Admin Account and Privileged Access Audit

Check how many people hold the keys and how they are used.

Added October 15, 2026. Written with AI assistance and checked for clarity and placeholders; not reviewed by a lawyer, accountant, clinician or other professional. How these prompts are made

The Open buttons send the prompt text as currently shown below to that site only when you click. Fill in the placeholders first.

[VERIFY] is an editorial flag, not a blank to fill. Wherever the prompt shows [VERIFY], check that item against a reliable source before you use it (what [VERIFY] means).

Audit privileged access. List of admin and owner accounts across email, cloud, payments, domain registrar and hosting, with who holds them and how they sign in: [ADMIN_ACCOUNTS]. Recovery methods registered: [RECOVERY_METHODS]. Emergency access arrangements: [EMERGENCY_ACCESS].

Check for personal email addresses on business accounts, single points of failure, admins used for everyday work, missing second factors, recovery routes controlled by one person or a former employee, and no record of who can approve changes.

Return a table with Account, Holder, Risk (red, amber, green) and Fix, a sensible separation of everyday and admin accounts, and an emergency access procedure in plain language.

Also suggest a simple register of admin accounts kept offline with the owner of each, and a rule that any change to an admin holder is approved by two people and recorded with the reason.

Then create the privileged access standard and emergency plan. Define which accounts are privileged, who may hold them, how they must be protected, how they are used, and how use is reviewed. Provide a register template listing the account, system, holder, backup holder, recovery method, last review and two-step sign-in status. Write a break-glass procedure for emergencies: where credentials are held, who can authorise their use, how use is recorded and how credentials are reset afterwards. Add a quarterly review checklist and a leaver step that includes recovery contact changes. Describe how to separate everyday accounts from admin accounts in practice for a small team, with a realistic exception process. Include a short staff briefing on why admin rights are limited. Keep the content defensive, do not include real credentials, and confirm contractual or insurance requirements with a professional [VERIFY].

Prioritise by realistic risk to the business, explain each fix in plain language, and avoid fear-based wording. Mark vendor-specific behaviour [VERIFY] against current documentation.

Fill in before use

Optional: type your details and the prompt above updates. Nothing is saved or sent.

Replace each bracketed placeholder with your own details, then paste into Any AI or another assistant.

Register extract (invented, no real credentials)
Domain registrar: one owner, a personal email, no second step. Red.
Cloud console: three admins; one is a former contractor. Red.
Payment provider: owner plus bookkeeper; recovery phone belongs to the owner's old mobile. Amber.
Email admin: shared "info" login used by 4 people. Amber.
Website CMS: two admins, both with second step. Green.
Actions: add backup holder to registrar, remove contractor, replace shared login with named accounts, update recovery contacts.
Break-glass procedure: sealed envelope location, two-person approval, reset afterwards.

• audit