How Often Should a Business Review Digital Access?

Access reviews are among the least glamorous habits in business operations. They involve opening a list, reading names, asking whether those names still belong there, and recording the answer. Nothing about this is interesting until the day it prevents an incident, at which point it becomes one of the most valuable half-hours in the quarter.

The question a review answers is simple: who has the keys. The keys here are not just the office door. They are administrator access to the social accounts, the website, the hosting, the DNS, the email tenant, the accounting software, the booking platform, the payment gateway, and every other system the business signs into.

The Default Cadence

For most Australian small businesses, quarterly is the right default. Every ninety days, somebody who understands the business reviews the administrator access to the main systems and asks three questions per entry: does this person still work here, does this person still need this level of access, and when was this last confirmed.

Quarterly is often enough to catch problems before they age into incidents, and infrequent enough not to become a burden that people start to skip. Monthly reviews are overkill for most businesses and quickly become a chore nobody prioritises. Annual reviews are too far apart to catch problems in a timely way, and they create a review that is too large to do carefully.

High-privilege accounts, such as the domain registrar and the email tenant administrator, may deserve a tighter cycle. Lower-risk tools can be reviewed less often. The point is to agree a cadence and keep to it, not to invent a single rule that applies to every system.

Trigger Events

The cadence tightens when something changes.

A staff member resigns or is dismissed. The access review for that person happens immediately, not at the next quarter.

A contractor finishes a project. The access review happens on the final day of the contract, not three months later.

An agency relationship ends. The review covers every system the agency touched, from the obvious (ad accounts, social) to the easily overlooked (DNS, SSL certificates, email forwarders they set up to monitor campaign replies).

A supplier is replaced. The outgoing supplier's access is removed and the incoming supplier is added at the appropriate level, which is often lower than the outgoing supplier was granted.

A merger, acquisition or ownership change. Every system is reviewed, because historical access patterns rarely match the structure of the new entity.

An incident. After any security event, the first follow-up is a full access review to identify any unauthorised entries that may have been added, and to confirm that the entries that should be there are intact.

What To Review

The main systems to cover are different for every business, but the list usually includes the Google Business Profile owners and managers, Google Ads accounts, Google Analytics properties, Google Search Console verified users, Google Tag Manager containers, Facebook Business Manager roles, Instagram account access, LinkedIn Page administrators, Microsoft 365 user list, Microsoft 365 global administrators, Google Workspace user list and administrators, WordPress administrators and editors, hosting account users, domain registrar logins, DNS provider administrators, Cloudflare organisation members, Mailchimp or Klaviyo users, Xero or MYOB users and advisors, Stripe or Square dashboard access, the SMS gateway, the SaaS tools that run operations, and the shared email forwarders.

That list sounds long because every business owns more systems than its leadership typically remembers. Having it written down in a register is the point. The review becomes a walk-through of the register, not a creative act of remembering.

The Three Decisions Per Entry

Each entry on the review resolves to one of three decisions.

Keep. The person is still here, still needs the access, and the record of their access is correct. The review date is updated and nothing further is required.

Remove. The person has left, no longer needs this access, or has moved to a role that does not justify it. The removal is scheduled or performed immediately at the provider, confirmed, and recorded.

Review later. The access is more complex, needs a conversation with the person's manager, or depends on a decision that has not been made yet. The entry is tagged for a follow-up by a specific date, with a named person responsible.

The review-later column should not grow between reviews. If it does, the review process has become a way of avoiding decisions rather than making them.

Reducing Permission Is Often Better Than Removal

Not every access review ends in a yes-or-no answer. A content editor does not automatically need hosting access. A media buyer does not automatically need Business Profile ownership. Where access can be reduced to the level the role actually needs, that is often the right outcome. Least privilege is a quieter principle than full removal, and it respects the ongoing involvement of the person.

