Time to Review Your Access Permissions. Who Can Still Log Into Your Systems?

December 1, 2025

It’s Tiiiiiiiiiiiime… to review who can access what!

Right now, someone in your business probably has access to files, systems, or data they shouldn’t have.

It’s not because you’re careless. It’s because businesses change. People move roles. Staff leave. New people start. And in the rush of daily operations, access permissions get forgotten.

Before you break for Christmas, it’s worth spending an hour checking who can see what. Think of it as a quick security health check.

Why This Matters Now

Over the past year, your team has changed. Maybe you’ve had:

Someone leave who still has access to your cloud storage
An employee who moved from sales to operations but can still see all customer payment details
A temp worker who finished three months ago but whose login still works
Someone promoted who now has access they don’t need from their old role

Each of these situations creates risk. Not necessarily because anyone has bad intentions, but because unnecessary access is a security weakness.

What to Check

Start with the basics:

Your main systems. Look at who can log into your accounting software, CRM, and cloud storage. Does everyone listed still work for you? Do they still need that level of access?

Shared folders. Check your Google Drive, OneDrive, or Dropbox. Those folders shared with “everyone in the company” might include people who left months ago.

Email groups. Distribution lists often include former staff. That means company updates, customer information, or internal discussions are going to people outside your business.

Admin accounts. These are the keys to the kingdom. Make sure only current, appropriate people have administrator access to your systems.

Third-party tools. Don’t forget the software subscriptions. From project management tools to communication platforms, old accounts often linger.

The Simple Approach

You don’t need expensive software or consultants for this. Just work through each system methodically:

List everyone who has access
Confirm they still work for you
Check their access level matches their current role
Remove or adjust anything that doesn’t fit

For most small businesses, this takes an hour or two. Set aside some time, make a cup of tea, and work through it.

Common Mistakes

Leaving access “just in case.” If someone’s left, remove their access. If you need their help later, you can always reinstate it.

Assuming HR handles it. Unless you’ve set up a clear process, access removal often falls through the gaps between HR and IT.

Only checking when something goes wrong. By then, it’s too late. Regular checks prevent problems rather than react to them.

Forgetting mobile access. Company data on personal phones or tablets often gets overlooked when someone leaves.

Make It Routine

The best approach is to build this into your regular schedule. Many businesses do a full access review quarterly, with quick checks when anyone leaves or changes role.

Some simple steps help:

Keep a list of all your systems and who manages access
Create a checklist for when staff leave or change roles
Set a calendar reminder to review access every three months
Document who should have access to what

The Cost of Getting This Wrong

Unnecessary access isn’t just a theoretical risk. It can lead to:

Data breaches from compromised old accounts
Compliance issues if you’re handling customer data
Commercial problems if former staff can still access sensitive information
Wasted money on software licenses for people who’ve left

More importantly, it’s about control. You should know exactly who can access your business data.

Getting Help

If you’ve got a complex setup or you’re not sure where to start, this is exactly the sort of thing a managed IT service can help with. We can audit your current access, set up proper controls, and create a process that keeps things secure going forward.

But even if you’re handling IT yourself, don’t skip this check. It’s one of the simplest, most effective security measures you can take.