Account and Subaccount Security

In MYOB Advanced, you can control which users will use particular General Ledger (GL) accounts and subaccounts.

To configure the security of GL accounts and subaccounts, you can use a combination of user roles and restriction groups. By using user roles, you can configure the access of users to branches and to all branch-specific accounts and subaccounts. With restriction groups, you can set up the visibility of particular accounts and subaccounts within branches and for certain users, and you can limit the use of subaccounts with particular accounts. For details on restriction groups, see Restriction Groups in MYOB Advanced.

In this topic, you will read about using restriction groups and branch-specific roles to configure and manage the security of accounts and subaccounts.

Usage Scenarios

The most common scenarios of managing the security of accounts and subaccounts are the following:

• Managing the visibility by branch: When your organization consists of multiple branches (and you have created multiple branches in MYOB Advanced), you can configure the system so that it narrows the lists of accounts and subaccounts by branch on data entry forms. For details, see Visibility by Branch.
  Note: You can configure and use the restriction groups that include branches only if the Multibranch Support feature is enabled on the Enable/Disable Features (CS100000) form.
• Managing the visibility by user: If your organization has sensitive GL accounts and subaccounts, you can provide the visibility of these objects to only a limited set of users. For more information, see Visibility by User.
  Note: For performance reasons, visibility restrictions by user for subaccounts do not affect analytical (ARM) and form-based reports or general inquiries. This means that users who can view the reports and general inquiries that include subaccounts will see the full list of subaccounts.
• Managing the visibility of subaccounts by account: If you have subaccounts that users must use with only particular GL accounts, you can set up lists of available subaccounts for each GL account. For details, see Visibility of Subaccounts by Account.
• Adding the needed objects to one restriction group to control visibility by multiple factors: For example, if you need to limit the users who use sensitive accounts, and only particular subaccounts must be used with these sensitive accounts, you can configure restriction groups to address this task. For details, see Visibility of Accounts, Subaccounts, and Users.

Cash accounts are one type of sensitive accounts that you may need to secure in the system. The ways of managing the security of cash accounts differ from the ways of managing the security of GL accounts. For more information, see Security of Cash Accounts.

Visibility by Branch

If your organization has users who have access to multiple branches, you can use restriction groups to narrow the lists of accounts and subaccounts on data entry forms by branch. With restriction groups set up in this way, users will make fewer mistakes when selecting accounts and subaccounts on data entry forms.

For example, suppose that your organization has two branches—the Headquarters office (HQ in the system) and the Regional Sales office (RS). The accounting department processes documents for both branches. To configure the visibility restrictions of accounts and subaccounts by branch, you need to do the following:

1. You configure user roles for each branch (for example, Branch HQ and Branch RS) and assign both roles to the user accounts of the accountants. With the roles assigned, the accountants will see information for both branches in MYOB Advanced. For details, see Security of Organization Branches.
2. To configure the visibility of accounts within branches, you do the following on the GL Accounts by Branch Access (GL103040) form:
   1. You create two restriction groups of type A (with direct restriction): the HQ Accounts group for the Headquarters office and the RS Accounts group for the Regional Sales office.
   2. In the HQ Accounts group, you include the Headquarters branch (HQ) and the accounts that should be visible within the HQ branch.
   3. In the RS Accounts group, you include the Regional Sales branch (RS) and the accounts specific to the RS branch.
3. To configure the visibility of subaccounts within branches, you do the following on the Subaccounts by Branch Access (GL103060) form:
   1. You create two restriction groups of type A (with direct restriction): the HQ Subaccounts group for the Headquarters office and the RS Subaccounts group for the Regional Sales office.
   2. In the HQ Subaccounts group, you include the HQ branch and the subaccounts that should be visible within this branch.
   3. In the RS Subaccounts group, you include the RS branch and the subaccounts specific to this branch.

After you have configured restriction groups for accounts and branches, or subaccounts and branches, the system will narrow the lists of accounts or the list of subaccounts on data entry forms after a user selects a branch. For example, suppose that an accountant is adding a bill on the Bills and Adjustments (AP301000) form and selects the HQ branch in the Branch column of the Document Details tab. In the Account column of the same tab, the accountant will see only accounts added to the HQ Accounts restriction group.

Visibility by User

Within branches, your organization may have sensitive or confidential accounts and subaccounts which must be invisible for majority of users. You can control the visibility of these accounts and subaccounts for users (that is, which users can view the accounts and subaccounts) by using restriction groups.

For example, suppose that only a chief accountant of your organization can work with the tax payable account. To make this account visible to the chief accountant only, you need to do the following on the GL Account Access (GL104000) form:

1. You create a restriction group (for example, Access to Tax Payable Account) with direct restriction.
2. You add to the group the user account of the chief accountant.
3. You add to the group the tax account.

As another example, suppose that the subaccount for the financial department can be used only by accountants (and not by other users). To make this subaccount visible to only accountants, you need to do the following on the GL Account Access form:

1. You create a restriction group (for example, Access to Financial Subaccount) with direct restriction.
2. You add to the group the user accounts of the accountants.
3. You add to the group the subaccount for the financial department.

Visibility of Subaccounts by Account

Visibility of Accounts, Subaccounts, and Users

By using restriction groups, you can combine the functionality of the following scenarios:

• Managing the visibility of accounts to users
• Managing the visibility of subaccounts by account

To implement this functionality, you need to add users, accounts, and subaccounts (or subaccount segments) to the same group. In this case, the visibility will be restricted as follows:

• Only users included in the restriction group will see the accounts and subaccounts added to the group.
• If a user included in the group selects an account in the group when processing a document, he or she will be able to select a subaccount from the list of only subaccounts added to the group.

Forms for Account and Subaccount Security

In the following table, you can find the list of forms that you can use to manage restriction groups with accounts, subaccounts, and subaccount segments, and tasks that you can resolve by using each form.

For information about how to add or remove objects from a restriction group, see Operations with Restriction Groups.