Why does unused software access keep costing money after a project ends?

Why unused access keeps showing up on the bill

Unused access is usually an entitlement problem, not a usage problem. The organisation is still paying for a licence seat, subscription, or provisioned account because the access was created for a project and never fully removed when the work ended. That means finance sees an active bill, while operations sees an apparently harmless account that is simply no longer needed.

In practice, the cost persists because access and billing are often coupled to provisioning, not to real activity. If a user, contractor, or shared account is left assigned in the application, directory, or SaaS console, the vendor may keep charging until someone explicitly deallocates it or the contract renewal resets the count.

What usually breaks after project closeout

The common failure is missed deprovisioning. Teams close the project, but no one owns the final access review, so the account remains assigned long after the person has moved on. Orphaned accounts create the same problem when the original owner departs, and shared accounts make it worse because there is no single user to reassign the entitlement to a new project or cost centre.

Unused access can also survive because the organisation lacks a clean inventory of who has what. When procurement, IAM, SaaS admin, and project management records are not reconciled, consumption data and compliance data drift apart. The result is a paid-for entitlement that is still visible in reports, still counted toward licences, and still available for misuse if no one removes it.

How to stop paying for access no one uses

The fix is to make deprovisioning part of project exit, not an optional cleanup task. Access should be reviewed at offboarding, at project end, and at the next renewal point so unused seats, licences, and subscriptions can be removed before they roll into another billing cycle. Where the system supports it, treat last-used data and entitlement reports as evidence for removal rather than waiting for a manual request.

That is also where entitlement hygiene matters. NHIMG’s How to find unused AWS IAM roles and access keys is a good example of the kind of review discipline that prevents dormant access from lingering after the original need has passed. For broader discovery and governance, CIEM Buyers Guide explains how to find excessive or stale entitlements before they become recurring cost.

Risk and Threat Considerations

Unused access is not only wasted spend. It also increases the chance that an old entitlement, token, or shared login survives long enough to be abused, and it can leave audit records inconsistent with actual business use. The larger the environment, the easier it is for “temporary” access to become permanent drift.

Failure mechanism: The control failure is incomplete removal of licences or access at the end of the work, often because no one owns the final revocation step or the system does not enforce expiry.

Impact: The organisation keeps paying for unused entitlement, and it may also retain a dormant access path that can be reactivated, reused, or inherited by the wrong person.

Practitioner Guidance

What to verify: Reconcile the project closure list against the actual entitlement list, not just the HR or project tracker. If a seat, role, or subscription still exists in the target system, treat it as active until proven otherwise.

Decision rule: If an access path exists solely for a finished project, remove it first and investigate later. Cost recovery and risk reduction both depend on revocation happening before the next billing event or renewal date.

Practitioner takeaway: The real issue is ownership of the cleanup step, because unused access keeps costing money until someone proves that the entitlement is no longer required and actually removes it.

Related resources from NHI Mgmt Group

• What should teams do when an AI agent keeps access after a project ends?
• Who is accountable for third-party access after a campaign or project ends?
• Who is accountable when subcontractor access remains open after a project ends?
• Who should be accountable when an AI agent retains access after a project ends?