Accounting software with permissions so staff can enter bills but not post journals

Xero is a good fit to investigate. Its US business-edition roles can be limited to entering supplier bills, and the “Only create drafts” setting keeps staff from approving them. Manual journals are a separate permission area, so you can leave journal access off. (central.xero.com)

QuickBooks Online may not fit as neatly: its standard Bookkeeper and Accounts Payable Manager roles can enter bills, but Intuit also lists journal entries among the bookkeeping permissions for its broader roles. (quickbooks.intuit.com)

If you’re open to a separate bill-entry tool integrated with your accounting system, BILL has a Clerk role described as permission to only enter bills. (vendorpayhelp.bill.com)

Before choosing, test the exact staff role in a trial account: “not approving bills” and “not creating or posting journal entries” are distinct controls.

Most mainstream accounting packages can do this, though the exact setting varies. Here's what the current sources show:

QuickBooks Online

• Custom roles in QuickBooks Online Advanced let you limit a user to bills and expenses. The Bookkeeping area's "All bookkeeping access" option is listed as one the user cannot have for journal entries, so a bill-entry role can be built without journal rights. Under the Full access heading, the custom role cannot create a journal entry.
• A separate "Bills" permission set can create and edit bills, but it blocks bill payments and access to other expense transaction types. The Bills permission lets a user create, copy, edit, and void bills, but not pay them.
• Keep in mind that the default Accountant role includes journal entries, so don't assign that role to bill-entry staff. The default accountant role covers Journal Entries, Chart of Accounts, closing-date settings, and company reports.

Xero

• Standard users have historically been unable to post manual journals, but a user-role change has reportedly made this less clear. One user-forum thread says standard users now by default have access to create and edit journals after an update. Another community answer says the Adviser role is needed to add and post manual journals. Check the current role matrix in your own Xero organisation before relying on it.

BILL (Bill.com)

• BILL has a predefined Clerk role for this purpose. The Clerk role is limited to permissions for bill and invoice entry. Its Accountant role can enter bills but cannot schedule payments, and it is not described as having journal rights, so the Clerk role is the better fit.

Odoo

• Odoo's Invoicing access level is designed for this. It covers vendor bills, payments and basic invoice reports, with no journal entries, reports, or reconciliation.

BizBooks Pro

• The Bookkeeper role can enter invoices and bills and record payments, but the Accountant role is the one listed with recording journal entries.

Tips

• Whatever the software, test the role with a trial user before going live, because permissions in these products change between versions and plans.
• Where the software can't block journals, use a review step. Some users ask for drafts that can't be posted until someone approves them, but this is not always available.

If you tell me which software you use (and plan/edition), I can narrow this to the exact setting.

To achieve the segregation of duties where staff can enter bills but not post journal entries, you should look for accounting software that offers role-based access control (RBAC) or customizable user permissions.

Recommended Software Approaches

Most modern cloud accounting platforms provide solutions to this problem, though the level of granularity varies.

1. Xero

Xero uses specific user roles that handle this type of segregation well:

• The "Purchases" Role: You can assign staff a "Purchases" role, which gives them access to enter and manage bills (accounts payable) without giving them access to sensitive accounting areas like manual journal entries, bank reconciliations, or comprehensive reports.
• Limitation: Xero’s roles are predefined, so you cannot "build" a custom role from scratch. However, the "Purchases" role is specifically designed to allow bill entry while keeping the user away from the general ledger journals.

2. QuickBooks Online (QBO)

QuickBooks Online allows for more restrictive, task-specific access:

• Custom Roles: If you are on a plan that supports custom roles (such as QBO Advanced), you can create a role that grants "Create" permissions for Vendors/Bills while specifically excluding permissions for "Journal Entries."
• Standard Limited Users: On standard plans, you can invite users with "Limited" access and restrict them to "Vendors" only. This allows them to focus on bills and payments without interacting with the broader financial reporting or journal adjustments.

3. Sage Intacct & Enterprise Solutions

For larger businesses or those requiring strict compliance (e.g., audit trails, segregation of duties), enterprise-level software like Sage Intacct is ideal:

• Granular Permissions: These systems are built for complex workflows. You can grant specific permissions at the module or even transaction level, allowing a user to have "Create" access to bills but no access to "Post" or "Edit" journals.
• Approval Workflows: These platforms often include built-in approval workflows, ensuring that even if a staff member creates an entry, a supervisor must review and approve it before it hits the general ledger.

Key Features to Look For

When evaluating software for your specific needs, verify these three capabilities:

• Granular/Custom Roles: Can you define exactly which screens or transaction types a user can see?
• Segregation of Duties: Does the software specifically separate "Accounts Payable/Bill Entry" from "General Ledger/Journal Entry" permissions?
• Audit Trail: Does the software log who created and who posted a transaction? This is essential for internal control, even if you trust your staff.

Implementation Best Practice

Regardless of the software you choose, follow these steps to ensure security:

1. Unique Logins: Never share logins. Each staff member should have their own account so actions can be traced to them in the audit log.
2. Principle of Least Privilege: Start by giving the absolute minimum access required for their job. You can always add permissions later if they find they cannot complete a necessary task.
3. Review Audit Logs: Periodically check the activity or audit log to ensure users are only performing the tasks assigned to their role.

QuickBooks Online Advanced and Xero both look like good fits:

• QuickBooks Online Advanced: You can create a custom role with access to bills but without permission to create journal entries. Intuit lists bill actions and journal-entry actions as separate permissions. ¹²
• Xero: Give staff a purchases-focused role to work with bills, and leave off the manual journals permission. Xero says purchases users can access bills, while sales and purchases users can’t access manual journals. ³⁴

If staff should prepare bills for review rather than approve them, QuickBooks Online Advanced also offers a “Bill clerk” role that can add bills but can’t approve or pay them. ⁵

Check the exact role options in your country and subscription before choosing: software features and permission names can vary by plan and region.