How Often Should You Review Who Has Access to What

A bookkeeper moved into an operations role eight months ago. She still has approval rights in the accounting system, full access to the payroll folder, and a login to the bank portal. A contractor finished a project in the spring, and his shared drive access never changed. Nobody did anything wrong. Nobody was asked to check.

That is how access builds up at a growing company. People join, change roles, and leave, and each change adds a little more access than anyone planned. A regular review is the fix, and the useful question is how often to run one.

Why Access Builds Up Faster Than Anyone Notices

Access is granted in a hurry and removed slowly. A new hire needs to work on day one, so they get whatever a similar employee has. A manager needs a file now, so someone adds them to the folder. A vendor needs a login for a week, and the login lasts for years.

Very little of this is tracked in one place. A growing company at 50 or 100 employees often runs dozens of cloud tools, and each one has its own list of users. The email system, the file share, the accounting platform, the CRM, the bank portal, the HR system, and the tools a department bought on a company card all keep separate lists. Removing someone from email does not remove them from the rest.

The result is what security teams call privilege creep: people holding more access than their current job needs. It is also how a former employee or contractor keeps a working login long after the relationship ended.

What Unreviewed Access Costs

Attackers do not need to break in when they can log in. The Verizon 2025 Data Breach Investigations Report found that abuse of stolen credentials was the most common way into a breach, at 22 percent of cases, ahead of exploited vulnerabilities (20 percent) and phishing (16 percent). Other reports that count differently put the share higher or lower, but they agree on the direction: valid logins are a leading entry point.

An old or excess account makes that worse in two ways. A forgotten account usually has no one watching it, so misuse goes unnoticed. And an account with more access than its owner needs turns one stolen password into a bigger problem than it should be.

The financial stakes are real. IBM's 2025 Cost of a Data Breach report put the global average cost of a breach at $4.44 million. Most growing companies will never see a number that large, but the pattern scales down: the longer an intruder holds a valid login, the more it costs to find, contain, and clean up. For a 75-person company, even a fraction of that average is a serious event.

Access also comes up outside of attacks. Cyber insurance applications and client security questionnaires routinely ask how often you review user access and how quickly you remove departing staff. A vague answer is a weak answer.

How Often to Review: A Practical Cadence

No single frequency fits every account. Risk differs by account, so the review schedule should too. NIST's account management control (AC-2 in SP 800-53) tells organizations to review accounts for compliance with their own policy, and it leaves the review frequency for the organization to set. The cadence below is the one Elevaire recommends to growing companies. It is a working standard, not a rule from NIST or any regulator.

Account type	Review frequency	What to check
Administrator and owner accounts	Quarterly	Who holds admin rights, and why
Finance, payroll, and bank access	Quarterly	Approvers, bank portal users, payment limits
Departing employees and contractors	Same day, then confirm monthly	Every system, not just email
Everyday employee access	Twice a year	Matches current role and department
Vendor, contractor, and shared accounts	Quarterly	Still needed, one named owner
Role changes and transfers	At the time of the change	Remove old access, add new

Two points sit underneath that table.

Event-driven reviews matter more than calendar ones. A scheduled review catches drift. It does not replace acting the day someone resigns, changes roles, or finishes a contract. The calendar is the backstop for the changes that nobody reported.

The highest-risk accounts get the shortest cycle. Admin and finance access can move money, change settings, and delete data. A quarterly check on a short list is cheap. An annual check on everything tends to be skipped.

What a Good Review Looks Like

A review does not need special software at the start. It needs a list, an owner, and a record. Here is a simple version a company can run in an afternoon.

1. Build the list of systems. Write down every tool that holds company data or money, including the ones departments bought on their own. Missing systems are the most common gap.
2. Export the user list from each system. Most platforms can produce one in a few clicks.
3. Compare it against current staff. Match every account to a current employee, contractor, or vendor. Flag anything that does not match.
4. Ask each manager to confirm. For their team, does each person still need each level of access? Managers know who changed roles.
5. Remove or reduce what is no longer needed. Disable first if you are unsure, then delete after a short waiting period.
6. Record what you found and what you changed. Date it and keep it. This is the evidence an insurer or client will ask for.
7. Check multi-factor sign-in on the accounts you reviewed. Every admin and finance account should require it.

The sticking point is rarely the steps. It is the ownership. A review that belongs to everyone belongs to no one, so name one person who runs it and one person who signs it off.

Where Companies Get Stuck

Three problems come up again and again.

The system list is incomplete. Tools bought outside of IT never make it into the review. Expense reports and corporate card statements are a good way to find them.

Shared accounts hide who did what. When five people use one login, you cannot review access at the individual level. Replace shared logins with named accounts wherever the tool allows it.

Managers approve without looking. If the review sends a 400-line spreadsheet to a busy manager, they will click approve. Keep each manager's list short and specific to their team.

How Elevaire Handles Access Reviews

Elevaire Managed Security includes multi-factor sign-in and access hardening, and a quarterly security review. Elevaire works alongside the existing IT provider or internal IT team. The IT provider usually holds the admin rights and does the day-to-day account changes. Elevaire would run the review, flag what does not match, and keep the record.

Example engagement: a 90-person professional services firm has never run a formal access review. Elevaire would inventory the firm's cloud systems, export the user lists, and match each account to current staff. It would then bring the manager confirmations, the list of accounts to remove, and the admin and finance access changes to the firm's quarterly review, and keep the record for the next insurance renewal.

Companies that want a written access policy, a defined owner, and reporting to leadership can add a virtual CISO, who sets the standard and checks that it is followed. The security baseline checklist for growing companies lists the other controls that should sit next to a regular access review, and Elevaire Managed Security covers how the pieces fit together.

Frequently Asked Questions

How often should a small business review user access?

Review admin, finance, and vendor access every quarter, and everyday employee access twice a year. Remove access for departing staff the same day. If you only do one thing, make that same-day removal reliable.

What is the difference between an access review and offboarding?

Offboarding removes one person's access when they leave. An access review checks everyone's access on a schedule. You need both, because offboarding misses accounts nobody knew about and reviews catch them later.

How much does an access review cost?

An internal review costs staff time, and the effort grows with the number of systems and people. Elevaire Managed Security includes access hardening and a quarterly security review under predictable monthly pricing, with no hourly billing. Breach costs run far higher, with IBM putting the 2025 global average at $4.44 million.

Does our IT provider already do this?

Many IT providers handle account setup and removal, but a scheduled review against current staff is often outside their scope. Elevaire works alongside your existing IT provider or internal team. They keep managing accounts, and Elevaire runs the review and keeps the record.

Do cyber insurers and clients ask about access reviews?

Yes. Cyber insurance applications and client security questionnaires commonly ask how often you review user access and how fast you remove departing staff. A dated record of your last review is the easiest way to answer.

How do we get started?

Start with the list of systems that hold company data or money, and export the user list from your email, file sharing, accounting, and bank portal. Match each account to a current person. Fix what does not match, and put the next review on the calendar before you finish.