Passwords, Money, Documents and Family: How to Vet an Assistant Before Giving Them Access to Your Life

At some point, every overstretched business owner reaches the same conclusion: “I need an assistant. I can’t keep doing everything myself.” They find a candidate, conduct the interview and everything seems promising. The person is organised, quick-thinking and professional. Then comes the part many leaders barely consider until the hire has already been made.

For an Executive Assistant or Personal Assistant to genuinely take work off a business owner’s plate, they need access to information most people are used to protecting carefully: calendars, contacts, business correspondence, documents, negotiations, travel arrangements, suppliers and, in some roles, personal family matters and financial transactions.

That is when many leaders hesitate: “What if I give the wrong person access to too much?” And a paradox emerges. The business owner has gone to the trouble of hiring an assistant, yet still books their own flights, approves every payment, sends documents personally, signs off every email and checks every action. There is an assistant — but there is no real delegation. And the underlying problem is more complex than it first appears.

One of the most dangerous assumptions a leader can make is: “I need someone I can trust completely.” It sounds perfectly reasonable. But in business, trust should not mean handing over every key to the company to someone who interviewed for the role three days ago.

At the other extreme, if a leader refuses to give an assistant any real authority for months, that person can never become a genuine right hand. The better question, therefore, is not “Do I trust this person?” but “What level of responsibility and access am I prepared to give them at this stage, and what evidence will I need before I increase it?”

💡 The key principle: trust should grow in line with demonstrated reliability.

In 2026, this matters more than ever because trust is also a cybersecurity issue. According to Verizon’s 2025 Data Breach Investigations Report, the human element was involved in around 60% of the breaches examined, while compromised credentials remained one of the key routes attackers used to gain initial access.

Microsoft has highlighted the sheer scale of attacks on user identities as well: in 2024, the company reported more than 7,000 password attacks per second. Access management is therefore no longer simply a question of whether you trust your assistant. It is part of your company’s security infrastructure.

If you are looking to hire a Business Assistant, do not assess candidates solely on their experience, an impressive CV or how personable they are in an interview. This is particularly important when the role involves access to sensitive information.

An interview should test not only “Can this person do the job?” but also “How do they make decisions when no one is watching?”

Instead of simply asking, “Are you comfortable handling confidential information?”, give them a scenario: “You accidentally gain access to a document that clearly wasn’t intended for you. What do you do?” Or: “A supplier asks you to send over one of the director’s documents and says they have always been given it before. The director is unavailable. What do you do?” Or: “An invoice needs to be paid urgently, but the bank details in the email are different from those previously used by the company. What would you do next?”

You are not looking for a perfectly rehearsed answer. Look at whether the candidate asks clarifying questions Checks the source Recognises potential risk Understands the limits of their authority Is prepared to stop an action when the consequences of getting it wrong are significant Knows when and how to escalate an issue calmly.

You can run an excellent assistant recruitment process, hire someone intelligent and trustworthy, and still expose the business to risk from an entirely different direction. An employee might keep work passwords in their phone notes, reuse the same password across several platforms, log into company systems from other people’s devices, forward documents to a personal messaging account “because it’s easier”, or upload confidential information to AI tools without understanding company policy.

None of this necessarily involves malicious intent. Sometimes it is simply poor digital hygiene. Unfortunately, the consequences for the business can be just as serious.

Microsoft’s 2025 Digital Defense Report states that 97% of the identity attacks it observed were password spray attacks. When recruiting someone who will have extensive access, it is therefore worth explicitly assessing their approach to passwords MFA corporate email devices cloud storage AI tools and sharing documents with third parties.

This is where leaders tend to make one of two opposite mistakes. The first is: “I won’t give them access to anything until I trust them completely.” The second is: “Here are all my passwords, my card and my documents — sort it out.” Neither approach is particularly sound.

A much safer approach is to use an access ladder.

Level 1 — Minimum access. At the beginning, the assistant receives only the tools and information required for their initial responsibilities. Level 2 — Operational access. Once they have demonstrated discipline and reliability, access can expand to calendars corporate systems business correspondence suppliers and documents. Level 3 — Sensitive information. This may include financial documents selected personal data confidential projects negotiations and family logistics. Level 4 — High-trust access. The assistant independently manages significant areas of responsibility within clearly defined parameters and restrictions.

This is not intended as a universal legal or cybersecurity framework, but as a practical management principle. Specific permissions should always reflect your IT infrastructure, applicable legislation and risk profile.

💡 Never give someone more access than they need to perform their role.

This requires another important shift in thinking. When a business owner says, “I’ll have to give my assistant my password,” the answer is often: no, you won’t.

Many business platforms allow you to create separate user accounts assign roles restrict permissions enable MFA provide temporary access monitor activity and revoke access without changing the owner’s primary password.

The leader’s job is therefore not to distribute their own login credentials. It is to build a system in which each employee receives exactly the level of access required to do their job.

This is becoming increasingly important. Verizon reported that third-party involvement in the breaches examined for its 2025 report doubled to 30%.

A good assistant reduces the number of tasks sitting with the leader. A good access system reduces the number of risks created in the process.

This is one of the most sensitive areas of all. An Executive Assistant or Personal Assistant may quite reasonably book travel pay for business services liaise with suppliers make purchases and manage invoices.

But “handles payments” and “has unrestricted access to all company or personal funds” are two very different things.

Set the rules in advance: spending limits permitted expense categories approval requirements procedures for new bank details approval thresholds for larger transactions prohibited actions and how expenses must be recorded.

