Quarterly Access Review: Who Still Has Access to What?

What an access review is and why quarterly

Access tends to only grow. People change roles and keep old permissions, suppliers finish projects but keep their logins, and offboarding misses the tools that nobody listed. A review catches what the offboarding process missed.

Quarterly is the frequency CSA uses. Clause A.5.4 (k) of the Cyber Essentials (2025) certification document says, as good practice, account reviews should be carried out at least quarterly or whenever the account list changes, such as onboarding, offboarding or restructuring. Clause A.5.4 (e) says dormant and inactive accounts should be removed, giving "inactive for more than 60 days" as an example.

Build your account inventory first

You cannot review access you have not listed. Cyber Essentials clause A.5.4 (a) and (b) ask for an account inventory covering user, administrator, third-party and service accounts, including cloud and AI tool logins. A spreadsheet or an export from your directory is fine. For each account record:

Start with the systems that hold money or personal data. A typical 10-person business ends up with 15 to 30 systems once everything is listed.

The quarterly access review checklist

Work through these each quarter. Each item is a yes or no; anything that is not a clear yes gets fixed or written down with a reason.

How to run the review: step by step

For a small business, the whole review should take one to two hours once the inventory exists.

1. 1

   Get the current staff and supplier list

   Ask HR or the owner for a dated list of current employees, their roles, and suppliers who should have access.

2. 2

   Export users from Microsoft 365 or Google Workspace

   In the Microsoft Entra admin centre, add the Last interactive sign-in time column to the user list and filter by date, as Microsoft describes for finding inactive accounts. In Google Workspace, use the user reports, which can be exported to Sheets or CSV.

3. 3

   Compare and mark each account

   Mark every account keep, change or remove. Anything without a named owner is a remove unless someone claims it.

4. 4

   Check sharing and guests

   Review guest users and external sharing on SharePoint, OneDrive and Google Drive. Our guide to Teams external access and guests shows where these settings are.

5. 5

   Repeat for SaaS, banking and Corppass

   Log in as an admin to each system in the inventory and check its user list. This is where most leftover access hides.

6. 6

   Make the changes and record them

   Disable or remove accounts, reduce roles, then log the date, reviewer, systems checked and changes made. Sign it off by email with the owner.

Evidence for Cyber Essentials and customer questionnaires

The Cyber Essentials mark is assessed by desktop review of your self-assessment by an independent assessor, according to CSA's certification page. Records help. Keep these together in one folder:

• The account inventory, with the date of each export.
• The approval trail for granting and removing access (Cyber Essentials A.5.4 (c) asks for name, system, department, role, from date and to date).
• The quarterly review log with what changed.
• Your approved admin list and when it was last checked.

The same records answer the access-control section of most customer security questionnaires. Microsoft's Secure Score also lists identity recommendations, such as limiting admin roles, which you can screenshot as supporting evidence. For the full set of controls, see our Cyber Essentials checklist.

Automating reminders and reviews

The simplest automation is a recurring calendar event on the first Monday of each quarter, owned by a named person, with the checklist attached. That alone fixes the most common failure, which is forgetting.

Microsoft Entra has a built-in Access Reviews feature, but Microsoft's access reviews overview says it requires Microsoft Entra ID Governance or Entra Suite licences, with some capabilities on Entra ID P2. Most small businesses on Business Standard or Business Premium do not have these, so a spreadsheet plus exports is the realistic option.

For businesses with frequent staff changes, a small internal tool that pulls user lists from your main systems and flags leavers and inactive accounts saves the manual comparison.

Do it yourself or get help?

The first review is the slow one because you are building the inventory. After that, a careful office manager can run it each quarter. Admin accounts deserve extra care; see our guide to admin account best practice.

Our Access Review & Leaver Tool (from S$1,200) builds a dashboard that lists accounts across your systems and flags leavers and inactive users. If you first need admin roles, MFA and sharing settings tidied up, start with Microsoft 365 / Google Security Lockdown (S$590).