Family businesses and IT access

Where family businesses differ

In a family business, the line between home and work is often blurred. The same laptop is used for the accounts and the children's homework. One person's email address handles both business and personal matters. Everyone knows the password to the bank portal because it's the same one used for the household account. A teenager helps with the website on weekends using a parent's login.

This informality works fine day to day, which is why it persists. The problems appear when something changes: a family member leaves the business, a relationship breaks down, someone falls ill, a younger generation takes over, or a scam targets the person with the weakest security habits. At that point, untangling who owns what and who can access what becomes urgent and sometimes painful, often at exactly the moment family members least want to sit down together and sort it out.

Individual accounts for everyone

Every family member who works in the business should have their own business account, separate from their personal email and from each other's. That applies even to occasional helpers. It costs little and means you can tell who did what, require multi-factor authentication properly, and remove one person's access without disrupting everyone else.

Resist the temptation to have one shared family email account for the business. Use shared mailboxes for addresses like info@ or accounts@, so multiple people can read them with their own logins. In the accounting system and bank, give each person their own user with appropriate permissions rather than sharing one login.

Decide who holds admin rights

Admin rights should go to the people responsible for running the business, not to whoever happens to be good with technology. In a family firm, that's often the directors or the managing family member, with an IT provider as a second admin. Write down who holds admin access to each important system, and make sure at least two people can manage the critical ones.

Have an honest conversation about what happens if a family member steps back or the family relationship changes. Business access should follow business roles, agreed in advance, so nobody has to make awkward decisions about locking out a relative in the middle of a disagreement. A shareholder or family agreement is a sensible place to record this, alongside other governance matters.

Separate home and business devices

Business data on family computers is a common weak spot. Children download games and browser extensions, partners click on shopping emails, and the device is rarely managed or backed up properly. If business work happens on a home device, the risk is shared by everyone who uses it. Where you can, provide dedicated business devices for business work, managed and protected like any company laptop. If a home computer must be used occasionally, restrict business access to the browser and avoid syncing files to it. Use separate user profiles at the very least, and keep business passwords out of the family browser's saved passwords.

Passwords and the family password manager

Many families now use a password manager at home, which is a good habit. Keep business credentials in a separate business vault or a separate business password manager account, rather than mixing them into the household one. That way business passwords can be shared with staff, contractors or a future owner without exposing personal accounts, and vice versa. Set up emergency access for business credentials so that if the main person is unavailable, another named director or trusted person can get in. Make sure the arrangement reflects business roles rather than family convenience, and review it when circumstances change.

Planning for succession

Family businesses often pass between generations or to a family member who has worked there for years. Treat that transition as you would a sale: confirm the business owns its domains and accounts, document the systems, move admin rights deliberately and remove access for those stepping back. A younger family member taking over may want to change systems; let them, but after the handover is clean rather than in the middle of it.

If you'd like an outside view of how access is set up, Office IT can review it as part of a health check. A neutral party can sometimes raise issues, such as a retired parent who still has full admin rights, that are awkward for family members to bring up themselves.