Changes to payment details deserve particular attention. AI is making fraud increasingly convincing, and Microsoft has highlighted the use of AI by threat actors to create more personalised attacks and deepfake-enabled scams.

That means an email “from the CEO”, a voice message or even a phone call should not automatically be treated as sufficient authorisation for an unusual financial transaction. For high-risk actions, establish a second verification channel in advance.

If you are looking to hire a senior Executive Assistant, you need to understand the unusual nature of the role. An assistant to a founder, CEO or principal can end up knowing more about their private life than almost anyone else in the company. They may know travel plans family schedules addresses personal contacts information relating to medical or educational arrangements dates when the principal will be away and family preferences.

That makes boundaries essential.

What does the assistant genuinely need to know? What information may be stored, and where? What must never be forwarded? Who may receive personal information? What happens if a member of the principal’s family requests confidential information? What happens to the data when the working relationship ends?

“It’s obvious” is not a confidentiality policy. If a rule matters, make it explicit.

A non-disclosure agreement can be an important part of the employment relationship, particularly when someone will have access to commercially or personally sensitive information. The precise documentation and wording should, of course, be agreed with a lawyer familiar with the relevant jurisdiction.

But there is a common management mistake: signing an NDA and assuming the security issue has been dealt with. It has not.

A legal agreement does not remove the need to restrict permissions use individual accounts enable multi-factor authentication establish rules for handling data monitor the allocation of access rights and revoke them promptly when required.

An NDA defines legal obligations. Access management determines what an employee is technically able to do. You need both.

“She seems like a very trustworthy person.” Perhaps she is. But recruitment is a poor place to rely on impressions alone.

Behaviour tells you far more.

How does the candidate speak about their previous employer Do they reveal other people’s confidential information How carefully do they handle documents Do they admit mistakes Do they clarify the limits of their authority Do they record agreements and decisions Do they flag risks early or hide problems until the last possible moment Do they follow procedures even when those procedures are inconvenient.

🚩 One particularly important red flag is a candidate who is far too willing to share confidential details about a former employer during an interview.

Today, they are telling you someone else’s secrets. Tomorrow, they may be telling someone else yours.

Imagine your assistant makes a mistake. It is tempting to assume that trust has been broken. Yet sometimes that moment tells you more about the person than the previous two months of flawless work.

A strong employee does not try to hide the mistake. They report it promptly assess the impact propose a solution correct what can be corrected learn from what happened and adjust the process to reduce the likelihood of it happening again.

The greater risk is not necessarily the employee who makes a mistake once. It is the employee who conceals a problem while there is still time to fix it.

So during the recruitment process, ask: “Tell me about a time when a mistake you made could have had a significant impact on the outcome. When did you tell your manager, and what did you do next?”

Do not focus on how dramatic the story is. Focus on the logic behind the candidate’s behaviour.

This is a question to answer before you hire someone, not after they say, “I’m leaving.”

If your Executive Assistant stopped working with you tomorrow, could you establish within an hour:

Which systems they can access Which documents they hold Which devices are authorised Where business files are stored Which passwords or credentials need to be changed Which permissions need to be revoked Which tasks are currently in progress Which suppliers or external contacts need to be informed.

If you cannot answer those questions, the problem is not necessarily the assistant. The problem is the architecture of your processes.

A robust system should allow you to revoke access quickly and transfer context to the next employee without creating chaos.

Business owners often begin with: “I need an assistant. Where do I find a good one?” But effective Executive Assistant recruitment starts before the job advert is ever written.

First, define:

Which responsibilities you want to delegate How much autonomy the role requires Which decisions the assistant can make independently What information they genuinely need Which systems they require access to What risks come with the role How performance will be monitored How the scope of responsibility could expand over the next three to six months.

Once those questions have been answered, it becomes considerably easier to hire the right Business Assistant — because you are no longer looking for an abstract “great person”. You are recruiting for a clearly defined role.

Before making an offer:
✔ Verify relevant experience
✔ Obtain references where appropriate and lawful
✔ Use scenario-based interview questions
✔ Assess their approach to confidentiality
✔ Discuss digital security
✔ Define the expected level of authority.

When they start:
✔ Grant only the minimum access required
✔ Use individual user accounts
✔ Enable MFA
✔ Establish rules for handling documents
✔ Set financial limits
✔ Agree escalation procedures.

After the probation period:
✔ Review the quality of their decisions
✔ Assess how they handle mistakes
✔ Check whether agreements and procedures are being followed
✔ Expand authority where appropriate
✔ Review access levels.

When the working relationship ends:
✔ Revoke accounts and active sessions
✔ Change relevant credentials
✔ Recover company devices
✔ Transfer documents and outstanding tasks
✔ Review cloud storage
✔ Ensure a structured handover of context.

Many business owners think: “First I’ll find someone I can trust, and then I’ll finally start delegating.”

In reality, it works the other way round. You can hire an assistant with excellent references, strong skills and a highly developed sense of responsibility — and still find yourself checking every detail.

Because delegation is not primarily a competency of the assistant. It is a competency of the leader.

The employee may be perfectly capable of taking ownership. But the leader still needs to define the outcome delegate sufficient authority establish boundaries provide the right resources agree checkpoints resist intervening in every step and maintain oversight without micromanaging.

If you hire an assistant but continue carrying every one of their tasks in your own head, you have hired an executor — you have not yet built a delegation system.