Acceptable use policy, Corrigan Hale Accountants
Acceptable use policy template with an honest monitoring notice
An acceptable use policy has to say which systems it covers, what staff may and may not do with them, what the organisation monitors, and what happens when the rules are broken. This four page policy for a 28 person accounting firm holding records for 1,900 clients does that, with a monitoring table that says what is logged, for how long, and what is never watched.
The document, page by page
Every page as it renders and as it prints, with nothing summarised. Read the wording before you reuse it.
Section by section
What each section is for, so you can keep the ones you need and drop the rest.
- Cover
- Document cover with the firm, title, purpose line and effective date.
- 1. Why this policy exists
- 1,900 clients' records and who the policy covers.
- 2. Systems covered
- Six systems with what each includes and its owner.
- 3 and 4. Permitted and prohibited use
- Brief personal use allowed, and eight things never done with firm systems or data.
- 5. Monitoring notice
- What is logged, for how long, and what is never monitored.
- 6. Passwords and sign in
- Authenticator based multi factor and five password rules.
- 7 and 8. Reporting, breaches and review
- Report at once, how breaches are handled, and the yearly review.
How to adapt this document
First, for a business without client data obligations, cut the prohibited list to what matters to you, such as company accounts and payment systems, and shorten the email retention to your own records policy. Second, if staff use their own phones, add a cross reference to a separate bring your own device policy rather than covering personal devices here. Third, if your monitoring is wider, for example screen recording in a call centre, say so in the table with the reason and retention, because undisclosed monitoring is what turns a policy into a complaint.
Monitoring and privacy rules differ by place
Whether and how an employer may monitor work systems depends on local law. In the UK, the Information Commissioner's guidance on monitoring workers expects employers to be open about monitoring, to have a clear purpose and to keep it proportionate. Other countries, and some states within them, have workplace surveillance laws that require written notice before monitoring starts, and privacy law governs the client data the logs may contain. Check the rules where your staff work before relying on this policy's notice.
What makes this document work
Monitoring is disclosed in full
Clause 5 lists four logs, sign ins, email, web traffic and file activity, with what each records and how long it is kept, from 90 days to 7 years. The callout then says what is never watched: keystrokes, screens, webcams, personal messages, phones out of hours. Staff accept monitoring they were told about.
The prohibitions match an accounting firm's real risks
Eight prohibited uses include sending client data to a personal email account, copying it to USB, pasting tax identification numbers into a public AI tool, and opening a client file you are not working on. Each one is a way client data actually leaks from small firms.
Password rules follow current guidance
Clause 6 asks for a 14 character passphrase, a different password per system from the password manager, and multi factor authentication by app rather than text message. It does not force regular password changes, only a change after suspected exposure, which matches current guidance and stops staff writing passwords down.
Questions people ask
Is it legal to monitor employees' work email and internet use?
Generally yes on work systems, provided staff are told clearly what is monitored and why, and the monitoring is proportionate. Privacy and workplace surveillance laws differ by country and, in some places, by state, and some require written notice in advance. This policy's monitoring table is that notice.
Should an acceptable use policy allow personal use?
Most do, within limits, because a total ban is ignored and then unenforceable. This one allows brief personal use that does not interfere with work, cost the firm money or break the prohibited list, and warns that anything stored on firm systems can be seen. That is realistic and defensible.
Why mention AI tools in an acceptable use policy?
Because pasting client details into a public chatbot sends them to a third party outside the firm's control, and staff often do not see it as sharing. Naming it specifically, as the third prohibited use does, closes a gap older policies did not anticipate. Approved tools with proper terms can be listed separately.
Do staff need to sign an acceptable use policy?
It helps to have a record that each person received and read it, whether a signature, an electronic acknowledgement or a training record. This version has no signature block; firms usually collect acknowledgement through their onboarding or HR system, which keeps the record with the employee file.
What should happen when someone clicks a phishing link?
They should report it immediately, as clause 7 asks, day or night. Fast reporting lets the IT provider reset passwords and check for damage before data leaves. This policy states that reporting is never a breach in itself, because staff who fear punishment hide mistakes, and hidden mistakes cost far more.
Build your own in about a minute
The button below opens the generator with this use case already described. Change the wording to match your own, generate, then edit anything you like.
Make one like thisOther document examples
Conflict of interest policy template for a not for profit board
A conflict of interest policy has to help directors recognise a conflict, declare it early and know what happens next, so decisions stay in the organisation's interest and funders can see that they do. This four page policy for a literacy charity board does that with six worked examples, five declaration rules, five management options and a register of interests.
BYOD policy template that draws a line around work data
A bring your own device policy has to let staff use their own phones for work while protecting client data, and it only works if staff trust what the employer can and cannot do to their device. This three page policy for a real estate agency sets eligible devices, five enrolment steps, a can see and cannot see table, and wipe rights limited to work data.
Performance management policy template with PIP steps and timeframes
A performance management policy has to show staff how they are measured, how often it is discussed, and exactly what happens, and how fast, when performance stays below standard. This four page policy for a 260 agent call centre does that with a four part review cycle, a weighted scorecard, a PIP with a 4 to 8 week window and four possible outcomes.
Want the steps in the builder? Read Create a document with AI, then Document builder components. For everything this generator can do, see the document maker.
Written and checked by the OneCraft team. Last checked .