Why should access permissions be reviewed regularly?

Access is granted continuously and rarely revoked. As a result, people accumulate permissions throughout their careers.

Role changes are the main source

A salesperson who becomes a manager gains new permissions while retaining the old ones. No single action is wrong, but the cumulative effect over several years is.

Former employees and service accounts

User accounts are usually deactivated on the employee's end date. Service accounts and integration users are far more often overlooked, and they often have extensive permissions.

Do it every six months

Export a list for each security role and send it to the managers. They know who needs what. IT does not, and should not have to guess.

Pay particular attention to the administrators

System administrator is the role that can cause the most damage if misused. If you have more than a handful, that is usually too many.