Small companies rarely lose control of access in one big moment. It happens slowly. A contractor finishes, a trial is never cancelled, a folder is shared "just for now". After a year there are accounts nobody can explain and licences nobody uses.
Regular checks help, and you may already do some of them, such as a monthly review of software subscriptions or removing access when someone leaves. A yearly cleanup day is different. It looks at everything at once and catches what the routines missed.
The plan is simple: one list, one owner, one afternoon.
Before the day: pick the owner and the scope
Choose one person who runs the day and signs off the result. In a small company this is usually the owner, the office manager or whoever looks after IT. One owner matters more than a perfect method, because a shared task tends to stay undone.
Then write the scope as a short list of tools. Start with these:
- email and calendar;
- file storage and shared drives;
- accounting, invoicing and banking access;
- project, chat and CRM tools;
- website, hosting and domain accounts;
- the password manager, if you use one (see a password manager rollout for a small company).
Block three hours in the calendar and tell the team the date. Ask each person to note any tool they use that is not on the list.
Step 1: export the accounts
For each tool, export the list of users, or take a screenshot if there is no export. Most admin pages show the name, the email, the role and the last sign-in date. Put everything into one sheet with these columns:
- tool;
- person or account name;
- role (admin, member, guest);
- last sign-in;
- cost per month, if it is a paid seat.
Do not fix anything yet. First collect, then decide. Mixing both is how things get missed.
Step 2: compare with the list of people
Make a short list of everyone who should have access today: employees, regular contractors and external advisers. Then go through the sheet and mark each row:
- Keep: a current person with a role that fits their work.
- Reduce: a current person with more rights than needed, for example an admin who only reads reports.
- Remove: someone who has left, a contractor whose work ended, or an account nobody recognises.
- Ask: you are not sure. Name who will answer, and by when.
Pay special attention to admin roles and to shared accounts such as "info@" or "accounting@". Each should have a named person responsible for it. If you cannot name one, that is the finding.
Step 3: cancel unused licences
Sort the sheet by last sign-in. A common rule is that a paid seat with no sign-in for 90 days goes on the cancel list. Before cancelling:
- Send the user a short message: "We will remove your seat in the tool on Friday. Reply if you still need it."
- Wait the agreed days.
- Remove the seat, or move to a cheaper plan if the tool offers one.
Check also for duplicates, such as two tools doing the same job, and for trials that turned into paid plans. Write down the monthly saving next to each cancelled seat. The total is a useful number for next year's budget and for explaining why the day was worth it.
Step 4: close the leftovers
Accounts are only part of it. Look for the quieter leftovers:
- Shared links to files and folders that are open to "anyone with the link". Switch them to named people or set an expiry.
- Guest users in chat and file tools from finished projects.
- Test and demo accounts created during setup.
- API keys and integrations connected to tools nobody uses. Revoke what you cannot explain, and note anything you cannot revoke today.
- Old devices still signed in to company accounts. Sign them out.
For anything with a password you are not sure about, change it and store the new one in your password manager. Where a tool supports two-step sign-in, check that it is switched on for admins at least.
Step 5: write down the result
A cleanup that leaves no record has to be repeated from zero next year. Use one page with:
- date and owner;
- number of accounts checked, removed and reduced;
- licences cancelled and the monthly saving;
- open items with a name and a date;
- the date of the next cleanup.
Keep it where the owner and the person responsible for IT can find it, and book the next date in the calendar before the afternoon ends.
Where it usually goes wrong
- No owner. Everyone agrees it is a good idea and nobody schedules it.
- Removing without warning. A person loses a tool they needed the same day. The short message in Step 3 prevents this.
- Cleaning only paid tools. Free accounts and shared links can expose more data than an unused paid seat.
- Fixing while collecting. The list is incomplete and the second tool is checked less carefully than the first.
- No next date. The cleanup becomes a one-off, and the same pile builds up again.
Summary
Once a year, pick one owner and one afternoon. Export accounts from every tool, compare them with the current list of people, cancel seats unused for 90 days after a warning, close old links, guests and test accounts, and write the result on one page. The first time takes the longest. After that the list exists, and the next cleanup is shorter.
Sources
- Common practice for small businesses, offered as a practical guide. No client results or market figures are claimed in this article. The 90-day threshold is an example; choose a period that fits how your team works.