Role Versus Individual

A review that treats every individual as a special case will take longer and produce fewer good decisions. Where the business has roles (office manager, marketing manager, bookkeeper, developer), define the systems and the access level each role should have, and then review individuals against that template.

A role template means that a change of office manager becomes a short conversation about which systems the outgoing person had, which the incoming person needs, and which are being promoted to a different owner. Without a template, each handover becomes an archaeological dig.

Multi-Factor Authentication Re-Check

The access review is a natural moment to check that multi-factor authentication is in place on each account that supports it. People change phones. People lose devices. People turn off multi-factor authentication during a frustrating moment and never turn it back on. A quarterly check that the second factor is active on the main administrator accounts is a small habit that prevents large problems.

Where multi-factor authentication is based on SMS, consider moving to an authenticator app or a passkey. SIM-swap attacks are the specific weakness that SMS-based multi-factor authentication does not defend against.

Shared Account Cleanup

Reviews are a good time to notice shared logins that have crept in. 'bookings@yourbusiness.com.au' that is accessed by five people, or an Instagram login whose password is in a shared document. Where the platform supports individual users, migrate off the shared account during the next quiet period and retire the shared credentials. Where the platform only supports a single login, rotate the password after any staff change and record the rotation date.

Pending invitations and dormant accounts belong on the same list. An unused invitation sitting in a provider's console is a pathway back into the system. A dormant account that has not signed in for a year is still a credential that can be compromised. Clean both out during the review.

The Documentation Habit

Each review produces a short record: the date it was done, who did it, which systems were reviewed, what changed, and what is scheduled for the next quarter. This record is not for an auditor. It is for the version of your team that will respond to the next incident, who will want to know when access was last confirmed and by whom.

Even a review that produces no changes should be recorded. A dated confirmation that access was checked is itself useful operational proof, especially during an insurance or audit question.

A Short Scenario From Adelaide

A dental practice in Adelaide ran a quarterly access review and discovered that a receptionist who had resigned the previous year was still listed as an administrator on the practice management system, the online booking platform and the Facebook Page. The receptionist had not done anything with the access. The practice removed her from all three systems, confirmed with the practice management vendor that no sessions were active, and set a rule that future staff departures would include a documented access revocation step on the final day. The review took forty minutes and prevented a potential incident the practice had no idea existed.

A Second Scenario From Perth

A trades business in Perth caught, during a quarterly review, that a former bookkeeper still had advisor access to Xero. The bookkeeper had moved to a new firm and was still professionally in good standing. The access was removed within the day, the business owner messaged the bookkeeper to confirm nothing was outstanding, and the review record was updated. The bookkeeper later said she had not realised she still had access and was grateful for the prompt. Nothing had gone wrong, and nothing was likely to, but a historical door was closed.

Reviews After An Incident

The relationship between a review and an incident runs both directions. A good review prevents incidents. A real incident drives a focused review of every system that may have been affected, which often reveals a problem adjacent to the one that triggered the incident.

The practical sequence after any incident is to run a short, focused review of administrator access on the affected systems within forty-eight hours, and a broader review of related systems within two weeks. Both reviews are recorded.

Culture And Framing

Businesses that treat access review as mistrust make staff defensive. Businesses that treat it as ordinary hygiene get better compliance. Frame it as protecting customers and continuity, not as a comment on any individual. The quarterly review is a maintenance task, like checking the smoke alarm, and that is the tone it should carry.

How Business Vault Fits

Business Vault records the people with access to each asset, the date each entry was last confirmed, and the review cadence. A quarterly reminder prompts the responsible person to walk through the register, mark each entry as keep, remove or review later, and record the decisions. Where removal needs to happen at the provider, the register tracks the decision and keeps the history. The platform does not sign into other systems on your behalf; it is the register and the reminder and the record.

A business that has run four access reviews a year for the last two years has a quieter risk profile than a business that has never run one. The practice is unglamorous. It is also one of the cheapest ways to reduce the chance of a bad week.