Ask any business about access control and they will talk about offboarding. It is the visible case, it has a clear trigger, and everyone understands the risk. Meanwhile the person who has moved between three departments in five years is quietly holding every permission from every role they ever had, and nobody has looked.
The three events
| Event | Trigger | Usually handled | Actually risky |
|---|---|---|---|
| Joiner | Start date | Yes, because someone cannot work without it | Copying access from a colleague |
| Mover | Internal role change | Rarely, because there is no urgency | Old access is never removed |
| Leaver | Last day | Usually, though often late | Contractors and shared accounts |
Why the joiner case goes wrong
The failure here is copying. Somebody asks IT to give the new starter the same access as an existing colleague, because it is fast and it works. It also copies every exception that colleague accumulated, including permissions they should not have had. Do this for three years and access has no relationship to role at all.
The fix is role-based groups. Define what a role needs once, grant that, and let the exceptions be visible as exceptions rather than propagating silently.
The mover case is the real problem
An internal move has no urgency attached to removal. The new access is needed immediately, so it gets granted. The old access is not hurting anyone, so nobody removes it. There is no ticket, no trigger, and often no notification to IT that the move happened at all.
- Require HR to notify IT of internal moves, not just joiners and leavers
- Treat a move as a leave-and-join: remove all previous role groups, then add the new ones
- Never handle a move by simply adding the new access
- Review the resulting access with the new line manager, who is the person who knows what the role needs
The quiet accumulation
Someone who has changed roles twice and never had access removed often holds more permissions than anyone in the business intended, including their own manager. It rarely shows up until an audit or an incident.
The leaver case, and where it still fails
- 1Disable the account rather than deleting it, so data ownership and audit trail survive
- 2Revoke active sessions, because disabling an account does not always kill a live session immediately
- 3Remove group memberships rather than relying on the disabled account alone
- 4Transfer ownership of files and any shared resources before archiving
- 5Wipe or selectively wipe company data from devices
- 6Handle contractors and third parties, which is where most missed access lives
Contractors are the recurring gap. There is often no formal end date, no HR record, and no trigger. Set an expiry at the point the account is created rather than intending to remove it later.
Making it hold
- Access granted to groups only, so all three events become group membership changes
- HR as the trigger for all three events, not a ticket someone remembers to raise
- Time-limited accounts for anyone who is not a permanent employee
- A periodic access review where managers confirm their own team, since IT cannot judge business need
- Reporting on accounts with no recent sign-in, which surfaces the ones everybody forgot
Not sure who has access to what?
We map current access, rebuild it around roles, and wire joiner, mover and leaver into your HR process so it happens by default rather than by memory.
