About · Quality & Security
How client data stays protected, reviewed, and returned
A reconciled ledger or a reviewed working paper means nothing if the client data behind it was mishandled along the way.
Every deliverable at Saramis Global passes three review layers, a signed confidentiality undertaking, and a controlled access list before it reaches you.
Book a discovery call and see the controls attached to your engagement before the first file moves.
How work gets checked
Three review layers sit between draft and delivery
Every deliverable passes three layers before it reaches you: the preparer, a qualified reviewer, and the engagement manager who carries overall responsibility for the engagement.
A single set of eyes catches less than three. Accounting and audit work carries figures that look plausible and are still wrong. A reconciling item filed against the wrong period. A lead schedule cross-referenced to the wrong working paper. Layered review is what catches those before the file leaves the building.
Behind that review sits a team of 9 Chartered Accountants, supported by MBA and BCom professionals, including part-qualified ACCA and CPA members. The reviewer and the engagement manager are drawn from that team on every engagement, never from outside it.
Preparer
The professional assigned to your engagement builds the first draft: the reconciliation, the working paper, the management report. Every figure traces back to a source document from the first line.
Qualified reviewer
A qualified reviewer checks the draft against its source documents and flags anything that does not tie out. Nothing moves forward with an open query still sitting on it.
Engagement manager
The engagement manager runs the final check before delivery, confirming scope, format, and the standard your engagement requires before the file goes out, and carries overall responsibility for the engagement. The chain behind that role sits on Leadership Team.
Confidentiality and access
NDAs and scoped access apply before a file ever opens
A confidentiality undertaking is signed before Saramis Global sees a client name, figure, or file.
Access is controlled and scoped per engagement, not shared across the wider team, and fieldwork can run inside your own systems when you ask for it. Client data stays where it already lives, and nothing lingers on an outside system once the work is done.
Audit engagements run on the same access controls. See audit support through to sign-off for how the file moves through them.
NDAs
Signed before a single file, name, or figure changes hands. The undertaking runs the full length of the engagement and covers everything inside it.
Controlled access
Access is scoped per engagement and per person. Nobody outside the assigned team opens the file, and every access change is logged against that engagement.
Work inside your systems
Fieldwork happens inside your own platforms and file structure wherever your firm requires it, so the data never leaves your estate for a system Saramis Global controls instead.
The named controls behind that posture
"Inside your systems" is a checkable claim, not a slogan. Four controls hold it in place on every engagement:
- Managed devices only: no fieldwork runs from a personal machine.
- Scoped credentials: each person can open their own slice of the engagement and no more.
- Logged changes: every access grant and every revocation is recorded against the engagement.
- Limited exports: downloads stay held to what the file actually needs.
Cross-border data
GDPR still applies when the work moves to India
India holds no EU or UK adequacy decision, so a GDPR-compliant transfer to an Indian provider runs on contract, not geography: a data processing agreement backed by the right transfer instrument, with the detail set out on Privacy.
Two instruments do that work. Standard Contractual Clauses cover personal data moving from the EU, and the International Data Transfer Agreement, or the UK Addendum to the EU clauses, covers data moving from the UK. Certification badges are common across the offshore field; published transfer terms are not.
None of this is hypothetical for a UK or EU firm. A sales ledger carries personal data. So does a payroll file, and so does an employee expense claim, which means the rules reach routine bookkeeping records, not only special categories.
Transfer terms belong in the engagement letter, not in a side promise. Raise them at the discovery call.
Exit and handover
Handover starts on the day an engagement ends, not after
Client files and working papers come back promptly and completely, in the format you already use. No hold period, no drawn-out export.
- Working papers, lead schedules, and reconciliations
- Supporting documents and correspondence tied to the engagement
- A closing note listing anything still open on the file
- The access list, closed out on the same day
Nothing is held back to force a renewal, and nothing sits behind a separate request.
The handover applies whether the engagement runs its full course or ends earlier, at your instruction. An early exit gets the same handover as a completed one.
Day to day
Day-to-day access follows the same discipline as day one
Device access, working permissions, and activity records follow one discipline for the length of the engagement. Week one and month nine look the same.
