Microsoft’s documented access-review popup asks whether to remove two denied users’ group membership; four of eight users are still not reviewed. This older Azure interface shows neither a fully reviewed population nor completed removal. Apply approved results and retest resource access separately.[2]
An access review has three different states: a manager decides what access should remain, an administrator or supported process applies that decision, and someone verifies the resulting access. Keep those states separate in the review record. The worked findings table below shows how a review can be complete while the required correction is still open.
For firms using Microsoft Entra access reviews, verify the resource scope, reviewers, product entitlement and completion settings. The feature reviews the configured groups or applications; it is not a review of every tax, payroll, banking or local account. [1] Review decisions also need the appropriate apply step and verification of exceptions such as inherited or on-premises membership. [2]
Evidence to collect before changing CPA and financial firm employee access
The review produces a worker-by-worker record of status, supervisor, role, service and client assignments, privileged and financial authority, devices, training, exceptions, last activity, review date, and action. Orphaned work is transferred before access closes.
- Current HR and contractor roster with status, supervisor, role, location, start date, review or end date, leave, transfer, and departure information.
- Identity, group, application, client, portal, administrative, financial, service-account, token, session, recovery, and vendor-access exports.
- Device assignment, management, encryption, endpoint protection, patch, local administrator, remote-support, return, and disposal records.
- Training completion, phishing reporting, policy acknowledgment, support history, repeated workarounds, exceptions, and role-readiness evidence.
- Active clients, deadlines, approvals, files, mailboxes, automations, shared queues, leave coverage, and departure transfer records.
Reconcile people, roles, clients, privileges, and end dates
Roster, supervisor, and worker status
What to check: Match each active identity to a current worker, status, supervisor, role, location, start date, end or review date, and service team. Identify people in systems but absent from the approved roster.
What to do next: Investigate unmatched identities with the responsible owner and distinguish person, administrative and service accounts. Contain confirmed unauthorized access under the approved timing; do not delay a cutoff to finish a handoff. Microsoft describes separate identity, token and application-session actions, so a directory status alone is incomplete closure evidence. [3]
Role, client, and restricted-record access
What to check: Sample workers across duties and compare allowed clients, inherited groups, public links, search visibility, inactive records, restricted clients, temporary access, and approval evidence.
What to do next: Correct groups and assignments, close stale links, remove inactive clients, expire exceptions, document restrictions, and retest allowed and denied paths with managers.
Privileged and financial authority
What to check: List high-impact permissions by worker and capture business need, approving owner, last use, separation of duties, temporary expiration, monitoring, and backup coverage.
What to do next: Remove unnecessary authority, separate administration, add independent approval and verification, expire temporary roles, alert on high-impact changes, and retest representative transactions.
Test devices, training, communication, and financial boundaries
Device assignment and remote access
What to check: Match devices and remote paths to current workers and collect ownership, last seen, health, encryption, protection, support, local administrator, return, and exception status.
What to do next: Recover unassigned devices, quarantine risk, enroll and patch supported equipment, remove unknown remote tools and local privilege, close former-user paths, and document approved exceptions.
Training and behavior evidence
What to check: Compare completion with observed behavior. Identify repeated unsafe attachments, credential sharing, unreported phishing, bypassed verification, unauthorized AI use, and roles that never practiced the procedure.
What to do next: Provide role-specific coaching, correct the workflow that encourages bypass, restrict high-risk access until readiness is shown, and test the real behavior again.
Use the employee-management and training guidance in IRS Publication 4557 to inform the firm’s review. Choose duties and test records that fit the actual practice, retain only necessary evidence and record what was tested. This access review supports the firm’s security program; it does not by itself certify compliance with every applicable requirement. [4]
Seasonal and temporary access
What to check: Find active accounts before start or after end, reused identities, missing supervisors, broad default groups, forgotten devices, undocumented extensions, and licenses or records owned by former workers.
What to do next: Correct owners and dates, review each person’s current role, remove stale client access and require approved extensions. Test the implemented end action in each covered system. Record manual actions where needed; a task, date field or exception report remains evidence of work to do until the resulting access is verified.
Role changes and leave coverage
What to check: Compare current duties with old and new access, delegated authority, active client work, deadline ownership, shared credentials, temporary coverage dates, and post-return cleanup.
What to do next: Remove obsolete duties, add only approved new access, transfer work and deadlines, use supported delegation instead of passwords, set expiration, and review after return or transition.
Review leave, seasonal access, departures, records, and support
Departure execution
What to check: Sample the approved cutoff, identity and application actions, remaining sessions, device custody, record preservation and transferred work. Check whether a handoff was prepared where possible, but do not accept a delayed cutoff simply because file transfer was unfinished. Keep deletion and license removal distinct from blocking the former worker’s access.
What to do next: Close missed access and sessions, recover devices, rotate shared secrets, transfer ownership, correct client and deadline coverage, preserve evidence, and repair the checklist that allowed the miss.
Worker-owned data and automation
What to check: Identify client records, deadlines, templates, approvals, exports, automation, credentials, and knowledge that depend on one worker. Record owner, backup, transfer method, and business impact.
What to do next: Move required records to approved team locations, transfer automation and ownership, document the procedure, create backup coverage, and remove unnecessary personal copies after approved preservation.
Support patterns and access exceptions
What to check: Group recurring issues by role, service, system, root cause, user impact, security impact, deadline, workaround, approval, and whether permanent correction occurred.
What to do next: Correct role templates and workflows, document safe self-service, train affected teams, close stale exceptions, automate repeatable checks, and retain escalation for high-impact authority.
Prioritize current exposure and client continuity
Give managers a concise action list by worker, client or service affected, authority, device, deadline, immediate containment, transfer requirement, owner, due date, and retest. Separate a technical permission error from a manager approval, staffing, training, or process problem.
Priority 1: Active former-user or unauthorized access
Act immediately on former-worker access, unknown identities, uncontrolled privileged or financial authority, lost devices, active malicious sessions, exposed client records, or a departure gap involving sensitive systems.
Priority 2: Client and deadline continuity risk
Urgently transfer orphaned clients, filings, payroll work, approvals, scheduled reports, mailboxes, automation, or deadlines that depend on an unavailable person.
Priority 3: Role and process mismatch
Correct excessive groups, stale seasonal access, device gaps, incomplete training, repeated unsafe workarounds, unclear supervisors, and expired exceptions on a scheduled plan.
Priority 4: Workflow improvement
Improve onboarding speed, automation, reporting, self-service, and license efficiency after access, authority, records, and continuity are controlled.
Keep the decision, implementation and retest in different columns
This illustrative register contains invented findings, not a client audit or measured failure rate. Use authorized test identities and fictional records. The owner should retain the evidence appropriate to the actual system and the firm's approved process.
| Finding | Decision recorded | