Most SMEs in Poland exchange documents with their external accounting firm in a way that becomes expensive the first time a GDPR audit lands, a phishing attack succeeds or a mailbox breaks. The alternative — proper order between company and accountant — is neither complicated nor costly. It only requires a decision.
This topic comes up in our calls surprisingly often. An owner rings about something else — an e-commerce–ERP integration, say — and along the way it turns out payroll runs get emailed to the accountant from a personal Gmail, and purchase invoices sit in a shared Dropbox folder that nine people can see, including the intern who left in March.
Where the mess comes from
It is rarely anyone's bad faith. Historically you drove a folder to the accountant once a month. Somewhere between 2010 and 2015 the folder was replaced by a scanner and email. Document volumes grew — civil-law contracts, payroll slips, JPK files, holiday requests, reports out of Comarch Optima or Subiekt, bank statements, transfer confirmations, Allegro invoices, expense claims. The handling didn't grow. It's still "attach and send".
Nobody sat down to ask "what mode are we actually exchanging these in". Because it worked. Until it stops.
Three classic bad patterns
- Attachment to the accountant's mailbox. Several employees send throughout the day. A copy stays in sender and receiver mailboxes. Attachments named
invoice_final_final2.pdf. When the accountant is on holiday, nobody knows what is waiting to be processed. - Shared Dropbox/Google Drive folder "for everyone". Created ad hoc long ago. The whole sales team, the whole accounting team, one ex-employee, an intern account and a "share with anyone who has the link" all have access. No audit of who downloaded what.
- A USB stick once a week. Common with an accountant who "visits on Fridays". A single lost stick with 30 people's payroll data on it is a GDPR incident report and a conversation with the regulator.
What you're really risking
It is not theoretical risk. It's the things that actually happen in Polish SMEs every year:
- GDPR. Payroll runs contain PESEL numbers, addresses, bank accounts, salaries. GDPR Article 32 requires "appropriate technical measures" — in practice at least encryption in transit and access control. An unencrypted email attachment doesn't meet that.
- No audit trail. A month later you can't reconstruct who pulled the sales team's payroll file. In an employment dispute that is a painful gap.
- Versioning. The classic: the accountant has the pre-correction version, the company has the post-correction one, the annual figures don't match. Two days finding where they diverged.
- Knowledge loss. The accountant or the assistant who "handles the sending" leaves — and the mental map of where things live leaves with them. Instead of folders you have hundreds of Outlook threads.
- Targeted phishing. A mailbox like
invoices@yourcompany.plis a known, easy target. Swapped bank details in an email "from the accountant" and suddenly PLN 40,000 lands somewhere it shouldn't.
What actually works
You don't need an expensive DMS or a six-month project. In most SMEs a sensible mix of three channels is enough:
- The accounting firm's portal. SaldeoSMART, Symfonia iBiuro, Comarch iBiuro, enova365 Payroll Online, MojeBiuro24 — every serious Polish accounting firm now offers some kind of portal. You drop a scan through the browser, they pick it up on their side. Versioning, history, access control — out of the box. If your accountant doesn't have one, it's worth asking (or considering a change of accountant).
- A shared Microsoft 365 or Google Workspace folder with granular access. The accountant added as a guest, access only to the specific folder, MFA required, an access log. Not a "team drive visible to everyone" — one folder, one person. Into that same bucket go HR contracts, time records, bank statements.
- KSeF for invoices — as the Polish government e-invoicing system matures, invoices land directly with the accountant without your involvement. Stop mailing them the moment your setup allows.
Three channels isn't "complicated" — it's order. One channel per document stream. Invoices via portal or KSeF, HR via SharePoint, everything else via one named place — never via the owner's mailbox.
A concrete case
One of our clients — a 24-person electrical wholesaler in Greater Poland with about PLN 28 million in annual revenue — used to run it like this. Each month roughly 800 purchase invoices went to accounting (scans from reception), 1,200 sales invoices out of Comarch Optima, 24 payroll slips, a dozen civil-law contracts and a few dozen cash reports. Everything through invoices@firm.pl, a shared inbox four people could reach, plus WeTransfer on Friday evenings when the 25 MB attachment limit kicked in.
At the 2025 year-end close, the accountant reported three scans missing. It turned out one invoice had been filtered as spam on their end, a second bounced back because their inbox was full (nobody noticed the bounce), and the third had been sent from the warehouse manager's private account and never arrived. Four days of searching.
We cleaned this up on two tracks. Invoices — the accounting firm's portal (SaldeoSMART, with automatic OCR and cataloguing by counterparty name). Contracts, payroll and statements — a dedicated SharePoint folder, the accountant added as a guest with MFA required, an access log emailed to the owner weekly. The monthly close dropped from about five working days to two. The volume of "please handle this now, I need to send it today" emails went to zero. Three inboxes that only existed for accountant traffic could be closed.
How to implement it step by step
- Call your accountant and ask what portals they support. Most have a preferred one; some support several.
- List every document stream. Purchase invoices, sales invoices, corrections, payroll slips, contracts, cash reports, bank statements, expense claims, time records. One line each.
- One place per stream. Never two. "Invoices always via the portal", "contracts always via the HR folder". The rule must be unambiguous.
- Turn off the old channels hard. The
invoices@inbox gets an autoresponder pointing at the portal. The shared Dropbox is migrated and closed within two weeks. Otherwise nobody switches. - Enforced MFA on the accountant's account and the whole finance team. This isn't negotiable.
- A one-page cheat sheet. Who sends what, where, by when. Pin it in the kitchen.
- A month later, look at what came back over email and why. Usually it's one or two people and one type of document. Close it out and you're done.
What's next
Sooner or later something will force this change on you: an audit, a phishing attack, a mailbox outage, or the person who "knew where things were" quitting. Better to do it in a calm quarter than under a regulator's deadline.
If you're not sure which stream to tackle first, half an hour with someone who has cleaned this up in a dozen similar organisations will save you a month of going in circles.
Document exchange with your accountant is nobody's conference-stage topic. It's the topic on which a serious company faceplants once a year. Fixing it is cheap if you do it before you fall.