User Access Review for a Small Business

Check who has access to what, and remove what is not needed.

Added October 15, 2026. Written with AI assistance and checked for clarity and placeholders; not reviewed by a lawyer, accountant, clinician or other professional. How these prompts are made

The Open buttons send the prompt text as currently shown below to that site only when you click. Fill in the placeholders first.

[VERIFY] is an editorial flag, not a blank to fill. Wherever the prompt shows [VERIFY], check that item against a reliable source before you use it (what [VERIFY] means).

Run a user access review for my small business. List of systems, the people with accounts, their roles and last sign-in dates where known: [ACCESS_LIST]. Staff changes in the last year: [STAFF_CHANGES]. Shared accounts in use: [SHARED_ACCOUNTS].

Compare access with current job roles, find leavers with live accounts, shared logins, owners and admins who do not need that level, accounts without two-step sign-in, and service accounts nobody owns. Rank each issue by the harm it could cause.

Return a table with Person or account, System, Issue, Risk (red, amber, green) and Action, a script for asking managers to confirm access, and a quarterly review checklist. Never include real passwords or codes.

Also record the date, reviewer and decisions for each account, so that the review itself is evidence, and flag any account I could not identify.

Then create a repeatable access review programme. Define the scope of systems, an owner for each, a quarterly calendar, and the evidence to keep. Write a short manager email asking for confirmation of each person's access, with a table to complete and a deadline, and a procedure for removing access that is not confirmed. Prepare a role-based access matrix for the five most common roles so that new starters receive the right access and no more. Provide a record template showing the system, user, role, reason, approver and review date. Include a plan for emergency access to critical systems and for service accounts that no person logs into. Add measures such as the number of accounts removed and the time to remove access after a departure. Keep everything defensive, and never include real credentials. Records rules are [VERIFY] for [JURISDICTION].

Add a closing reminder to review shared mailboxes, shared calendars and shared drives, which often hold access that is missed in system-by-system reviews.

Redact personal data and secrets before pasting anything. If the material includes them, stop, tell me what to remove, and continue only with the redacted version.

Fill in before use

Optional: type your details and the prompt above updates. Nothing is saved or sent.

Replace each bracketed placeholder with your own details, then paste into Any AI or another assistant.

Review extract (invented, 9 accounts)
Accounting system: 4 users; one former contractor (left in March) still active. Red.
File storage: shared "admin" login used by 3 staff. Red.
Email: owner and manager are admins; manager does not need it. Amber.
Payroll provider: no second step enabled for the bookkeeper. Amber.
Website CMS: 2 editors, 1 admin; recent sign-ins confirmed. Green.
Actions: remove contractor today, create named accounts, enable two-step on payroll, remove manager admin. Evidence: date, reviewer, decision for each account. Next review: three months. No passwords recorded here.

• audit