Why access reviews matter when your team is small
When a business has 8, 15 or 30 people, access can change faster than the paperwork. Someone starts as a temp, moves into sales, helps with accounts for a month, then leaves that task behind but keeps the login. That is where trouble begins. Old access creates avoidable risk, especially when staff work from home, split time between the office and site visits, or share duties across a few apps.
In South Africa, small teams often run lean. One person may handle invoices in the morning, supplier orders after lunch and client support before close. That kind of flexibility is useful, but it also means permissions can drift. A quarterly review gives you a chance to ask one simple question: does each person still need this level of access today?
Set a review rhythm that suits real business hours
You do not need a long meeting with five managers and a pile of printouts. For most small teams, a quarterly access review is enough. If your team changes fast, or you handle sensitive client data, monthly checks for admin accounts and finance access can help too. The point is to keep it regular so it becomes part of the routine, not a once-off panic after a problem.
Choose a fixed time that suits your business. Many Cape Town firms set it for the first week of the quarter, when payroll and month-end pressure has eased a bit. A 30 to 45 minute session can cover the main accounts if someone prepares the list first. With the right setup, the review should be simple enough for a busy manager to finish without losing half a day.
- Review admin, finance and shared accounts first
- Check new starters, role changes and leavers
- Confirm whether any temporary access can be removed
- Record changes straight away, not later in the week
Start with the access that matters most
Not all access carries the same level of risk. A staff member with a marketing login is not the same as someone who can change banking details, approve payments or reset other users. Start with the highest risk systems first, then work down. That keeps the review practical and helps you spend time where it counts.
A simple list usually includes finance tools, customer records, cloud storage, payroll, messaging platforms and any system with admin rights. If your business uses shared logins, treat those as priority items as well. Shared access can be tempting when you are busy, but it makes it hard to see who did what, and it is a problem when staff move on or someone forgets a password. It is also where small teams get caught out when one account is used by three people and nobody knows who still needs it.
- Who can approve payments or refunds
- Who can export client data
- Who can add or remove users
- Which accounts are shared, if any
Use role-based permissions instead of memory
The easiest way to keep access reviews manageable is to organise permissions by role. When a new person joins sales, they should get the sales access set. When someone moves into operations, their permissions should change with that role. This is much easier than giving access one app at a time from memory, then trying to work out six months later why the person still has the old rights.
At 1Pass, we often see small businesses in Johannesburg, Pretoria and Durban that grew quickly and never had time to tidy up permissions. The result is usually the same: a few people have too much access, and no one is sure who approved it. Role based access makes reviews easier because you compare people against a standard pattern rather than guessing case by case. It also makes onboarding quicker for new hires and less messy when someone resigns.
Make offboarding part of the review, not an afterthought
Many access problems start when someone leaves, but their accounts remain open for days or weeks. In a small team, that can happen because everyone is busy and the handover is informal. A practical access review should always check leavers, contractors and anyone who no longer needs a login. Offboarding is not just about stopping access on the final day, it is about removing every route back in.
A good process includes a clear handover of what needs to be disabled, what should be reassigned and who signs off that the person is done. This is especially important where a former staff member had access to shared folders, client records or payment platforms. If you have staff in Gqeberha, Stellenbosch or across remote teams nationwide, it helps to keep the same checklist everywhere so nothing gets missed.
- Disable active logins as soon as notice is confirmed
- Change shared passwords and recovery details
- Reassign files, notes and approvals to the right owner
- Confirm the final access list after handover
A Cape Town example that keeps the process simple
Picture a small Woodstock business with 12 staff, one operations lead and a few people working remotely. The team uses a finance app, a file store, a messaging tool and a supplier portal. During a quarterly review, the operations manager checks who still needs admin rights, who moved roles and which contractor accounts should be closed. It takes less than an hour, but it removes old access that had been sitting there since last year.
That same business may also need to think about load-shedding, working from home and a mix of office and remote access. If people are jumping between connections and devices, it becomes even more important to know exactly who has access to what. A clean review gives the team confidence, and it cuts down on awkward surprises when someone tries to log in to a system they should no longer be using. It is one of those jobs that looks minor until it saves you from a proper headache.
Keep the review light, but keep it written down
The best access review is the one your team can repeat. Keep a short record of who checked what, what changed and when the next review is due. That record does not need to be long. It just needs to be clear enough that another manager can pick it up later without starting from scratch.
If you want the process to stay useful, keep it tied to real business actions: onboarding, role changes, quarterly checks and offboarding. When those pieces work together, access reviews stop being an extra chore and become part of everyday control. For small South African teams, that is the difference between feeling swamped and staying in charge of the basics.
