A former employee can still see client files six months after leaving. A receptionist has administrator access because it was the quickest way to fix a software issue. A shared Microsoft 365 account is used by three people, so nobody can tell who opened a sensitive document. These are common findings when businesses learn how to audit user access properly.
An access audit is not about making it harder for good staff to do their jobs. It is about confirming that each person, supplier and system account has the access they need - and no more. Done well, it reduces the chance of accidental data exposure, fraud and disruption while making day-to-day IT management clearer.
What a user access audit actually checks
User access is every permission that allows someone or something to enter a business system, view information, make changes or approve actions. That includes Microsoft 365, email, accounting platforms, practice management software, shared folders, cloud storage, remote access tools, Wi-Fi, password managers and business applications.
A useful audit answers four straightforward questions: who has access, what can they access, why do they need it, and is that access still appropriate?
The last question is where many businesses find gaps. Staff move roles, take on temporary duties or leave the business. Software is added for a project and then forgotten. An external bookkeeper, web developer or IT provider may retain a login long after the original work is complete. None of this necessarily means anyone has done the wrong thing. It usually means access has grown over time without a regular review.
Start with a reliable list of people and accounts
Before reviewing permissions, establish who should currently have access. Use your payroll or HR records as the starting point, then compare them with your technology systems.
Include permanent and part-time employees, contractors, casual staff, directors, temporary workers and external providers. Do not overlook generic accounts used for devices, software integrations, backups or scanners. These accounts may not belong to a person, but they can still provide a path into important systems.
For each account, record the person or purpose, their team, their role, their manager, the systems they use and whether their account is active. A simple spreadsheet can work for a small business, provided it is kept securely and updated. For larger or more regulated organisations, an IT management platform may be more practical.
This first comparison often reveals immediate actions. You may find active accounts for former staff, duplicate accounts created after name changes, or people using a personal email address to access a business service. Disable former staff accounts promptly, but check first for mailboxes, files or workflow notifications that need to be handed over.
Map the systems that matter most
You do not need to inspect every low-risk application on the first day. Begin with systems that hold sensitive information, control money or could significantly interrupt operations if misused.
For many Central Coast and Newcastle businesses, that means Microsoft 365, email, cloud file storage, accounting software, banking portals, payroll, customer databases and remote access. A medical practice may prioritise its patient management system. A construction business may focus on estimating, job management and supplier portals. A law firm may give particular attention to matter files and document management.
Make a list of these systems and identify who administers each one. If nobody is clearly responsible, that is a finding in itself. Every critical platform should have a nominated business owner as well as a technical contact.
Review permissions, not just usernames
An active account is not automatically a problem. The risk often sits in the level of access attached to it.
Look at the permissions each person has in the systems you identified. Can they only read information, or can they edit, delete, export or share it externally? Can they create new users, reset passwords, change security settings or approve payments? Administrative permissions deserve the closest review because they allow someone to make broad changes quickly.
A good rule is least privilege. Give people the minimum access required to perform their current role. For example, an accounts employee may need access to invoices but not the ability to add bank account details. A team leader may need to approve leave, but not administer the entire HR platform.
There are trade-offs. Restricting access too tightly can create bottlenecks, especially in a small business where people cover for each other. The answer is not to give everyone administrator rights. Instead, define approved backup access for key tasks, make it time-limited where possible, and review it after the busy period or staff absence ends.
Pay close attention to privileged and shared accounts
Not all access carries the same level of risk. Administrator accounts, global Microsoft 365 roles, domain access, financial approver permissions and remote support tools should be reviewed separately from ordinary user accounts.
Limit the number of people with these higher privileges. Where practical, an administrator should have a separate admin account for technical tasks and use their normal account for email and everyday work. This reduces the impact if an email account is compromised.
Shared accounts need a careful approach. Sometimes a shared login is built into older software or equipment and cannot be avoided immediately. However, it removes accountability and makes offboarding difficult. If a shared account must remain, document its owner, change the password when staff leave, store it in an approved password manager and plan a move to individual accounts where the software allows it.
Also check service accounts - accounts used by applications, backups or integrations. They are easy to forget because nobody signs into them daily. Confirm that each one still has a purpose, has a secure password or credential, and only has the permissions required for its task.
Check how access is protected
A permissions review is incomplete if it ignores sign-in security. An account with sensible access levels can still cause trouble if its password is weak, reused or available to someone outside the business.
Confirm that multi-factor authentication is enabled for email, cloud services, remote access and financial platforms. Review whether staff are using personal devices to access business systems and whether those devices have basic protections such as screen locks, updates and the ability to remove company data if lost.
It is also worth reviewing sign-in logs for unusual activity, particularly for administrator accounts. You are not expected to investigate every normal login. Focus on signs that need an explanation, such as access from unexpected locations, repeated failed sign-ins or logins after an employee has left.
Decide what to remove, change and document
Once the review is complete, group the findings into actions. Remove access that is no longer needed, reduce excessive permissions, reset or secure shared credentials, and assign ownership for accounts with no clear manager.
Document any exceptions. A director may legitimately need broader access than most staff. An external accountant may need short-term access at BAS time. The important point is that the reason is known, approved and reviewed rather than left open indefinitely.
Avoid deleting accounts before preserving business records. In Microsoft 365, for example, emails and files may need to be transferred or retained under your business requirements before a departed employee's account is removed. Your retention needs will depend on your industry, contracts and legal obligations.
Make access reviews part of normal operations
A one-off audit is useful, but access changes constantly. The most reliable approach is to build checks into staff onboarding, role changes and offboarding.
When someone starts, their manager should request access based on the role, not simply ask for the same permissions as the previous employee. When their role changes, review what should be added and what should be removed. When they leave, disable access on the last working day or earlier where appropriate, recover company devices and redirect relevant business communications.
Set a regular review schedule as well. Quarterly is sensible for higher-risk systems such as email, finance and administrator accounts. A six-monthly review may suit less sensitive applications. Businesses handling health records, financial information or confidential client matters may need more frequent checks, depending on their obligations and risk profile.
Keep the process proportionate. A business with 12 staff does not need the same governance framework as a national organisation, but it does need a clear record of who can access its critical systems. If the task has become difficult to manage in-house, a managed IT provider can help maintain the account register, review permissions and ensure offboarding steps are completed consistently.
The best time to check access is before an incident, a rushed resignation or an audit request exposes a gap. A regular, practical review gives your team clearer boundaries and gives business owners confidence that sensitive systems are being used by the right people for the right reasons.
