Who Still Has the Keys? Running a One-Afternoon Access Audit Before It Costs You

Ask who has admin access to your billing account right now. Not eventually, not after checking — right now. If your answer is a shrug, keep reading.

Small teams are obsessive about their software. We comparison-shop CRMs, we A/B test onboarding flows, we argue about Notion versus Coda like it's a family dinner debate. But the plumbing underneath all of it — who can actually get into what — is usually held together with a shared Google Doc called "logins (final) (2).docx."

That's not just a security problem. It's a speed problem.

The Slowest Login Sets the Pace

Every team has one person who holds the keys. Maybe it's the founder who set up the Stripe account in 2021. Maybe it's your office manager who's the only human who knows the social scheduling tool password. When that person is in a meeting, on vacation, or simply at lunch, work stops.

Think of it like airport security: your team's throughput is capped by the slowest checkpoint. A developer blocked on a staging environment, a marketer who can't pull ad account data, a sales rep waiting on CRM permissions — these aren't IT tickets. They're hours of payroll spent waiting.

And then there's the flip side: the ghost accounts. When Marcus left in March, did anyone revoke his access to the analytics platform? The file storage? The email marketing tool he set up? Every departed employee who still holds a login is both a security liability and a reminder that nobody owns offboarding.

The Afternoon Audit: A Realistic Plan for a 10-Person Team

You don't need enterprise identity management. You need a spreadsheet and four focused hours. Block a Friday afternoon and work through this:

Step 1: List every tool that touches money, customers, or data (45 minutes). Pull the last three months of credit card statements and bank transactions. Every recurring charge is a tool with a login attached. Add anything paid via a founder's personal card — those are the ones most likely forgotten.

Step 2: Map who can access what (60 minutes). For each tool, open the admin panel and look at the user list. You will find surprises: contractors from 2022, a personal Gmail address, duplicate accounts. Write down the current reality, not the intended one.

Step 3: Sort into three buckets (30 minutes). Keep and assign an owner. Downgrade to a lower permission level. Or kill the access entirely. When in doubt on old accounts, revoke — re-adding someone takes two minutes, and a breach takes a lot longer to clean up.

Step 4: Fix the shared password problem (45 minutes). Move credentials into a team password manager like 1Password or Bitwarden. It costs a few dollars per seat per month — rounding error money — and it means the shared logins doc can finally die.

The Offboarding Checklist That Takes 20 Minutes

The audit is a one-time cleanup. Offboarding is the habit that keeps it clean. When anyone leaves — employee, contractor, intern — run this same short list every time:

• Revoke access to every tool on your master list (this is why the list matters)
• Transfer ownership of any automations, scheduled reports, or integrations they built
• Change any shared passwords they knew
• Forward or archive their email
• Remove them from your password manager and devices

Twenty minutes, tops. Put it in your HR checklist so it happens automatically, not from memory.

Ownership Beats Perfection

The real fix isn't a policy document nobody reads. It's a simple rule: every tool has one named owner, and that owner is responsible for knowing who's in and who's out. When your billing tool, your CRM, and your automation platform each have a person's name attached, "who has access" stops being a mystery and becomes a question with an answer.

Your team's speed is a permissioning question more often than a talent question. Clear the logins, and you clear the bottleneck.