What it means
A former contractor still appears as an active user in a payroll application. An access review should find the account, decide whether it has a valid owner and ensure it is removed or disabled.
A signed spreadsheet alone does not protect any data. The review begins with scope and evidence.
Decide whether it covers one application, all finance systems or a particular privileged role, then gather a current export of users, roles, groups and last-use dates. Check the time of the export and whether it is complete, because a stale list produces a stale review.
Next, the right person must decide. An application owner and a line manager may each know part of the picture, so the reviewer must be someone who can judge business need.
High-risk rights such as administrators, payment approvers and sensitive-data exports deserve focused attention, along with shared accounts, service accounts and external users such as vendors and consultants. Each account then gets a clear outcome: keep, change, remove or investigate, with the reason recorded because vague labels such as approved can hide uncertainty.
Look at inherited rights as well, since an identity group may grant access indirectly. Be careful with activity data, because a low login count can signal unnecessary access, but an emergency administrator account may be deliberately quiet.
The weakest point is usually the follow-through. A reviewer who marks an account for removal has not removed it, so someone with system privileges must make the change and the team must re-check the live system afterwards.
Unresolved items, such as a high-privilege account with no verified sponsor, should be escalated and not silently approved. Cadence and records should be set by risk.
Critical systems deserve more frequent review than low-risk tools, and contracts or regulations may add timing requirements. Keep proof of decisions and actual changes for the period set by internal policy, and protect the exports themselves because permission inventories reveal sensitive structure.
In practice
Real-world examples.
Example
A finance team reviewing its payroll system finds a former contractor's account, confirms the departure with the project manager and disables it the same day. The reviewer then checks the payroll system again to confirm the status shows disabled.
Example
A bank branch analyst keeps read-only access to a reporting tool but loses payment approval rights that belonged to a previous role. The manager confirms that the remaining rights match the current job description.
Example
A hospital group assigns a named owner and a written purpose to a service account that sends appointment reminders, which previously belonged to nobody. If the owner later leaves, the review flags the account for reassignment.
Formula
Calculation
Remediation closure = verified changes completed / changes approved for action x 100
Worked example: a review approves 10 changes, such as removing 6 stale accounts and trimming 4 excessive permissions. When a fresh export confirms that 9 of the 10 are done, closure is 9 / 10 x 100 = 90%.
The tenth change stays on a tracked ticket, and if it involves a high-risk account it should be escalated and not left open quietly.Case study
Seen in the real world.
This entirely fictional example follows Elm Trading, an invented import business. Its quarterly review report showed a privileged account that belonged to a completed contractor project. The system owner requested removal, and the security team then checked a fresh export to confirm the role was really gone.
Elm Trading added a rule that every approved removal must be verified in the live system within five working days. The illustrative case shows closing the loop from decision to verified change, and it does not prescribe a review schedule for any business.
The team also began to group accounts by role and highlight changes since the previous review, so approvers saw what was new and not a long unfiltered list. That reduced rubber-stamp approvals and surfaced two further stale accounts in the next cycle.
Watch out
Common mistakes.
- Signing off an access list without checking inherited permissions that arrive through groups.
- Marking an account for removal but never verifying that the change was actually made.
- Assuming an unused account is always safe to delete, without checking whether it serves an emergency or automated purpose. Deleting a quiet but essential service account can stop a payroll run or an overnight data transfer.
Questions
People also ask.
What is an access review?
It is a check of current permissions against an ongoing business need, with documented decisions and follow-up.
How often should one be done?
Set a schedule based on risk, and check any contract or regulatory requirement that applies, because there is no single interval for every business. Critical systems often warrant a shorter cycle than low-risk tools.
Why does it matter?
It finds stale or excessive access, which helps reduce security and fraud risk and gives evidence for auditors that controls are working. It also keeps the list of people with power over money and data accurate as the business changes.
From the founder's library
Take it further with the book.
Build your financial confidence beyond this definition. Shihan's full-length guide, Accounting Fundamentals, takes the same plain-English approach and turns it into a complete, practical playbook for non-finance managers, business owners and students - with chapter-end quiz answers and presentation slides included.
25% off with code MMHQ25, applied at checkout. Priced in USD - checkout may show the equivalent in your local currency.
View the book and save 25%Related