When a UK SME loses people, changes suppliers, or grows quickly, old logins often outlive the relationship. An access-control review is not a compliance theatre exercise. It is a practical check that the people who can still reach email, cloud apps, finance tools, and admin panels are the people who should.
This article sets out a grounded review that busy owners and managers can run without inventing scare stories. If you need deeper help afterwards, Web Vantage’s cybersecurity services and broader services are there — or contact Web Vantage to talk it through.
Why access control still fails after someone leaves
Most access problems are not exotic. They come from ordinary habits: shared mailbox passwords kept in a browser, a contractor who still has a project folder link, a former manager who remains an admin on a SaaS tool because nobody removed them after the last busy week.
Leaver processes often stop at reclaiming a laptop. The accounts behind that laptop — Microsoft 365, Google Workspace, payroll, CRMs, remote access, marketing platforms — keep working until someone notices. By then the risk is already quiet and long-lived.
UK SMEs also add tools faster than they remove them. A short trial becomes a paid seat. A temporary admin role becomes permanent. A “just for this project” grouping never gets reviewed. The review’s job is to surface those leftovers before they become an incident story.
Signals that a review is overdue
- Staff or contractors left in the last quarter and nobody can show an access-removal checklist.
- More than one person knows a shared password for finance, social media, or domain hosting.
- Admin rights are held by people who no longer need day-to-day control.
- Former staff still appear in MFA approvals, mailbox delegates, or shared drives.
What a practical access-control review should cover
Keep the first review narrow enough to finish. Start with systems that hold customer data, money, identity, or the keys to everything else. For many SMEs that means the productivity suite, finance software, customer records, website hosting, and any remote access into servers or desktops.
For each system, answer four plain questions: who has access, what can they do, how do they prove who they are, and what happens when they leave. Write the answers down. A spreadsheet is enough for the first pass.
Identity and authentication
Confirm every human and service account is named, owned, and needed. Prefer individual logins over shared ones. Where MFA is available, turn it on for administrators first, then for everyone who can touch finance or customer data. If a tool cannot support MFA, treat that as a reason to limit its privilege and plan a replacement path.
Privileges and standing rights
Admin is not a badge of seniority. It is an operational risk. Reduce standing admin rights and use temporary elevation where the product allows it. Separate “can change settings” from “can do daily work”. Review mailbox delegates, drive owners, and API tokens with the same seriousness as interactive logins.
Shared logins, leavers, and lingering privileges
Shared credentials are the fastest way for a leaver process to fail. If five people use one social media password, you cannot prove who posted, who deleted, or who still has the secret after an exit interview. Move shared work into named accounts, role-based access, or a password manager with audited sharing.
Build a leaver checklist that IT, HR, and the line manager can actually complete on the last day. Include SaaS seats, VPN, Wi-Fi guest portals, building door apps, Git or deployment keys, and any personal devices that synced company mail. Confirm MFA devices are removed, not only passwords changed.
Do not forget dormant accounts. An unused CRM seat still has a password reset path. An old marketing agency login still has export rights. Lingering privileges are rarely dramatic on day one. They become dramatic when someone reuses an old inbox rule, an old integration, or an old admin invitation link.
A simple UK SME review cadence that sticks
Run a light review monthly and a deeper review quarterly. The monthly pass checks new joiners, leavers, and any admin changes. The quarterly pass samples high-risk systems end to end: who is an admin, which tokens exist, which shared mailboxes still have delegates, and which suppliers still have access.
Assign one owner. Without an owner, reviews become optional and optional work disappears under sales pressure. The owner does not need to do every click alone. They need authority to ask managers for confirmation and to remove access that nobody can justify.
Keep evidence light but real: dated export of users, notes of what changed, and confirmation that leavers were processed. That is enough for most SME leadership discussions and for conversations with insurers or advisors who ask how you manage access.
When to get specialist cybersecurity help
Bring in help when you cannot see a full user list, when privileged access spans too many tools for one person to track, or when a leaver, supplier exit, or suspected misuse has already happened. Specialists are also useful when you are consolidating identity — for example moving scattered SaaS logins toward a clearer Microsoft 365 or Google Workspace baseline.
A good engagement stays practical. It maps systems, removes obvious leftovers, hardens admin paths, and leaves you with a cadence your team can keep. It should not depend on invented threat theatre. Web Vantage can support that through cybersecurity services, and you can explore wider delivery options under services or contact Web Vantage when you are ready to review priorities.
Putting the review into next week’s work
Pick one system you rely on every day and list every active user before Friday. Mark admins, shared credentials, and anyone who left this year. Remove what is obviously wrong, schedule the rest, and record the date. That single pass is more valuable than a long policy nobody opens.
Then book the next monthly check in the calendar. Access control improves when it becomes routine operations, not an annual panic. Keep the questions short, keep the evidence light, and keep the privilege set small enough that leavers cannot remain invisible inside your tools.