Who has access to what? The annual access review every SME should do

Ask at an SME of fifteen employees who has access to the shared customer folder, and you usually get a hesitant 'everyone, I think'. Ask who is an admin on the website, and the answer is a short list of names, two of which no longer work there. That is not sloppiness, that is how access works when nobody manages it: it only ever grows. Every role change, every project and every temporary exception adds rights. Nobody takes them away, because there is never a moment for it. This article is about that moment: an annual access review, in five steps, in half a day.

Access that only ever grows

These are situations we come across in almost every first review. Not because the company is badly organised, but because granting access is an action and removing access is a decision.

• The intern from two years ago is still in the shared folder, because their account was never closed.
• The previous bookkeeper still has access to the banking platform, because that authorisation sat with the bank and not with IT.
• Everyone is an admin on the website, because at some point that was easier for posting a news item.
• A supplier has permanent VPN access for a project that was completed last year.
• Whoever moved from sales to administration now has the rights of both roles.

Why this matters

As long as nobody means harm, you notice none of this. But access that is too broad becomes a problem the moment one account falls into the wrong hands, or one former employee is left with a grudge.

• One hacked account gives the attacker everything that account can reach. Giving people only the access they need is the cheapest damage limitation there is.
• NIS2 and cyber insurers ask about it. 'Who has access to what, and when was that last checked?' has become a standard question, and 'no idea' is not an answer.
• GDPR expects personal data to be accessible only to those who need it. A former intern in the customer folder is a data breach that has not been discovered yet.

The annual review in five steps

The exercise itself is not technical. What matters is that you actually do it once a year.

1. List all systems. Not only Microsoft 365 or Google Workspace, but also the accounting package, the CRM, the banking platform, the website, social media, the password manager, the VPN, the alarm system and the tools you forgot you had.
2. Per system, note who has access and at what level: regular user, admin or read-only. Do not forget external parties: suppliers, the accountant, your previous IT person.
3. Have each owner confirm whether it is still correct. The managing director for the bank, the office manager for the shared folders, the marketing lead for the website. IT does not decide who may do what, the owner of the system does.
4. Remove or reduce. What is no longer needed goes. Whoever has too much gets less. In doubt, reduce first and see if anyone misses it. That rarely happens.
5. Document the date and the decisions. A simple tab is enough: system, who, which level, checked on, by whom. Next year you start from that list, and in an audit you have proof right away.

Tools that make it easier

You do not have to do this on paper. Most platforms you already pay for show this centrally.

• Microsoft 365 and Google Workspace have an admin centre where you see per user which licences, groups and shared folders belong to them, and who is an admin.
• A password manager with shared vaults shows who can see which logins. Whoever leaves disappears from the vault and the passwords get rotated. More on that approach in a password manager for your team.
• SSO (single sign-on) where possible: have your tools sign in via your Microsoft or Google account, then closing one account is enough to be locked out everywhere.
• For systems without a central overview, such as the banking platform or the website, the list from step two is your only source. Keep it up to date.

How long does it take for fifteen employees?

Realistically: half a day, once a year. The first time a bit longer, because you still have to build the list of systems and will probably clean up more than you expect. Tie it to a fixed moment, for example the first week of December or just after the year-end closing. And connect it to the two moments when access changes: when someone starts and when someone leaves. Whoever gets those two right has little to remove at the annual review.

What an IT partner takes off your hands

At clients where we handle IT management, the annual access review is a fixed part of the service. We build the list of systems and keep it up to date, pull the current access from the platforms, present it per owner, apply the changes and deliver the documentation. Your role is limited to confirming what is still correct and deciding when in doubt. That is an hour of your time, not half a day. And it is exactly the kind of proof that NIS2 questions and insurers want to see.