Every access grant was reasonable at the time. Nobody removes it afterwards because there is no moment that prompts it. Here is the review that fits in five minutes and therefore happens.
Access in a small business only ever goes one way. Somebody covers a leave, joins a project, helps finance for a month. Each grant is reasonable at the time and nobody removes it afterwards, because there is no moment that prompts removal.
Why this matters more than it sounds
Verizon 2025 Data Breach Investigations Report, covering 22,052 incidents and 12,195 confirmed breaches across 139 countries and drawn from real incident records rather than surveys, found stolen credentials were the single most common way into a breach at 22 percent. It also found 88 percent of breaches at small and medium businesses involved ransomware, against 39 percent at large enterprises.
Excess access does not cause a breach. It determines how far one travels once a single account is compromised, which is the difference between an incident and a disaster.
The question is not whether someone can be trusted. It is how much damage one compromised account can do, and that is a design decision rather than a character judgement.
How to build it
1. Pull the access list automatically, per system
Most business tools expose an administrative export of users, their permission level, and their last login. Schedule that export monthly rather than assembling it by hand, because a manual list is a project and a scheduled one is a file.
2. Review by exception, not in full
This is the difference between a review that happens and one that does not. Send each system owner only the accounts nobody has used in ninety days, plus anyone holding administrative rights. Nine rows gets read; four hundred does not.
3. Ask a question with a default
Confirm or remove, with removal happening automatically if there is no reply within a stated period. Silence should resolve toward less access rather than more, which is the opposite of how most organisations behave.
4. Flag administrative rights separately and always
Administrative access should be reviewed every cycle regardless of usage, because it is the access that turns a small compromise into a large one.
5. Check for accounts belonging to people who have left
This should already be zero if offboarding is automated. Running the check anyway is how you find out whether it actually is, and the answer is often surprising.
6. Keep the evidence
A record of who confirmed what and when. This costs nothing to retain and is exactly what you will need if a client, insurer or auditor ever asks how access is managed.
Tools and what they cost
| Option | What it costs | Honest trade-off |
|---|---|---|
| Workspace or Microsoft 365 admin exports plus a script | Included in your existing subscription. | Covers identity and connected apps at no extra cost. Third-party tools outside single sign-on need individual exports. |
| Identity provider (Okta, JumpCloud, Entra) | Per user monthly, low single to low double digits. | One place to see and revoke everything connected. Real setup effort, and increasingly worth it above about twenty people. |
| Password manager team reporting | Roughly $4 to $8 per user monthly. | Shows shared item access, which is the part identity providers miss entirely. |
| A quarterly calendar reminder and a manual export | Free. | Better than nothing and it is what most small businesses should start with. It survives exactly as long as the person who set it up. |
What it is actually worth
This is exposure reduction, so measure exposure rather than efficiency.
Run it once and count. Accounts belonging to people who have left, accounts with administrative rights that do not need them, and accounts unused for ninety days. Those three numbers describe your current blast radius, they take an afternoon to produce, and they are usually higher than anyone expects.
On cost, honestly: Hiscox, an insurer, reported a median cyberattack cost of around $8,300 for US small businesses in its 2023 Cyber Readiness Report, fielded by Forrester across more than 500 US small businesses. Hiscox sells cyber insurance. A median is also not a worst case, and the tail is where a business actually gets hurt.
And a figure I will not use: the claim that 60 percent of small businesses close within six months of a cyberattack. The National Cyber Security Alliance publicly disavowed it in 2022 as an unverifiable third-party figure from 2011.
How it breaks
The full-list review, which nobody completes. The most common failure by far, and the reason for reviewing by exception.
Confirmation becomes automatic. If system owners approve everything without looking, the review is theatre. Sampling one confirmation per cycle and checking it independently is enough to keep it honest.
Removal breaks something. An account nobody logs into may still run an integration. Check for service accounts before removing, and mark them clearly so they are excluded from usage-based flagging.
Shared logins are invisible to it. An account four people use shows one login and looks fine. Access reviews cannot fix shared credentials; eliminating them is a prerequisite.
How to tell whether it worked
Accounts belonging to leavers, target zero. Administrative accounts as a share of total, which should be small and falling. And the share of review requests answered within the window, which tells you whether the process is working or merely running.