An access audit should reconcile people, credentials, and doors
Counting cards is not enough. For every key, card, fob, code, alarm user, or app credential, identify the current holder, authorized role, openings or systems reached, issue date, and removal trigger. Then compare that record with what the access system and managers actually show.
Begin with the highest-consequence access
Review masters and shared credentials first
Prioritize credentials that reach cash, personal data, controlled stock, plant rooms, server equipment, roof or utility areas, alarm controls, or multiple locations. A shared code may be operationally convenient but difficult to attribute or remove when one person leaves. Replace it with named access where the system and workflow permit.
Investigate four common mismatches
| Mismatch | Question | Action |
|---|---|---|
| Unassigned credential | Who physically holds it now? | Locate, disable, or replace according to risk. |
| Excess access | Does the current role still need every area? | Reduce to the required scope. |
| Shared code | Can use be attributed and removed? | Move toward named access or controlled rotation. |
| System-record conflict | Which record reflects current reality? | Verify, correct, and record the review. |
Make the audit part of normal change
Review access after hiring, transfer, termination, lost credentials, contractor completion, renovation, incident, and system replacement. Give one role responsibility for physical and digital closeout so each team does not assume another team removed access.
Use the access offboarding checklist for a departure. If the audit finds an unexplained use or loss, preserve facts with the incident documentation log before changing records needed for review.