Letting staff bill without showing them your margins
Why one shared login is the most expensive habit in a small shop, and how to split access sensibly.
5 min read
Almost every small shop starts with one login that everybody uses. It is simpler, and when it is you and one helper it genuinely does not matter. It starts mattering the day your helper can see what you paid for the goods.
Two separate problems
It is worth being precise, because they need different answers. The first is confidentiality: you may not want staff knowing your purchase prices or your monthly profit. The second is accountability: when something is wrong, you want to know who entered it.
A shared login fails both. Everyone sees everything, and every entry is attributed to the same person, which is the same as attributing it to nobody.
Give people the smallest set that lets them work
The useful question is not "do I trust this person" but "what does this person need in order to do their job". A cashier needs to create bills, look up a product and add a customer. They do not need to delete an order, adjust stock, view profit and loss or change staff permissions.
- Cashier: create and print bills, view products and stock levels, add customers. No cost prices, no reports, no deletions.
- Manager: everything a cashier does, plus stock adjustments, purchase orders, expenses and reports — but not staff management.
- Owner: everything, including permissions and anything involving money leaving the business.
The specific line worth drawing is cost visibility. Selling price has to be visible to bill at all. Purchase price and margin do not, and that is usually the information owners most want kept in the family.
Accountability is the quiet benefit
Separate logins mean every bill, every stock adjustment and every discount carries a name. This is less about catching theft than about ending arguments. When an entry is wrong, you can ask the person who made it what they meant, instead of guessing across four people.
It also protects your staff. If everyone shares a login, then everyone is equally suspected whenever something goes missing. Individual logins mean an honest employee can point at the record and be cleared.
When someone leaves
With a shared login, an employee leaving means changing the password and telling everyone the new one — which people write down, and which usually gets skipped. With individual logins you disable one account and nothing else changes. Do it the same day.