PeopleMuster

Access review on a role change

Internal moves add access and rarely take it away. Somebody shifts from support into delivery. They keep the ticket queue and gain the project boards. Two moves later they hold a set nobody would grant on purpose.

At every internal move, promotion or department change. Thirty minutes at the change, with a follow-up date two weeks later for the removals.

The checklist

  1. 01Write down what the new role needs to do, before looking at any systemOwner: Manager
  2. 02List the person's current access, including tools outside the main systemOwner: IT
  3. 03Compare the two lists and mark every item as keep, add or removeOwner: Manager
  4. 04Set a date for the removals, usually the end of handoverOwner: Manager
  5. 05Update the system role, and check it applies at their next sign-inOwner: HR
  6. 06Update the reporting line so the org chart and approvals followOwner: HR
  7. 07Reassign what they owned: approvals, queues and running processesOwner: Manager
  8. 08Check the capacity plan reflects the new work, not the oldOwner: Delivery lead
  9. 09Remove the old access on the date, and confirm it is goneOwner: IT
  10. 10Record what was decided and why, for the next reviewOwner: Manager

What goes wrong

  • Adding the new access and never scheduling the removal, which is how permissions accumulate for years.
  • Forgetting the reporting line, so leave requests keep routing to the old manager.
  • Leaving approvals and running processes assigned to someone who no longer does that work, where they quietly stall.
  • Removing access during handover instead of after it, which stops the transfer of the thing being handed over.
  • Treating a promotion as no change. A promotion usually adds approval rights, which is exactly the access worth reviewing.

Questions people ask

When does a role change take effect?

At the person's next sign-in. Plan around that rather than expecting an immediate change mid-session.

Why schedule removals rather than doing them immediately?

Handover usually needs the old access for a short period. Scheduling the removal keeps both the handover and the cleanup, which doing it immediately does not.

Does a promotion need an access review?

Yes, and it is the one most often skipped. Promotions usually add approval rights, which is the access most worth checking.

Other checklists