Years ago, during a routine review at the bank, we pulled the access list for one of our payment systems. Most of it looked right. Then someone pointed at a name halfway down the page and asked, "Didn't Brenden leave?"
He had. Fourteen months earlier, on good terms, to a job across town. His login still worked. Nobody had used it, as far as we could tell, and nothing bad had happened. But nobody could say that with confidence, and that was the problem.
No one did anything wrong, exactly. HR processed his departure. His manager collected his badge. IT closed his email. The payment system sat with a different team, and that team never got the memo.
I have seen some version of this at almost every organization I have worked with since, large and small. A bookkeeper who moved to sales but kept full rights in the accounting system. A shared login for the bank portal that three people know and nobody has changed since 2019. An outside IT contractor whose remote access was set up for one project and never switched off.
None of these are dramatic. That is why they last.
Why this keeps happening
Access gets granted on a busy day by someone trying to help. Taking it away is nobody's job in particular. People leave on a Friday, the replacement starts on Monday, and the cleanup slides to next week, then next quarter, then never.
The fix is not expensive software. It is a short, boring routine that someone owns, done on a schedule, with a record that it happened.
A quarterly access review you can keep up with
Put it on the calendar four times a year. For a firm of ten to fifty people, the first pass might take an afternoon. After that, an hour or two.
1. List your systems. Write down every place money, client data, or company records live. Email, accounting, payroll, the bank portal, your file storage, your CRM, the website, social media accounts. If you are unsure whether something belongs on the list, put it on.
2. Name an owner for each one. One person, not a department. The owner is the one who approves new access and answers for who has it. In a small firm the same person may own several systems. That is fine, as long as it is written down.
3. Pull the actual access list. Do not work from memory. Export or screenshot the user list from each system and have the owner go line by line. Is this person still here? Do they still need this? Do they need this much? An admin account for someone who only runs reports is worth a second look.
4. Check your leavers. Get the list of everyone who left or changed roles since the last review and confirm each one is gone from every system on your list. Better still, keep a one page leaver checklist with those systems on it, and have it signed off on the person's last day. The quarterly review then becomes a check on the checklist.
5. Deal with shared and generic logins. "Admin," "frontdesk," "accounting@." Sometimes these cannot be avoided. When they can, give people their own accounts. When they cannot, know who has the password, keep it in a password manager rather than a sticky note, and change it whenever someone who knew it leaves.
6. Look at vendor access. Your IT provider, your outside bookkeeper, the software company that helped you migrate last year. Ask whether each one still needs access, whether it can be limited to when they are actually working, and who on your side would notice if it were used.
7. Sign off and keep the evidence. Each owner signs and dates their review. Keep the exported lists, the notes on what you removed, and the date. A shared folder works. This is the part people skip, and it is the part that matters most when someone asks.
How do you know?
That question is the reason for all of this. If your board, a client, an auditor, or your insurer asks whether former employees can still get into your systems, "I think so" and "IT handles it" are not answers. A folder with four signed reviews a year, and a list of what you found and fixed, is an answer.
The first review almost always turns up something. That is not a failure. It is the review doing its job.
If you would like a second set of eyes on your first one, or help setting up a checklist that fits how your firm actually works, I am glad to talk it through. No pitch, just a conversation.
Want to know how your controls hold up? Start a conversation