Dealing with "former employees" in your review — the cleanup round

Your first review turns up 8 accounts belonging to people who left years ago. That's not a problem — that's progress. Here's how to handle it without it turning into a blame session.

Your first real access review will inevitably uncover old mistakes: ex-employees with still-active accounts. Treat this as a clean-up exercise, not an opportunity to point fingers.

Bucket your findings

\n
• Truly inactive: no login > 180 days, person no longer in HR. Disable immediately + apply the 30-day rule.
\n
• Recently departed: < 90 days since leaving, offboarding partly completed. Fill in the gaps.
\n
• Unclear: person is still in HR but hasn't logged in for a long time. Check with their manager.
\n

Patch the process at the same time

Every ex-employee account you find is a signal that your offboarding process missed something. Use your findings to improve the process — not to put the previous person responsible in the stocks.

Document for audit

"During this review we found 12 orphaned accounts and offboarded them" is a strong story for an auditor — it shows that your review process is working. You won't be penalised for it, as long as you can demonstrate how you're preventing it from happening again.

See also: tracking down orphaned accounts, review pillar.