“Least privilege” is easy to agree with and hard to maintain. Access drifts: people change roles, projects end, and temporary permissions quietly become permanent. A quarterly review is the simplest way to pull it back.
Who is involved
- System owner — decides whether access is still needed.
- Line manager — confirms the person’s current role.
- Reviewer (security or IT) — runs the process and records outcomes.
What to check
- Accounts belonging to people who have left or changed teams.
- Privileged roles (admin,
SAP_ALL, owner) — each one needs a named justification. - Service accounts — is each one still used, and by what?
- Accounts with no login in the last 90 days.
Record every decision
| User | Role | Decision | Reason | Reviewer |
|---|---|---|---|---|
| j.doe | Finance Approver | Keep | Current role | A. Rahman |
| t.smith | System Admin | Remove | Moved to new team | A. Rahman |
A decision without a reason won’t survive an audit — and won’t help the next reviewer either.
