Every organisation we audit has the same finding somewhere in the report: someone who left still has access to something. It is rarely malice and almost never noticed. Someone resigns, IT disables the laptop login, and the eight other places they had an account quietly carry on.
An access review is the least glamorous control in any security framework. It is also one of the few that catches problems every single time it runs.
What actually accumulates
Access debt builds from ordinary events, not unusual ones. A contractor is given admin rights for a migration and nobody removes them afterwards. A shared mailbox is created for a project that ended two years ago. A finance system login is passed between three people because buying a second licence was never approved.
- Leavers with active accounts in systems outside your identity provider
- Contractors and vendors whose access outlived the engagement
- Standing administrative rights held by people who need them twice a year
- Shared credentials with no named owner
- Guest accounts in Microsoft 365 from long-finished collaborations
A review that takes an hour, not a week
The reason most access reviews do not happen is that they are scoped too broadly. Reviewing every permission in every system is a project. Reviewing the accounts that could cause real harm is an hour.
We work through four questions each quarter. Who has administrative rights, and do they still need them. Who has left since the last review, and is every account closed. Which external guests still have access, and to what. Which logins are shared, and who owns each one.
A control that runs imperfectly every quarter is worth more than a thorough one that runs once and is never repeated.
Make the leaver process the fix
The review finds problems. The offboarding checklist prevents them. If your review keeps surfacing the same category of account, the answer is not a better review — it is a change to what happens on someone's last day.
For managed clients we keep that checklist in the documentation alongside the environment, so the person doing the offboarding is not reconstructing it from memory. If you would like a copy of the template to adapt, ask and we will send it over.