submissions. The access arrangement should support those responsibilities without giving everyone the same permissions merely because it is convenient.

The SARS profile-management guide describes organisation users, representative activation and tax-type access. Use the applicable process for the actual relationship. A personal password handed to a colleague does not document a mandate or establish a separate record of who performed an action.

Create an access inventory without collecting passwords

Record the people and roles currently connected to the company's tax work. Include the registered representative, internal users and external practitioners, along with the functions they need. Keep personal passwords, one-time codes and recovery secrets out of this inventory.

Compare the inventory with what the authorised company representative can actually see. An old engagement letter may not reflect current access, and an employee may retain permissions after their work changed. Mark discrepancies for correction rather than treating the spreadsheet as proof that the system already matches it.

Confirm the company’s representative and contact records

Check that the representative record identifies the correct person and capacity. If the public officer is changing, complete the appointment and SARS update process as its own task. Our guide to a public officer's departure covers that handover.

Review where company correspondence is sent and who monitors it. Keep the company's notice process under appropriate business control. At the same time, distinguish correspondence details from an individual's security contact details. Replacing every contact field with a shared office mailbox may interfere with the authentication arrangement rather than solve the company's notice problem.

SARS's profile guide expressly distinguishes correspondence and security details. Follow the appropriate update process for each. Confirm that the authorised person can complete their own verification, and that company notices reach people assigned to act on them. Possession of an email address or phone number alone should not be treated as proof of authority over the taxpayer.

Who controls access when the accountant changes?

The company should maintain a clear, authorised representative and an accurate account of which practitioner may act. A departing accountant's personal login should not become the incoming accountant's login. Use the SARS tax-type transfer process and the appropriate practitioner arrangement for the selected work.

Before approving a request, verify the requesting party, taxpayer and tax types. Read the authority or power of attorney presented. Approve only the work the company has agreed to assign, using the authorised person's own authentication process. Record the result and check the resulting access rather than treating a request marked awaiting authorisation as complete.

Ask the outgoing accountant for the relevant returns, calculations, correspondence and open-work list. Agree who will handle work already in progress during the transition. A transfer of portal access does not explain a pending objection, missing invoice or payment arrangement without the underlying records.

If access cannot be obtained through the ordinary process, use SARS's official assistance route with the entity and authority evidence. Identify the precise obstacle: an incorrect representative, inaccessible security contact, pending request or missing permission. Do not attempt to solve an authority problem by using someone else's credentials. Retain the case reference and assign follow-up ownership until the company has a verified result.

Arrange the incoming permissions for the actual tasks

For internal staff, use the relevant organisation-user and permission features described in the current guide. For a practitioner, follow the client and tax-type process for the agreed engagement. The practitioner portfolio guidance explains the different stages and the role of client authority.

Write down which functions must work at the end of the handover. Viewing correspondence, preparing a return, submitting it and authorising a payment are different responsibilities. Make the approval boundaries clear in the company's working arrangements, even where the same person performs more than one task.

If only one tax type is moving, verify that the intended scope was selected. Do not infer that every product transferred because one return is visible. Keep pending activation or verification work on the action list and preserve the messages that explain what remains outstanding.

Transfer the records that access alone cannot explain

Collect final returns, assessments, working papers, payment evidence and material correspondence for the periods in scope. Add a list of unresolved matters with their references, deadlines and current owners. An incoming user can have correct access yet still lack the reasoning behind a disputed figure.

• Separate final submissions from drafts and proposals.
• Identify documents already sent to SARS and those still being prepared.
• Record the status of payments and allocation queries.
• Preserve the basis of material calculations or adjustments.
• Confirm where the company retains the underlying source records.

Use an agreed transfer method appropriate to the information and authorised recipients. Check that files open and remain available after the departing person's account is closed. Keep the records connected to the company and period, rather than leaving the incoming adviser to search an unlabelled collection of email attachments.

Verify the incoming access with a short acceptance check

Arrange the checks before the planned end of the outgoing engagement where possible. The incoming authorised person should confirm the correct taxpayer, intended tax types and access to the relevant existing records. Use ordinary review actions to establish visibility without submitting a dummy return or making an unnecessary payment.

1. Confirm the company identity and representative record.
2. Locate the tax types included in the handover.
3. Open relevant existing correspondence and account information.
4. Confirm the working files and open-task register are available.
5. Record remaining permission or data gaps and their owners.

Keep a dated handover note describing what was checked. A successful login alone is too narrow: it may lead to the wrong portfolio or show only part of the required work. If a check fails, record the message and affected function so the follow-up is specific.

Remove departing access when the authority ends

Set a clear end date for the outgoing person's authority and coordinate the transition around it. Use the relevant removal or access-change process, then verify the result. Do not leave obsolete permissions in place indefinitely because a handover checklist has not been signed.

Review related organisation roles and practitioner arrangements as well as the most obvious tax type. Record which access was removed, who confirmed it and what ongoing work was reassigned. Keep the record of past actions and filings even when the person's future access ends.

Where a representative change affects the previous representative automatically, still check the broader access inventory. An automatic change to one role does not prove that every other user or external relationship has been reviewed. The company should be able to explain who remains authorised and why.

Close the handover with responsibilities that remain visible

Public-officer and representative support can help align the appointment evidence, SARS record and access tasks. Keep the completed handover note with the authority records and schedule a review when personnel or advisers change again.

A complete handover leaves the right people able to do the agreed work, the company able to receive and respond to notices, and the historical records understandable. Personal credentials remain personal, while company responsibilities and evidence remain available to those properly authorised to act.