An access review is a scheduled check of everyone and everything that can get into your store, run on the calendar rather than when somebody leaves. It exists because most stale access is not created by a departure: it is cover that never ended, a project that finished, or a role that changed, and none of those trigger anything.
When to use it
Run it quarterly. Monthly becomes a chore that gets skipped, and annually lets enough accumulate that the review stops being quick, which is also how it gets skipped.
Announce the cadence once, before the first one. Removing access from somebody who has done nothing wrong feels like an accusation if it is a one-off, and like bookkeeping if it is a known routine.
The template
Work down the list. The question for every line is the same: does the reason this was granted still exist?
ACCESS REVIEW Quarter: [ ] Run by: [name] Date: [ ] 1. PEOPLE WITH A LOGIN For each: does the job this was granted for still exist? [ ] Staff accounts listed and attributed to one named person each [ ] Anyone who changed role this quarter, re-checked [ ] Anyone given temporary cover, cover confirmed ended [ ] Leavers from this quarter, confirmed removed 2. EXTERNAL [ ] Agencies, freelancers, contractors listed [ ] For each: engagement still live? end date recorded? [ ] Agency staff changes checked (the firm stays, the person may not) 3. APPS [ ] Installed apps listed [ ] Any installed for a trial and never removed 4. NOT ACCOUNTS [ ] Shared docs and drives with link sharing left on [ ] Group chats containing people who no longer work with you [ ] Supplier portals and saved payment methods [ ] Email forwarding rules set up during an absence 5. SHARED LOGINS [ ] Anything that cannot be attributed to exactly one person These are a separate project, not a review item. REMOVED THIS QUARTER: [list] Next review: [date]
How to adapt it
- Remove in the same sitting. A review that produces a list of things to deal with later produces nothing, and next quarter finds the same list with additions.
- Record what you removed. Two lines per review. It tells you next time whether the review is catching real drift or has become a rubber stamp.
- Do section two first if you are short of time. External access is where stale permissions concentrate, and it is usually a list of four or five.
- Treat shared logins as a project. They cannot be reviewed, because the honest answer to does this person still need it is that you do not know who this person is.
Why it is this short
The list is short because a long audit does not get run. Most of the risk sits in a small number of places, and a fifteen-minute check that happens beats an hour-long one that is postponed to next quarter twice.
It also asks only yes-or-no questions. Anything requiring judgement slows the review down enough that it stops being quarterly.
The reasoning behind it
The argument for running this on a calendar rather than on events, and what typically turns up the first time, is in the quarterly access review nobody runs. This page is the artefact; that one is why it exists.
Common questions
How often should access be reviewed?
Quarterly suits most small stores. Monthly becomes a chore people skip, and annually allows enough to accumulate that the review is no longer quick.
What is the most commonly missed stale access?
Cover that never ended. Somebody was given wider access while a colleague was away, the colleague came back, and nothing triggered a removal because nothing happened.
Should apps be included in an access review?
Yes. An app installed for a trial and never uninstalled keeps whatever permissions it was granted for as long as it stays installed.
What about access that is not an account?
Shared drives with link sharing left on, group chats containing former contractors, supplier portals and forwarding rules set up during an absence. These are forgotten more often than logins because nobody thinks of them as access.