Addresses That Outlast Their Owners: A Custody Audit for Generic Inboxes in UK Professional Firms

A generic email address looks administrative. In practice, it is often an authority point. Messages sent to info@, admin@ or enquiries@ may contain instructions, approvals, complaints, attachments and personal data. The address may be printed on a website, embedded in a client portal and remembered by suppliers long after the person who created it has left the firm. Yet shared mailboxes are frequently governed less rigorously than a client file, a matter management system or a regulated document repository.

That imbalance deserves attention. A mailbox is not merely an inbox. Where it receives and holds client correspondence, it is a records location. UK professional firms should therefore be able to answer a simple question for every shared address: who is accountable for what it contains, who can access it, where its messages go and how long they are kept.

Begin with an inventory, not a policy

A custody audit starts with a list. Many firms discover that their shared mailboxes are more numerous than expected. The official enquiry address may have spawned aliases, team groups and legacy addresses that still receive mail. Some will be visible in the email administration console; others will appear only in website contact forms, invoice templates, supplier records or old signatures.

For each address, record the purpose, platform, creation date where available, current members, linked aliases, forwarding rules, integrations and any auto-response. Note whether messages are automatically copied outside the firm. Include distribution lists and shared team inboxes, not only mailboxes with a conventional name. The objective is a complete picture before any policy is rewritten.

Name an accountable custodian

IT teams administer mailboxes, but they should not be asked to decide what client correspondence means. Accountability belongs with the business area that uses the address. For each shared mailbox, name an accountable owner and a deputy. The owner should be a role or named individual with sufficient authority to decide access, response standards and retention treatment. The team is not an owner. Nor is the IT service desk.

Where a generic address serves several functions, split it or assign a lead custodian. An enquiries@ address that receives new business, complaints and supplier invoices is unlikely to have a coherent retention position. The custodian should review the access list, confirm the mailbox purpose and escalate unusual messages. The name should appear in a register and be reviewed at least annually.

Trace aliases, forwarding and delegation

The most useful part of the audit is often the least visible. Shared addresses accumulate plumbing. An alias may deliver to a personal inbox; a rule may forward messages to an external account; a delegate may hold send-as or send-on-behalf permissions; a mobile device may retain a copy of the mailbox. Each route changes who can see or use the correspondence.

Record every alias and forwarding destination. Confirm whether external forwarding is permitted, approved and logged. Review delegation permissions and mailbox rules, especially rules that redirect messages to folders or addresses that no one monitors. Check whether a website form, CRM or portal writes into the mailbox automatically. Where appropriate, use a controlled test message to confirm the delivery path, then document the result. The register should show the intended route and any approved exceptions.

Close the back door for joiners, movers and leavers

Access to a shared mailbox should follow role, not convenience. When a person leaves, the audit should confirm that mailbox permissions, delegation rights, rules, mobile access and forwarding arrangements have been removed. When someone changes role, their access should be reviewed rather than inherited by default. New joiners should be added through an approved request that names the mailbox and the reason for access.

A quarterly access review is a reasonable discipline for sensitive mailboxes such as complaints, finance or HR. The review should be evidence-based: who reviewed the list, what changed and when. This supports UK GDPR accountability and data minimisation without pretending that every email is a client record. The point is control, not bureaucracy.

Treat retention as a records decision

Not every message in a shared mailbox must be preserved. Some are routine administration; others contain instructions, approvals, complaints or attachments that belong in the client file. The firm should record a retention position for each shared mailbox: what is filed elsewhere, what remains in the mailbox, how long it is kept and how deletion is handled.

Automatic deletion policies need the same scrutiny. A short mailbox retention period may be sensible for routine enquiries, but it must not remove correspondence that should have been transferred to the matter file. Legal holds and complaints should override routine deletion. The custodian should confirm that sent items and attachments are included in the review, not only incoming messages.

A short audit routine

A workable first pass can be completed in a series of short sessions. Export the mailbox list, interview the custodians, trace forwarding and delegation, review access for leavers, sample recent messages and record the retention position. Produce a one-page register and a list of exceptions. Schedule the next review before the exercise closes.

The register need not be elaborate. It should identify the address, purpose, accountable owner, deputy, access list, aliases, forwarding arrangements, integrations, retention rule and last review date. That single view turns an invisible shared inbox into a governed records location.

Generic addresses are not neutral. They carry authority, memory and risk. A custody audit makes that visible and gives UK firms a defensible answer when someone asks who owns info@.