The most dangerous account is the one nobody closed.

Every business has a few accounts that belong to nobody. They were someone’s once: a colleague who moved on, a contractor whose project ended, a temporary login made for an audit. The person left. The access didn’t.

These accounts are rarely dramatic. Nobody is using them, which is exactly the problem: nobody is watching them either. They keep working, with whatever permissions they had on their last day, until someone finds them — or someone else does.

Why leavers keep their keys

It is almost never negligence. It is the shape of the work. Access is granted in many places — the email system, the finance tool, the shared drive, the supplier portal — often by different people, often in a hurry, because a new starter is waiting. When someone leaves, the same many places have to be visited again, by people who may not know the account exists.

So the offboarding checklist closes the obvious accounts and misses the rest. Not because anyone skipped a step, but because the list was never complete.

The thirty-minute review

You don’t need a project to start. You need half an hour, once a month, and three systems.

Pick the three that would hurt most in the wrong hands — usually email, finance and wherever your customer data lives. Export the list of active accounts from each. Put them side by side with a list of current staff and contractors from HR. Then ask three questions of every account that doesn’t match:

1. Whose is it?
2. Do they still need it?
3. Who decided that?

Anything without an answer to the first question gets disabled, not deleted — you can always turn it back on if someone shouts. Anything without an answer to the third gets an owner.

The first review is always the longest and the most surprising. By the third, it takes minutes.

Make the HR record the source

The review finds the leftovers. The lasting fix is to stop making them.

That means one place decides who works here — usually the HR system — and every other system follows it. When someone joins, their identity is created from the HR record and given the access their role needs. When they leave, the same record closes it, everywhere, the same day. No list to remember, no person to chase.

This is less about any particular product than about agreeing which record is the truth. Once that is settled, the tooling to follow it is well understood.

What good looks like

In a business where access is under control, three things are true:

• A new starter can work on their first morning, without a stream of tickets.
• A leaver loses access the day they leave, without anyone having to remember.
• If someone asks “who can see our customer data?”, the answer takes minutes, not a week.

None of these is exotic. They are the ordinary result of treating access as something that has a beginning and an end — and of making sure the end actually happens.