People collect access the way desks collect paper. A new project adds a folder here, a tool there, a temporary admin right that never gets taken back. After a few years, the person who started in support can quietly reach payroll. The principle of least privilege pushes against this drift: every person, service and device should have only the access needed for its current job. An access review is how you enforce it.

Why Excess Access Is a Real Risk

Extra permissions rarely cause trouble until something goes wrong, and then they multiply the damage. If an account with broad rights is phished, the attacker inherits everything that account can reach. If an employee makes an honest mistake, they can break more than their role should allow. If a former employee’s account lingers, nobody is watching it, which makes it attractive to attackers.

Least privilege shrinks all three problems. It does not assume people are untrustworthy. It simply limits how far any single failure can spread.

The Review in Five Passes

Run the review at a regular interval, quarterly for sensitive systems and perhaps twice a year for others. Each pass has a clear question.

Pass 1: Who has an account?

Export the user list for each key system and compare it with the current staff, contractor and vendor lists maintained by whoever handles human resources. Anyone who appears in the system but not on the list is a candidate for removal. Do not forget service accounts and integrations, which belong to no person but still hold access.

Pass 2: Who has elevated rights?

List every administrator, owner and approver. Ask whether each person still needs those rights, and whether a more limited role would do. Administrators should be few, named and ideally using a separate account for admin tasks.

Pass 3: Does the access match the role?

Compare each person’s permissions with what their present role requires. The key habit is to ask the system owner or manager to confirm, rather than guessing from titles alone.

Pass 4: Is anything temporary and expired?

Look for access granted for a project, an audit or a trial period. If the work is finished, the access should be too.

Pass 5: Are shared and external accounts justified?

Shared logins, guest users and vendor accounts deserve extra scrutiny because accountability is weak. Replace shared logins with named accounts where possible, and give external users expiry dates.

Review Worksheet

Item to check	Question to ask	Action if the answer is no
User accounts	Is this person still with us?	Disable, then delete after a retention period
Admin rights	Does this role need admin?	Downgrade to a standard role
Group memberships	Does this match the current job?	Remove old group memberships
Temporary access	Is the project still running?	Revoke and record the date
Service accounts	Is the owner known and the account in use?	Assign an owner or retire it
External users	Is there a current contract or need?	Remove or add an expiry

Handle Role Changes and Departures Continuously

A quarterly review catches what slipped through, but the better fix is to prevent the slip. Tie access changes to events:

• Joiners: provision from a role template instead of copying a colleague’s account, which also copies their accumulated extras.
• Movers: when someone changes teams, remove old access as part of the move rather than just adding the new.
• Leavers: disable accounts on the final day, or earlier when circumstances call for it, and reclaim devices, tokens and shared secrets. Reset any credentials the person knew.

Role-based access, where permissions attach to roles or groups instead of individuals, makes all three easier. Changing a role then updates dozens of permissions at once.

A Realistic Example

Imagine a hypothetical twenty-person logistics company that runs its first access review. The IT administrator exports user lists from the email system, the shared drive and the accounting tool. Comparing them with the staff list, she finds two former seasonal workers whose accounts are still active, a contractor with administrator rights from a long-finished migration, and an operations coordinator who retained edit access to the finance folder after changing teams. She disables the stale accounts, downgrades the contractor, and, after confirming with the finance manager, removes the coordinator’s finance access. She also notes that the accounting tool has a shared login used by three people; she schedules a change to named accounts. The review takes an afternoon, and the findings become the starting point for tidying up the joiner, mover and leaver steps so the same gaps do not reappear.

Making Reviews Stick

Reviews fail when they are one person’s burden. Share the load by asking data and system owners to attest that their lists are correct, with a short deadline. Keep a simple record of the date, the reviewer, what was found and what was changed. This record is useful for your own learning and may help if a customer, insurer or regulator asks how access is controlled. Requirements differ by industry and jurisdiction, so consult a qualified professional about any obligations that apply to you.

Automate where it helps. Many identity and productivity platforms offer reports of inactive accounts or built-in access review features. Check the vendor’s current documentation to see what your tools offer, but do not wait for automation before starting; a spreadsheet works.

Frequently Asked Questions

What does least privilege mean for non-technical staff? It means people can open and change what their work needs and nothing more. Most staff should never have administrator rights on systems or their own devices.

How often should we review access? Quarterly for systems holding sensitive data or financial functions, and at least yearly for the rest. Also review after reorganizations and after any security incident.

Should we delete accounts of people who leave? Disable first, which stops access immediately while preserving data and history. Delete after your retention period once you confirm nothing depends on the account.

How do we handle someone who needs temporary elevated access? Grant the minimum rights for a defined period, record the reason and approver, and set a date to remove them. Many platforms support time-limited access.

Is a review worth it for a team of ten? Yes. Small teams often have the loosest permissions and the least visibility, so even a short review typically finds easy wins.

Next Step

Export the user list from your email or file-sharing system, compare it against your current staff list, and disable every account you cannot match to a real, current person.