What happens when organisations do not review access rights as employee responsibilities change?

Why stale access rights become a control problem when people change roles

When employees move teams, take on new duties, or leave parts of a job behind, access must change with them. If it does not, the organisation keeps a mismatch between job need and actual privilege. That mismatch is not just untidy administration, it is a durable control weakness because access that is no longer justified often stays usable until someone notices it.

Stale permissions usually show up first as excess access, not immediate compromise. The practical issue is that access review are the point where outdated entitlements are discovered and removed, so failing to review means the business keeps carrying permissions that were valid for a former role but not for the current one.

What goes wrong operationally when reviews are skipped

Unreviewed access creates hidden breadth in the environment. Users may retain rights to sensitive systems, older applications, shared folders, admin consoles, or data sets that sit outside their current responsibilities. That increases the chance of policy exceptions, makes approvals harder to defend, and leaves managers with an incomplete picture of who can actually reach what.

It also weakens the organisation’s ability to prove control discipline. Audit teams tend to look for evidence that access is periodically revalidated and removed when it is no longer needed. If role change is not reflected in review cycles, the organisation often ends up explaining why access persisted rather than showing why it was still necessary.

Over time, the problem compounds because old permissions accumulate across multiple job changes. The longer review is delayed, the harder it becomes to distinguish active need from legacy access, and the more expensive the cleanup becomes. CIS Controls v8 is useful here because it treats account management and access control as recurring operational safeguards rather than one-time provisioning tasks.

Why the risk gets worse after a compromise or internal error

Stale access is dangerous because it expands blast radius. If an account is hijacked, the attacker inherits every lingering permission attached to that account, including access that the employee no longer needs. That can turn a limited account compromise into broader exposure of sensitive data, privileged functions, or connected systems.

The same issue matters for honest mistakes as well. A user who still has old access can perform actions outside current authority simply because the entitlement was never removed. MITRE ATT&CK Enterprise Matrix is a strong reference point for understanding how retained access can support credential abuse, privilege escalation, and lateral movement once an attacker finds a usable foothold.

For teams operating under formal control regimes, this is exactly where periodic review matters. NIST SP 800-53 Rev 5 Security and Privacy Controls ties access control, identity and authentication, audit, and configuration management into a single control expectation: access must be both granted appropriately and kept current.

What good access review looks like in practice

Effective review is not a box-ticking exercise. It should verify whether the access still matches the employee’s current duties, whether any elevated rights are still justified, and whether access should be reduced, removed, or reapproved under a new owner. Reviews are most useful when they are tied to real role change events, not just calendar dates.

The most important judgement is to treat removal as the default outcome when justification is unclear. If a manager cannot explain why a permission is still needed, the safer answer is to remove it and restore only the minimum required access after validation. That approach supports both least privilege and cleaner audit evidence. ISO/IEC 27001:2022 Information Security Management is relevant because its access control and privileged access expectations support this review-and-revoke discipline.

For organisations that rely heavily on application and system entitlements, the review process should also capture whether access is tied to current business need, whether session or account level controls are still aligned, and whether dormant permissions are being accumulated through role churn. CIS Controls v8 and OWASP ASVS both reinforce the need to validate that access is constrained to intended use.

Practitioner Guidance

What to prioritise: Focus first on privileged, data-rich, and shared-access accounts, because stale access there creates the fastest path to meaningful exposure. Then work outward to standard user entitlements and inherited group membership.

What to verify: Confirm that reviews are triggered by role changes, not only by periodic attestation. If a role moves, the access baseline should move with it, or the review process is missing its main signal.

Common mistake: Treating access review as an annual compliance event rather than a lifecycle control. That delay is what allows old rights to stay live long enough to become a real risk.

Practitioner takeaway: The control goal is not to review everything more often, it is to remove access quickly enough that former duties do not keep creating present-day exposure.

Related resources from NHI Mgmt Group

• What do organisations get wrong when they review access rights after employees change roles during a return to work?
• When should organizations review access controls?
• What breaks when organisations skip access review documentation and change tracking?
• How should organisations continuously reduce access creep as employee roles change over time?