A job change access review is the practice of adjusting a person's system access when their role changes — adding what the new position needs and, critically, removing what the old one granted. The first half happens naturally, because the person cannot work without it. The second half is the most consistently skipped step in access management, and it is how organizations end up with employees who can reach everything they have ever touched.
The pattern has a name because it is universal. Someone joins in one role, transfers to another, covers a leave, joins a project, gets promoted — and at each step gains access while shedding none. Ten years in, their permissions are an archaeological record of their career.
Nobody decided this. Removal has no natural constituency: the employee does not request it, the new manager does not know what the old role carried, the old manager has moved on, and the system administrator was never told the transfer happened. Absent a deliberate trigger, accretion is the default physics of access.
The consequence is asymmetric exposure. Long-tenured, much-promoted employees — frequently the most trusted people in the building — carry the largest attack surface. Compromise one such account and the intruder inherits a career's worth of accumulated reach.
Departures, whatever their gaps, at least have a process — someone disables the primary account. Transfers have none: the person remains employed, their account remains active, and nothing prompts anyone to reconsider what it can reach.
The risk is not hypothetical misuse by the transferred employee, though separation-of-duties problems are real — the payroll clerk promoted to a role that approves what they once entered, while retaining the entry access, has just dissolved a control. The larger risk is the standing surface: every retained permission is one more thing a phished credential exposes, forever.
The fix is procedural, not technical: role changes must generate an access event the way hires and terminations do.
A transfer out of HR, payroll, or finance warrants the most care, because the retained access is the kind that moves money or exposes the workforce: payroll edit rights, HRIS visibility, banking portals, approval authority. The person who moved from payroll to operations three years ago and can still open the payroll register is a finding that appears in nearly every first access review.
Manager transitions have their own wrinkle: visibility into direct reports should follow the reporting line. A supervisor who moved departments retaining dashboards over their former team — compensation, leave records, performance data — is both an access problem and, where medical or investigation data is visible, a confidentiality one.
Because triggers get missed, the periodic access review remains the safety net: quarterly or semiannual reconciliation of each person's access against their current role, with managers attesting rather than rubber-stamping. The job-change trigger keeps the drift small; the review catches what slipped through. Neither substitutes for the other.
A useful audit question for any organization starting from zero: pull the ten longest-tenured employees and compare their current access to their current job. The result usually makes the case for the process better than any policy argument.
Employer's Guardian helps employers build role-change triggers into HR processes and run the access reviews that backstop them through outsourced HR services.
This article provides general educational information, not legal, tax, or insurance advice. Requirements vary by location, industry, and the data your organization handles.