The work is done. The audit report is signed off, the financial statements balance, the management letter is final. What's left looks like a formality: export to PDF, attach, send. Yet that last step is where avoidable mistakes slip in: a draft sent instead of the final, an author name from another firm in the file properties, a "hidden" account number that can still be copied, a password written in the same email as the attachment. This checklist covers the few minutes between "finished" and "sent."
1. Make sure it's the final version
It sounds obvious, and it's the most common slip. Before anything else:
- Open the exported PDF itself, not the source file, and check it's the version that was approved.
- Look for leftover draft marks: "DRAFT" watermarks, review comments, highlighted figures, placeholder text such as "[to be confirmed]".
- Check the dates: report date, period end, signature date. They should agree with each other and with the engagement.
- Check the client name on the cover, in headers and footers, and in the file name, especially if the document started from another client's template.
2. Assemble, order and number the pages
A report often arrives in pieces: the opinion, the statements, the notes, appendices, a scanned signed page. Sending five attachments invites confusion about what goes with what.
- Merge the parts into one PDF, in the order the reader expects.
- Check page orientation: rotate any landscape table or scanned page that came in sideways.
- Remove blank or duplicate pages that crept in during scanning or export.
- Add page numbers so that everyone discussing the report refers to the same page.
- Make scans searchable if some pages are scanned; OCR lets the reader search the text.
- Compress if the result is too heavy to email comfortably, then check the figures are still legible.
Our article on merging PDF files without uploading them walks through the assembly step.
3. Remove the metadata
A PDF carries information you don't see on the page: author name, organization, the software used, creation and modification dates, sometimes a working title like "Draft v7 – do not send." For a document leaving the firm, that layer should be cleaned.
In PDF Protect Plus, metadata cleaning removes the document's Info dictionary and its XMP metadata, and saves the result as a new file. Our article on removing metadata from a PDF explains what's typically found there and why it matters.
Do this step after merging and numbering, since assembling a new file can create fresh metadata.
4. Redact for real, if anything must be hidden
Sometimes a report goes to a wider audience than the client: a lender, a board, a regulator, a buyer. Some details may need to be removed first, such as employee names in a payroll note or bank account numbers in an appendix.
The trap is the black rectangle drawn in an ordinary editor: it covers the text on screen, but the text often remains in the file and can be copied or searched. Real redaction removes the information. In the PDF Protect Plus desktop app, any document with at least one redaction mask is rebuilt from images when the dossier is exported, so the text under the mask no longer exists in that document.
Whatever tool you use, test the result: search for a redacted word and try copying the area. Our guide to redacting a PDF properly details the method and the one-minute test.
5. Protect the file with a password
Financial statements and audit reports contain exactly the kind of information that shouldn't be readable by whoever happens to receive a misaddressed email. Protect the final PDF with an open password and AES-256 encryption:
- Use a strong password: long and random, or a passphrase of several random words. Avoid the client's name, the year or the file number.
- Use one password per client, so a leak doesn't open everyone's documents.
- Set permissions if useful, for example to discourage editing of a final report. Keep in mind that they're instructions to the viewer software, not a lock; the open password is what protects the content.
When the same report goes to many clients at period end, batch protection handles up to 200 PDFs at once, with a different password for each client read from a CSV file or spreadsheet.
6. Send the password separately
The encrypted file goes by email. The password goes by another channel: a text message, a phone call, or a password agreed with the client at the start of the engagement. Never in the same email, never in a second email to the same address, never in the file name.
The guide to sending a PDF password has ready-to-adapt templates for the email and the text message.
7. Keep the original and a record
- Keep the unprotected original in your working papers, stored securely. In PDF Protect Plus, every operation saves a new file, so the original is never overwritten.
- Keep a copy of exactly what was sent: the final, protected PDF.
- Record the password somewhere encrypted, so you can answer when the client asks for it again. PDF Protect Plus includes a local password vault stored in your operating system's secure storage.
- Note the date and recipients of the transmission, in whatever way your practice documents it.
The checklist at a glance
- Final, approved version, no draft marks, dates and client name checked.
- One merged PDF, in order, rotated, numbered, searchable, reasonable size.
- Metadata removed, after assembly.
- Sensitive details truly redacted, and tested.
- Open password with AES-256, one per client.
- Password sent by a separate channel.
- Original kept, copy of what was sent kept, password recorded securely.
An example
At Whitmore & Price, a fictional audit firm, a manager prepares the year-end package for a client. She merges the opinion, the statements and the notes, checks that no blank page slipped in, numbers the result, cleans the metadata, and protects the PDF with the client's password from the firm's vault. The PDF goes by email; the password was agreed by phone at the start of the engagement. The unprotected original stays in the working papers.
What protection does and doesn't cover
These steps make the document much harder to misuse in transit, but they have limits. A weak password can be guessed. Anyone who has the password can open the file. A recipient can forward the report and its password, or print it if printing is allowed. The checklist reduces the everyday risks; it doesn't replace judgment about who should receive what.
All on your own device
Every step above, merging, numbering, OCR on desktop, metadata cleaning, redaction on desktop and encryption, runs locally in PDF Protect Plus on Windows, macOS or Android. The documents aren't sent to our servers. For concrete workflows, see the use cases for protecting financial statements and protecting client reports, then download the app and run this checklist on a test file during the 7-day trial.