Review old and new access when staff change roles

What this means for your practice

Treat a role change as a review of existing access as well as a request for new access. Identify systems that need separate handling when automatic updates are unavailable.

Questions to take to your supplier

Change a fictional staff role and inspect each connected tool. Which permissions are added, retained or removed? Ask who handles systems that cannot update automatically. The employee and manager should know what is ready and what still needs an authorised person to complete it.

Agree the working process

Treat a role move as a review of what the person already has as well as what they need next. List the connected applications and identify access to add, retain or remove, using the organisation's authorised process. Some permissions may remain appropriate for a handover period, but that should have a reason and review point. Ask the supplier how automatic updates and manual exceptions appear together so the owner can see when the change is genuinely complete. Use a fictional move between teams and inspect the destination tools, not only the central staff record.

Include a system that cannot update automatically and confirm a responsible person receives that task. Keep the agreed result understandable to the manager and employee. After completion, verify that old access is no longer present where removal was required. Repeated residual permissions may indicate that the application inventory is incomplete or the role mapping is unclear, rather than an isolated missed administration step.

How to check the result

Count residual permissions awaiting review.