Case Study
User Access Management Review
Reviewing user roles, permissions, and access removal across internal commission, project management, and CRM applications, and building safeguards to keep access appropriate.
- Focus
- Logical access
- Context
- Three internal business applications
- Tools
- Supabase, Vercel
- Role
- Operations Intelligence Manager
Overview
At a technology advisory firm, I review who has access to what across three internal business applications: commission tracking, project management, and CRM. The aim is to make sure access matches each person's role and is removed when it is no longer needed.
Risk & objective
Internal applications hold contract, commission, and client information. Excess permissions, or accounts that stay active after someone changes role or leaves, create the risk of unauthorized viewing or changes, and make it harder to trust the records. The objective is to keep access limited to what each role needs, to catch access that should be removed, and to keep a trail of what users do.
Approach
- Define the scope. List the applications in the review: commission tracking, project management, and CRM.
- List users and roles. Record who has an account in each application and which role they hold.
- Compare access to need. Check that each role's permissions match what that role needs to do its job.
- Identify access to change. Flag accounts or permissions that are no longer needed.
- Remove or adjust, then confirm. Apply the change and check that the access is actually gone.
- Build in safeguards. Set up role-based access, data restrictions, two-factor authentication, and activity logs so that access stays appropriate between reviews.
Controls
| Control | Risk it addresses | Evidence |
|---|---|---|
| Role-based access | Users holding more access than their role needs | Defined roles with permissions per role |
| Data restrictions | Viewing or changing records outside one's role | Restrictions on records by role |
| Two-factor authentication | Account takeover through a stolen or guessed password | Two-factor sign-in enabled |
| Activity logs | Changes that cannot be traced to a user | Log of user actions |
| Access removal review | Leftover access after a role change or departure | Review of roles and removals |
Access review matrix and checklist
| Role | Commission app | Project app | CRM |
|---|---|---|---|
| Role 1 (Administrator) | Manage | Manage | Manage |
| Role 2 (Manager) | Approve | Edit | Edit |
| Role 3 (Analyst) | Edit | Edit | View |
| Role 4 (Viewer) | View | View | None |
- Does the account belong to a current user?
- Does the user's role match their current job?
- Are the permissions for that role limited to what it needs?
- Is two-factor authentication on?
- If the user left or changed role, was access removed or changed, and was it confirmed?
- Do the logs show who changed what?
Result
Access across the three applications is governed by defined roles, with safeguards built into the applications instead of relying on manual checks alone, and with logs that record user actions.
Through an audit lens
This is the control area that IT general controls testing calls logical access: provisioning, periodic access review, removal of leavers, authentication, and logging. I have worked on both sides of it, designing the controls and checking that they operate, which is the view an auditor needs when deciding what evidence to request and how to test it.
Skills demonstrated
Details are anonymized to protect confidential business data. Figures are limited to those on my resume.
← Back to all projects