Giving budget holders their own reports without losing control

• Opening up a dashboard or report to more people without deciding what they should see and why tends to create confusion rather than genuine self-service.
• Real self-service needs three things: reports built for someone outside finance, access scoped to what a person really needs and a clear owner for what each metric means.
• One thing worth knowing before rolling this out: sharing a report can also give someone access to the full dataset behind it, not just what’s on screen. Hiding a field from a report doesn’t stop a user reaching it another way.
• Start from who needs to see what, and why, rather than from what the software happens to allow by default. Pilot with a small group before rolling access out more widely.

Finance teams under pressure to reduce the number of requests for reports will often reach for the same fix – turning on wider dashboard access so people can find what they need. This rarely works cleanly.

Someone without financial training can open a report built for finance and not know what they’re looking at, or someone can see numbers well outside their own budget and ask a question that you’re not ready to answer.

Self-service reporting works when someone has decided what a given person needs to see and why. That way, budget holders get the data they need, without the risk that finance will have to tighten access a few weeks later. In the latest in our series of articles about reporting, we look at how to set it up successfully.

What does self-service reporting require?

Self-service reporting means budget holders can answer their own questions without asking finance to build or explain a report. It depends on three things being in place before access is granted: reports written for someone outside finance, access limited to the budget or department a person is responsible for, and a clear owner for what each metric means. If one is missing, the model tends to fail.

• Reports that make sense to someone who isn’t in finance, not a raw export of the ledger. A budget holder needs to see spend against budget in terms they recognise, not a chart of accounts they’ve never had to learn.
• Access that’s scoped to what a person needs, their own budget or department, not the whole organisation by default. Scoped access is what makes the report trustworthy. Someone only sees numbers relevant to them, so a figure on screen is something they can act on rather than something they have to question first.
• A clear owner for what each metric means, so two people don’t get different answers to the same question. If ‘spend to date’ means something slightly different depending on who built the report, self-service just spreads that inconsistency.

Why ‘give everyone access’ usually fails

Giving everyone access to everything rarely works. Before long, someone outside finance will open a report full of ledger codes and account names that mean nothing to them. They’ll either ignore it or ask finance to explain it, which defeats the point of self-service.

Someone else may notice they can see figures for departments that aren’t theirs and finance ends up fielding a different kind of question – not about the numbers, but about why they can see them at all. Both problems trace back to the same root cause: access was granted before anyone decided what it should include.

A warning about sharing reports

In many reporting tools, hiding a field from a report doesn’t stop a user from reaching it. Microsoft’s guidance on sharing Power BI reports says that sharing a report also shares access to its underlying semantic model, and that hiding a table, column or page “isn’t a security measure”. Real control relies on access rules being set on the data itself.

Microsoft also says that, by default, “a report consumer’s read access isn’t restricted to the elements and data visible in the report”. Its recommendation is row-level security, which limits which rows a person sees, and object-level security, which limits which tables and columns they see.

This isn’t a Power BI-specific problem. Any tool that separates a visible report from the dataset behind it can leave a gap between what a report shows and what a determined user can reach. This merits checking, regardless of which reporting tool is in use.

How to design self-service reports

Start from who needs to see what, and why, rather than from what the software happens to allow by default. Answering that question for each role, before access is granted, solves most problems. Turning access on afterwards can’t make up for skipping it.

Pilot with a small group before rolling access out more widely. A pilot can reveal which reports make sense to someone outside finance, which access boundaries are wrong and which metric definitions need agreeing before more people start relying on them, while the group affected is still small enough to fix quickly.

What this looks like in practice

The right finance system builds carefully designed access into everyday reporting, so budget holders can open live budget-versus-actual reports in the system itself. iplicit’s real-time reporting and dashboards allow people across the organisation access to the data they’re authorised to view.

Age Scotland went from around four or five people using its finance system to around 40 people across the organisation getting value from it directly, seeing their own department’s monthly and year-to-date budget variances and full-year budget. Those users have the ability to drill down to individual transactions.

Reprieve’s budget holders previously relied on finance extracting data and rearranging it in Excel. “The ability to share budget vs actual reports with budget holders within the system has been revolutionary,” says Hubert Hutchinson, Head of Finance at the time of the change. “Now, budget holders have the access they need.”

At Landlink Estates, those without a licence for the old system previously couldn’t see anything, according to Senior Finance Manager Tom Marriott. Anyone with questions had to ask finance directly. Now, non-finance users can query the data themselves, with access limited to what they need.

See it for yourself: watch the 3-minute quick tour to see how iplicit handles reporting, or book a demo to talk through access for your own budget holders.