First Monday Back: The Access Review That Starts the Year

First Monday of the working year. The inbox is full, the year is new, and the last thing anyone wants is a security task. Do it anyway, because this is the one week when an access review practically runs itself: the holidays just stress-tested every account, and the year's departures and arrivals are still fresh.

An access review is not an audit. It is one hour with a list, asking of every account: does this person still work here, still need this, at this level? The findings are always there, and they are always cheaper found now than later.

Key takeaways

• The first week of January is the natural moment for the year's first access review.

• Start with departures: every account of every person who left in 2025.

• Holiday grants and temporary access tend to linger. Collect them back.

• Admin and owner-level access gets a name-by-name look, not a glance.

• Write down what you found and fixed; next January starts from the list.

Step 1: Start with the people who left

Pull the year's departures, including the quiet ones: the seasonal staff, the contractor whose project ended, the bookkeeper who retired in June. Check each against your systems: email, accounting, file storage, the line-of-business apps, the building code.

Expect to find at least one live account. It is rarely malicious; offboarding is simply easy to half-do when the leaving is friendly. Half-done is still open.

Step 2: Collect the holiday lending

December runs on exceptions: the temp who got shared drive access, the covering manager who got admin rights, the vendor who was set up quickly before the freeze. All legitimate at the time, and all still active now.

Walk back through the last few weeks and collect what was lent. Temporary access that is not actively collected becomes permanent access nobody remembers granting.

Step 3: Look hard at the powerful accounts

Admin rights, owner-level access, the ability to move money or see everything: list who holds each one and ask whether the list is still right. People accumulate power as their roles change, and nobody ever asks for it to be removed.

The goal is not suspicion of your people. It is that a compromised ordinary account is a bad day, and a compromised powerful one is a bad year. Fewer powerful accounts, more carefully held, is simply arithmetic.

Step 4: Write the findings down

One page: what you found, what you fixed, what needs a decision. That page is the record that the review happened, the to-do list for anything not closed today, and next January's starting point.

If the findings are uncomfortable, that is normal and healthy. The uncomfortable version of this review is the one you get from an attacker or an auditor instead.

Frequently asked questions

How often should access be reviewed?

Quarterly is the comfortable rhythm for most small businesses, with the January one being the natural anchor. At minimum, every departure triggers an immediate check.

What about shared accounts?

Shared logins defeat the whole point of a review, because access stops mapping to a person. The January review is a good time to plan their retirement, starting with the most powerful ones.

Should we tell staff a review is happening?

Yes. Transparency makes it routine instead of ominous, and staff often volunteer the stale access they know about, which saves you the hunt.

A practical next step

Block one hour this week: departures, holiday grants, powerful accounts, one page of findings. If the account list itself is a mystery, or the findings are bigger than the hour, book a Decision-Clarity Call and we will work through it together.