If you lead an organization with an access control system, there is a list somewhere of every person who can open your doors. It includes employees, contractors, vendors, cleaners, and probably a few people nobody can identify anymore. Executives ask me how often access permissions should be reviewed, and my answer is quarterly as a baseline and immediately on every termination or contract end, with no exceptions. That answer is simple. The reason organizations fail to follow it is what deserves the explanation.
In my experience, access review is the single discipline that catches more real exposure than any equipment purchase, and it is almost never happening in a mid-sized organization before someone is put in charge of security. The list grows with every hire and every project, and it shrinks only when someone deliberately makes it shrink. Left alone, it becomes a record of everyone who has ever needed to get in rather than everyone who needs to get in now.
Why Access Lists Drift
Access is granted by one process and removed by a different one, and the two are rarely connected. A new hire gets a badge because onboarding requires it and someone will complain on day one if it does not work. A departing employee’s badge gets deactivated only if the separation checklist includes it, if the person running the checklist remembers, and if the system administrator acts on the request. Nobody complains when a former employee’s badge keeps working, because nobody is there to notice. The incentive runs entirely toward adding access and not at all toward removing it.
Contractors are worse. An employee’s departure at least passes through HR. A contractor’s project simply ends, and the person who requested the badge has moved on to the next project and has no reason to think about the credential. Vendors change staff without telling the client. Temporary access granted for a renovation stays in the system long after the walls are painted. Add in transfers between departments, where a person accumulates the access of every role they have held, and the list becomes a map of your organization’s history rather than its present.
How Often Should Access Permissions Be Reviewed
The quarterly review is the floor. Once a quarter, the complete list of active credentials is exported from the access control system and compared line by line against the current employee roster from HR and the current contractor and vendor roster from whoever manages those relationships. Every credential that does not match an active person with a current need is deactivated. Every credential that matches a person but grants more than the person’s role requires is reduced. The review is documented, with the date, the reviewer, the number of credentials removed, and the sign-off of the person who owns security.
Organizations with higher turnover, larger contractor populations, or sensitive areas such as data rooms, pharmacies, or cash handling should review monthly for those areas even if the general population is reviewed quarterly. If the quarterly review keeps turning up a large number of stale credentials, that is a signal that the event-driven process is broken and the interval should tighten until it is fixed.
The event-driven review is the part that matters most and fails most. On the day an employee is terminated or resigns, the credential is deactivated, ideally before the person leaves the building and never later than the end of that business day. On the day a contract ends, every credential associated with it is deactivated. On the day a person changes roles, their access is reset to the new role rather than expanded. These are not quarterly tasks. They happen the day the event happens, and the quarterly review exists to catch the ones that were missed.
What a Review Actually Involves
The first review in an organization that has never done one is the hardest and the most revealing. Expect it to take a few days, expect to find credentials nobody can explain, and expect some resistance from managers who would rather not decide whether a long-departed contractor still needs a badge. Deactivate anything unexplained. If the person needs access, they will surface, and reissuing a credential takes minutes. The risk of removing access from someone who needs it is an inconvenience. The risk of leaving access with someone who should not have it is an incident.
After the first pass, reviews become routine if the process is built correctly. That means a single named owner, a calendar reminder that does not depend on anyone’s memory, a standard export from the system, a standard roster from HR, and a written record. It also means that HR’s separation checklist and the contract management process both include a step that notifies the access owner on the day of the event. Tie the three together and the list stops drifting.
Do Not Forget the Rest of the Keys
The badge system is the visible part. Physical keys, alarm codes, gate remotes, and shared door codes are the part organizations forget, and they are often the larger exposure because they are harder to revoke. A mechanical key issued a decade ago still works unless the lock was changed. A shared alarm code known to every employee who has ever worked the closing shift is effectively public. The quarterly review should include a key inventory, and every termination should trigger the question of what physical keys and codes the person held. If the answer is a master key or a shared code, the lock or the code changes.
Test the Review Instead of Trusting It
A review that reports zero stale credentials every quarter is either evidence of an excellent process or evidence that nobody is really looking. Test it. Pick a handful of people who left in the past year and check whether their credentials are active. Take a deactivated badge to a door and see whether it opens, because the system record and the door do not always agree. Ask the guard whether they would stop a familiar face whose badge failed. This is the discipline at the center of Until Tested: Security Is Only Assumed, and access control is one of the places where it pays off fastest. The list is an assumption until someone verifies it against reality.
Quarterly at minimum, same-day on every departure, documented every time, and tested periodically by someone who owns the result. That is the whole answer, and any organization can implement it within a single quarter if one person is made responsible for doing so.
Go Deeper
Access review is one of the standing disciplines a security leader puts on the calendar in the first quarter of an engagement. For a full picture of that role and how it works on a part-time basis, start with What Is a Fractional Security Director? The Complete Guide. My book Fractional Security Director covers the monthly and quarterly rhythm of a working security program in detail.
Commissioner William Epps is a former elected Fire Commissioner, federal law-enforcement supervisor, and firefighter since 2006, with instructor credentials in Hazardous Materials response, Active Shooter preparedness, and Stop the Bleed®. He spent seven years in federal law enforcement in physical security, executive protection, and incident command, and now serves organizations as a Fractional Security Director. He is the author of The Spirit of Saul, The Spirit of Pharaoh, and other practical books on security, leadership, and faith, built around one idea: knowledge should be practical enough to use when it matters.
Leave a Reply