The question "who in our company has access to the customer database" sounds innocent. In most SMEs, after a week of collecting answers it turns out that half as many people again have access to it as anyone expected — plus two accounts of employees who left three years ago, and one integration login whose password nobody remembers.
An access review isn't a security audit and isn't an SSO rollout. It's a plain, boring, quarterly tidy-up: someone walks system by system and account by account, asks "does this person still need this access", and ticks the box. Nothing more. For most SMEs it takes two days once every three months — provided someone finally starts.
Why bother at all
Three reasons, each enough on its own:
- People leave, accounts stay. Especially in systems IT doesn't see day-to-day — an external logistics platform, a wholesaler account, access to a bank portal. Offboarding catches 70% of accounts; the missing third is only caught by the review.
- Permissions pile up. Someone got promoted, switched departments, covered a colleague for two weeks three years ago — and ended up with access they no longer need. A single case is harmless; ten of them add up to a compliance problem.
- Auditors ask about it more and more often. Banks when extending credit, insurers for a cyber policy, NIS2 inspection in regulated sectors, a large B2B customer before signing a framework agreement. "We review access quarterly" is today's standard answer that closes the point. No answer opens five more questions.
Skipping the review usually comes to light too late — a former employee who left six months ago is still receiving emails from a company mailbox because nobody closed their account in one of the cloud apps.
Which systems actually need the lens
A 30-person company typically has 15–25 systems in which someone has an account. Not all of them matter equally. A sensible split:
- High risk (quarterly): ERP (Comarch Optima, enova365, Subiekt, Microsoft Dynamics), WMS, CRM, online banking, Microsoft 365 / Google Workspace, VPN and remote access, domain administration (Active Directory, Entra ID), code repositories.
- Medium risk (every six months): HR and payroll systems (Płatnik, Comarch ERP HR), logistics platforms (Transportero, Trans.eu), supplier portals and marketplace accounts, ticketing systems, the file share / SharePoint, networked printers with a management panel.
- Low risk (yearly or ad hoc): marketing apps, graphics tools, utility licences. Not because they're less important, but because they're usually tied to one person and rarely shared.
Most firms try to cover everything at once, get stuck at the fourth system, and never finish. Better to do the first category properly every quarter than all three sloppily once a year.
What it looks like in practice — one company, two days, concrete findings
With one of our clients — a 24-person distributor from western Poland, running Comarch Optima, Microsoft 365, Subiekt for a branch, and three logistics platforms — the first serious access review took a total of 16 hours of work by one person (the chief accountant with an IT flair) spread over three afternoons. Scope: 7 systems from the high-risk category.
The findings were typical — and telling. Two active Microsoft 365 accounts belonging to employees who had left 18 and 24 months earlier (E3 licences costing the company roughly PLN 1,200 a year with zero value). In Comarch Optima, seven people with an active "cashier" profile also had access to the HR/Payroll module, which they'd needed for one week in 2023 when a colleague was on holiday. In Subiekt, a shared "warehouse" account whose password was known to eight people and which couldn't be unambiguously tied to any of them. Two integration accounts (to the CRM and to a logistics platform) that nobody could describe — they'd been created by the previous IT vendor and nobody knew whether they could be disabled. One API token with full permissions, issued "for testing" in 2024, still active.
Remediation time after the review: another 8 hours. One-off savings: PLN 1,200 a year in licences plus two potential attack vectors closed (a dormant Microsoft 365 account of an ex-employee is almost pre-staged ransomware). Lasting savings: a full quarter without discovering that "someone else also has access". And the first coherent picture — for the first time in years, it was clear who actually held which key.
The second review, three months later, took 6 hours. The third — 4 hours. The first one is hard because you're cleaning up a decade of neglect. After that it's just upkeep.
What exactly to check for each account
A short, repeatable list — because a long list will kill the review after the first pass:
- Does the person still work for the company. Reconcile the account list with HR. Obvious, but surprisingly often it fails — especially in systems where HR integration is manual or non-existent.
- Are they still in the same role. The person from the warehouse who moved to purchasing three years ago still has stock-adjustment rights. Not because they use them, but because nobody took them away.
- Is it a personal account, a shared one, or an integration account. Shared accounts ("warehouse", "reception") and service accounts need different treatment — you can't just disable them, you have to decide whether they're needed and who owns them. We covered this separately in our piece on service accounts.
- Is the access needed for the work the person actually does. This question goes to the manager, not to IT. IT doesn't know whether Anna really needs the Analytics module in the ERP. Her manager does.
- When they last logged in. In most systems this is a one-click piece of information. An account unused for 6 months essentially disqualifies itself.
Format of the answers: a spreadsheet with 20–50 rows and four columns — account, system, decision (keep / remove permission / disable account), who decided. Nothing more. Not Jira, not Confluence, not a dedicated GRC platform. A spreadsheet that goes to the archive after the review and serves as proof that the review happened.
Three traps you'll fall into
First attempts usually walk into the same mines:
- Delegating the whole thing to IT. IT sees accounts, not business needs. The call on whether a salesperson needs access to the purchasing module is made by their manager. IT only executes the decision.
- A "just-in-case" review. Some firms try to pull everything: ERP permissions at the window level, every NTFS folder, every AD entry. After a week everyone has had enough and the review never finishes. Seven systems at the role level beats twenty-five at the checkbox level.
- "Let's do it just this once". A one-off review loses most of its value within 6 months, because life in the company goes on — new people, role changes, cover arrangements. The whole point is the rhythm. If you can't make a quarterly cadence, do it every six months — but a cadence.
How to start this week
A simple sequence that doesn't require any new tooling:
- Step 1 — write down the list of high-risk systems. Five or seven, not twenty. ERP, email, VPN, bank, domain administration. That piece of paper takes 20 minutes.
- Step 2 — for each system, pull the account list. In most ERPs it's a single report; in Microsoft 365 — an export from the admin centre. Half a day for everything.
- Step 3 — reconcile the account list with the current HR roster. Accounts without people = disable. People without accounts = are you sure nothing's been missed.
- Step 4 — send the remaining accounts to department managers with the question "does this person still need this access". Don't tick anything on their behalf. Nine out of ten will answer within a week.
- Step 5 — execute the decisions. Archive the spreadsheet with a date. Put the next review date in the calendar — not "in three months", but a specific date.
An access review won't eliminate security incidents. It will shrink their blast radius — if something goes wrong, one person loses, not thirty. And it lets you answer an auditor's question with a sentence, not a slide.
A dormant account of someone who left a year ago does no damage until it does. An access review is the quarter-hour that answers "until".