Why old logins become a real risk
In many small businesses, the problem is not one dramatic breach but a collection of small oversights. A former manager still has access to a supplier portal. A seasonal worker keeps a shared login from last year. Someone set up a trial account during a busy period and nobody removed it. On paper these accounts look harmless, but they are often the easiest way into a finance system, file storage or customer records.
South African teams also deal with practical pressures that make this worse. Load-shedding can interrupt handovers. Staff work between the office in Woodstock, a home setup in Pretoria, and a client site in Durban. When access changes happen over WhatsApp or in a rushed call, the follow-up can fall through the cracks. That is how a forgotten login becomes an open door.
Start with a full account register, not assumptions
The first step is simple: list every account linked to the business. That includes message, cloud storage, accounting systems, file sharing, payment tools, social media, supplier portals and any internal admin tools. Do not rely on memory. People often forget personal message accounts used for business, or a temporary login created for a subcontractor in Gqeberha during a busy project.
Once the list is in place, compare it against your current team and current tools. Ask three direct questions for each account: who uses it, who owns it, and does it still need to exist? If nobody can answer clearly, treat it as a review item. A good audit does not need fancy language, just clean records and a clear decision trail.
- Capture the account name, platform, user, and purpose
- Mark whether the account is active, dormant, shared, or unknown
- Note the last login date if the system provides it
- Assign one owner for each account, even if it is a shared tool
Look for the hidden accounts people forget
Most teams remember the obvious systems. The tricky part is the accounts that sit outside daily use. These are the ones that often cause trouble during staff changes, client disputes, or contractor exits. In a small business, the risk is not only theft. It is also confusion, missed updates, and people still working inside systems they no longer need.
Common examples include:
- Trial accounts that were never closed after testing
- Personal logins used to bypass a shared company account
- Vendor portals tied to an old office or old manager
- Archived message accounts still receiving reset links
- Temporary access given to a freelancer or installer
- Legacy admin logins kept “just in case”
These accounts are especially common in businesses that have grown quickly. A company in Century City may have started with three people and now has twenty. The systems changed, but the old access pattern stayed the same. That is where review discipline matters most.
Use role changes as a trigger for access review
Account reviews should not happen only once a year. They should also happen when someone joins, leaves, or changes role. If an operations person moves into sales, they may no longer need finance access. If a support lead takes on admin duties, they may need new permissions but lose old ones. The moment a role changes is the best time to clean up access rather than leaving it to memory.
A useful rule is to review access as part of the role change process. That makes it easier to close old permissions before they are forgotten. It also reduces the risk of people using the wrong login out of habit. In a busy Durban office, or with a remote team member in Stellenbosch, that kind of routine can save a lot of back-and-forth later.
- Remove access the same day where possible for leavers
- Adjust permissions immediately for role changes
- Confirm managers know which systems the person should still use
- Keep a short note of what was changed and when
Set a clean offboarding process before someone leaves
Offboarding is where many security gaps start. If the business waits until the last hour, the checklist gets rushed. A proper process should cover every account, not only the obvious message and file storage logins. That includes shared drives, cloud tools, password vault access, social accounts, client portals and anything tied to banking or approvals.
The cleanest approach is to make offboarding a standard process rather than a memory test. Decide who closes access, who checks for missed accounts, and who signs off once everything is done. For South African small businesses, this matters even more when team members work across provinces and there is no single office to walk through. When roles are clear, mistakes drop quickly.
Turn account reviews into a repeatable quarterly task
Quarterly access reviews are usually enough for a small team, provided the process is practical. The goal is not to create admin for its own sake. It is to keep the account list accurate and stop dormant access from building up. A short review every three months is easier to manage than a large clean-up once a year.
A simple review meeting can cover the accounts that matter most: admin users, finance tools, customer systems, cloud storage, and any shared logins. If you already use a password manager and single sign-on, the process gets easier because you can see who has access to what in one place. That is especially useful for teams with remote onboarding nationwide, where the business needs order without adding extra steps.
For a small business in Woodstock, the result is practical peace of mind. You know who can open what, you know which old accounts have been retired, and you are less likely to discover a forgotten login after staff changes or a supplier issue.
