A new starter needs access to Microsoft 365, a line-of-business application and a shared folder. An employee changes roles and retains permissions from their previous team. A contractor finishes their work but their account remains active. These ordinary events are where an access governance framework either protects the business or quietly creates risk.
For many small and mid-sized organisations, access has grown organically. Accounts are created when people need them, permissions are granted to avoid delays, and reviews happen only after an incident, audit request or staff departure. That approach can work for a while, but it becomes harder to manage as more people, cloud services and suppliers are involved.
A clear framework brings order to the process. It helps the business decide who should have access, who approves it, how long it lasts and how it is checked. The aim is not to make everyday work difficult. It is to give staff the access they need while reducing the chance of data loss, fraud, disruption or unnecessary exposure.
What an access governance framework should achieve
Access governance is the set of policies, responsibilities and controls used to manage access to business systems and information. It covers employee accounts, administrator rights, shared mailboxes, cloud platforms, finance software, customer records, remote access and third-party accounts.
It is broader than passwords or multi-factor authentication. Those are valuable security controls, but they do not answer the key business questions: should this person have access in the first place, is the access still appropriate, and who is accountable for the decision?
A well-run framework gives leaders a reliable answer to those questions. It should support five practical outcomes:
- people receive the right access when they join or change role
- higher-risk access has a clear business owner and approval route
- access is removed promptly when it is no longer needed
- privileged accounts are tightly controlled and regularly reviewed
- the organisation can show who has access to sensitive systems and why
The level of formality should reflect the organisation. A business with 25 staff does not need the same governance structure as a national enterprise. It does, however, need a process that remains consistent when the office manager is away, a manager leaves, or a supplier asks for remote access.
Start with the systems that matter most
Trying to catalogue every application and every permission at once can delay progress. Begin with the systems where inappropriate access would cause the greatest commercial or operational impact. This usually includes email and file storage, finance and payroll, CRM, HR records, cloud administration portals, remote access tools and any production or industry-specific systems.
For each system, identify the system owner. This is not necessarily the person who administers the technology. The owner is the business person responsible for deciding who needs access and what level is appropriate. For example, a finance director may own approval for accounting software, while IT manages the technical account creation.
It is also useful to classify access by risk. Standard access might include a general Microsoft 365 account and a shared team folder. Sensitive access could include HR or customer data. Privileged access includes the ability to change configurations, create accounts, alter financial details or disable security controls. The more powerful the access, the more evidence and oversight it should require.
Define access by role, not by individual favour
Permissions granted one person at a time are difficult to track and even harder to review. Role-based access is a more manageable alternative. Instead of asking what access Jane has accumulated over three years, define what a sales manager, accounts assistant, engineer or director should normally require.
This does not mean every role will be identical. Some employees have legitimate additional responsibilities. The point is to create a sensible baseline, then record exceptions clearly. When someone moves from operations into finance, their old access should not simply follow them by default.
Role definitions also reduce friction for new starters. A manager can request a recognised job role, the appropriate approvals can be applied, and IT can provision the right tools without relying on memory or informal messages. Staff get productive more quickly, while the business retains control.
Keep least privilege practical
The principle of least privilege means giving people only the access needed for their job. It can sound restrictive, but it is usually common sense. A user who only needs to enter purchase orders should not be able to amend supplier bank details. A contractor helping with a project does not necessarily need access to every shared drive.
There is a balance to strike. Controls that slow down legitimate work will be bypassed, so avoid designing approval processes around unlikely edge cases. Standard, low-risk access should be quick and predictable. Higher-risk access should be more carefully assessed, especially where it involves financial transactions, personal data or administrator permissions.
Make joiners, movers and leavers a business process
The most effective access controls begin outside the IT department. HR, line managers, finance and IT all have a role in ensuring changes are communicated and completed on time.
For joiners, the manager should confirm the role, start date, required systems and any non-standard access. For movers, the manager should review current permissions as well as requesting new ones. This step matters because internal moves are a common source of access creep.
Leavers require particular discipline. The business should have a clear trigger for notifying IT before the employee’s final working day. Accounts must be disabled, remote access removed, licences reclaimed where appropriate, shared passwords changed if they were known, and company devices collected. Where access needs to be retained briefly for handover purposes, set a defined expiry date rather than relying on someone to remember later.
Third parties deserve the same attention. Suppliers, consultants and outsourced teams may need access to specific systems, but it should be time-limited, approved by a named internal owner and removed when the engagement ends. Shared supplier accounts make accountability difficult and should be avoided wherever possible.
Put strong controls around privileged accounts
Administrator access is often necessary for IT support and business continuity, but it carries greater risk than standard user access. A compromised privileged account can affect an entire network, not just one mailbox or device.
Use separate administrator accounts for administrative tasks rather than allowing day-to-day email accounts to hold elevated rights. Require multi-factor authentication, record who holds privileged access, and review the list frequently. Emergency or “break glass” accounts can be useful, but they need secure storage, restricted use and a process for checking why they were used.
For organisations without an internal IT department, this is an area where a trusted managed service provider can add real value. The provider should be able to explain exactly how its engineers access your environment, what approvals are required and how that access is monitored. Clear access arrangements protect both parties.
Review access regularly and act on the results
An access governance framework is only credible if it includes regular reviews. The right frequency depends on risk. Privileged accounts and finance systems may need quarterly checks, while lower-risk systems might be reviewed every six or twelve months.
The review should go to the person who understands the work, not simply the person with the closest job title. A department manager can usually confirm whether an employee still needs a shared mailbox, client folder or application licence. The system owner should review exceptions and elevated rights.
Keep the evidence straightforward: who reviewed the access, when they reviewed it, what changed and whether any issues remain open. A spreadsheet may be sufficient for a smaller organisation, provided it is controlled and maintained. As systems and staff numbers grow, identity and access management tools can automate workflows, approvals, reporting and reminders.
Automation helps, but it does not remove management responsibility. A system can disable an account based on a leaving date, but it cannot decide whether a departing director’s delegated mailbox access should be retained. Good governance combines useful technology with clear human ownership.
Measure the process, not just the policy
A policy document alone does not prove that access is under control. Track a small number of operational measures: how quickly accounts are created for starters, how promptly leaver access is removed, how many privileged accounts exist, whether reviews are completed on time, and how many exceptions have passed their expiry date.
These measures help leaders spot where the process is failing. If leaver accounts are routinely removed days after someone leaves, the issue may be poor notification from managers rather than an IT problem. If staff frequently request administrator rights, it may indicate that standard tools or workflows need improvement.
Blowfish Technology approaches access governance as part of practical business resilience. The goal is clear accountability, productive staff and fewer avoidable security gaps, explained in language that decision-makers can act on.
The best place to start is with one high-risk system and one repeatable process, such as leavers or administrator access. Get that working consistently, assign ownership and build from there. Small, well-managed improvements create the control and confidence that a growing business needs.
The Blowfish Technology team. Managed IT, cloud services, software development and connectivity for North West businesses since 1999.