Start with a full list of who has access
Begin by pulling together one clean list of every user, admin and shared account in use. For a small business, that list should cover message, finance tools, file storage, HR systems, messaging apps and any password vault or single sign-on setup. If the list is scattered across spreadsheets, old messages and manager memory, the review will miss things. One practical owner should be responsible for getting the full picture before anyone starts signing off changes.
At this stage, note each person’s name, role, department, date started and the systems they use every week. If you have contractors or part-time staff, mark them clearly. Remote teams in Johannesburg, Pretoria, Durban, Gqeberha or elsewhere often pick up access over time, so it helps to record whether a user works on-site, hybrid or fully remote. That makes it easier to spot access that no longer matches the job.
- List every active user and shared account
- Include admin accounts and emergency access
- Mark contractors, interns and temp staff separately
- Note the systems each person uses day to day
Check role fit, not just logins
A quarterly review is not only about confirming that a person is still employed. It is about checking whether the access they have still matches what they actually do. A bookkeeper may no longer need supplier approval rights. A sales rep may not need to see payroll folders. A manager might need view access, but not editing rights in every system. This is where many small teams keep more access than they realise.
Go role by role and compare current duties with current permissions. Keep it practical. If someone changed jobs in the last quarter, review the new role first, then remove anything left behind from the old one. In a business with lean admin support, it is easy for old permissions to stay in place because nobody wants to interrupt work. But unused access is still access and it can become a weak point fast.
- Compare each user’s role with the permissions they hold
- Remove access that no longer supports current duties
- Confirm admin rights only where needed
- Check shared folders, finance tools and customer records first
Review shared passwords and vault groups
Shared passwords need extra attention because they are often used by several people across a team. If one person leaves, changes role or no longer needs that system, the shared credential may need to be changed as well. Quarterly access reviews should check which vaults, groups and shared logins each person can reach. That includes access used for marketing platforms, supplier portals, utility accounts and any other service the business relies on.
Look at the structure too. If everyone can see everything, the vault is doing too much. Split access by team or function where possible. For example, finance, operations and customer support should not all use the same access group unless there is a clear reason. A clean vault structure makes offboarding faster and helps new staff get only what they need. It also reduces the chance of someone sharing a password out of habit, which is still common in small teams.
- Check who can view and use each shared password
- Reset passwords where a leaver had access
- Split vault groups by function if access is too broad
- Remove old shared logins that are no longer in use
Test single sign-on and admin access carefully
If your team uses single sign-on, quarterly checks should confirm that the right people can still sign in cleanly and that no one has gained access through the wrong route. Test the login path for a few key users in each role. A person should be able to reach only the applications they need, not everything linked to the account. Also check that multi-factor authentication is still on for the accounts that need it, especially for admins and users handling finance or customer records.
Admin access needs a closer look because it carries more risk. Review who can create users, reset passwords, approve integrations and change security settings. Keep a note of which admin rights are permanent and which are only temporary for setup or support. If you find an admin account that nobody can explain, treat it as a priority item. In one review or two, you usually uncover access that was left in place after a project ended or a staff change.
- Test login for users in different roles
- Confirm multi-factor authentication is active
- Review who can create or change accounts
- Remove or explain any unknown admin access
Record changes and close the loop with managers
The review is only useful if the changes are recorded properly. Keep a simple log of what was removed, what was changed and who approved it. If a manager requested extra access for a new project, note the reason and the expiry date where possible. That way, next quarter’s review starts with a clear trail instead of guesswork. It also helps when auditors, directors or external advisers ask why a user had a certain permission.
Once changes are made, send a short summary back to the relevant managers. Keep it plain and direct: what was removed, what remains and what needs follow-up. If there are open items, assign them to a named person with a deadline. Quarterly access reviews often fail because nobody owns the last 10 percent. A clear close-out prevents the same issues returning three months later.
- Log every access change and the reason for it
- Assign follow-up actions to named people
- Keep approvals and expiry dates on record
- Send a short summary to managers after the review
Use a simple quarterly checklist that anyone can follow
A small team does not need a heavy process, but it does need a repeatable one. Choose the same quarter end each time, then run the same checklist so nothing gets missed. Many South African businesses find it easiest to review access just after month-end or after payroll, when records are fresh. If your team works across Cape Town, Johannesburg or remotely, schedule the review when the key approvers are available and avoid public holiday weeks if you can.
Keep the checklist short enough to finish in one sitting. The goal is not to create paperwork. The goal is to spot unnecessary access, protect shared logins and keep the business ready for staff changes, leave cycles and load-shedding disruptions that can make admin tasks pile up. Once the rhythm is set, the review becomes a normal part of the quarter, not a fire drill.
- Confirm the user list is up to date
- Check role changes and remove stale permissions
- Review shared passwords and vault groups
- Test SSO, MFA and admin access
- Log approvals, changes and open follow-ups