That discipline is the same one How We Work describes for the wider engagement, applied specifically to the data your team hands over.
Device discipline
All fieldwork runs from managed devices. Downloads and exports stay limited: nothing leaves beyond what the work in hand requires.
Least access
Each person on the team sees the client and file scope their part of the engagement needs, nothing wider, and access narrows again once that part is done.
Query logs
A question raised against a working paper is logged against that working paper, not sent through a side channel that leaves no record.
Due diligence
Ten due-diligence checks, answered on one page
Published offshore-accounting due-diligence checklists run from 10 points to 30. The ten checks that recur across them are answered here, each one tied to the section that carries the detail.
- Certification status. Asked and answered in the first FAQ below: not yet certified, and the controls in place today are published instead of implied.
- Review structure. Three layers on every deliverable: the preparer, a qualified reviewer, and the engagement manager, each with a named job in the review structure above.
- Qualification counts. Nine Chartered Accountants, supported by MBA and BCom professionals and two part-qualified members, with the reviewer and the engagement manager drawn from that team.
- NDA timing. Signed before a client name, a figure, or a file changes hands, not partway through onboarding.
- Access scoping. Per engagement and per person, with every access change logged against the engagement it belongs to.
- System of record. Yours. Fieldwork runs inside your own platforms and file structure wherever your firm requires it.
- Device controls. Managed devices only, with exports capped at what the file requires.
- Transfer terms. India holds no EU or UK adequacy decision; the cross-border data section above names the contract instruments that close the gap.
- Exit terms. Files returned promptly and in full, the access list closed on the end date, nothing withheld to force a renewal.
- Query trail. Every question logged against the working paper it concerns, so the file itself carries the record.
Bring your firm's own checklist to the discovery call and walk it line by line.
Questions
Quality and security, answered directly
Does Saramis Global hold ISO 27001 or SOC 2 certification?
Not yet, and the website does not pretend otherwise. The controls described on this page, confidentiality undertakings, scoped access, layered review, and client-system working, operate today. If and when a formal certification is achieved, it will be published here with its certificate number so it can be checked, the same way the firm publishes its CIN.
How many reviewers check a deliverable before it reaches us?
Three. The preparer builds the first draft, a qualified reviewer checks it against source documents, and the engagement manager runs the final check before it reaches you. Overall responsibility for the engagement sits with that manager. All three sit inside your own engagement team, not a separate quality department that only sees the file at the end.
Who can access our data during an engagement?
Only the team assigned to your engagement. Access is scoped per engagement and per person, every access change is logged, and nobody outside that assigned team can open the file.
Can Saramis Global work inside our own systems?
Yes. Fieldwork runs inside your own platforms and file structure wherever your firm or business requires it, so client data stays in your own estate rather than moving onto a separate system.
What happens to our files if we end the engagement?
They come back to you, promptly and in full, in the format your own file already uses. Nothing is retained past the engagement, and no document is held back to push a renewal.
Is a confidentiality undertaking signed before work starts?
Yes. A confidentiality undertaking is signed before Saramis Global opens a file, sees a client name, or touches a figure, and it covers the engagement, the client, and every document in between.
Is outsourcing accounting work to India compatible with GDPR?
Yes, through contract. India holds no EU or UK adequacy decision, so a compliant transfer rests on a data processing agreement plus Standard Contractual Clauses for EU data, or the IDTA or UK Addendum for UK data.
Where does client data live during an engagement?
Inside your own systems, wherever your firm requires it. Fieldwork runs in your platforms and file structure from managed devices, exports stay limited to what the file needs, and nothing moves onto a separate system that outlives the engagement.
Is every access to our file logged?
Yes. Every access grant and revocation is logged against the engagement, and every query raised on a working paper is logged against that paper. The trail runs for the length of the engagement, not just the first week.
See the controls attached to your engagement
Book a discovery call and Saramis Global walks through the review layers, access controls, and handover terms before your file moves.
Talk to us
Book a Discovery Call
Tell us your requirements: bookkeeping, audit support, or a tailored finance solution. We'll suggest the right way to work together.
Write to us
contact@saramisglobal.com
Share your questions or a short brief. We reply with next steps, not a sales script.
Your Growth. Our Commitment.