The Open Door
People who left still have accounts, and nobody is certain who
What is actually going on
Offboarding is usually a payroll process, not a technical one. Accounts get forgotten because nobody owns the list, and the business genuinely cannot answer a simple question: who can currently get into our systems?
Accounts that outlive people
Email, file storage, the CRM, the accounting package and a dozen line-of-business tools each have their own user list. Removing someone from one is not removing them from the others.
Shared logins
A password everyone knows cannot be revoked when one person leaves, and nothing done through it can be traced back to a person. It is convenient exactly until it matters.
Missing second factor
Where multi-factor authentication is optional, it is uneven. A single reused password from an unrelated breach is then enough to get in, and nothing else stands in the way.
Nobody owns it
Access creeps outward because granting it solves an immediate problem and removing it solves nothing visible. Without someone reviewing it, permissions only ever accumulate.
What it costs
This one rarely announces itself. It surfaces as an account used months after someone left, an invoice paid to a redirected bank account, or files that turn up somewhere they should not be, and by then the question of who had access cannot be answered.
What we would do about it
What changes
You can answer who has access to what. Former employees do not have accounts. Shared logins are gone, multi-factor authentication is on everything that supports it, and joining and leaving follow a documented process.
Whether it pays
The return is exposure removed. The scenarios this prevents, a compromised mailbox redirecting invoices or a former employee reaching live data, are the kind that cost real money and are difficult to unwind.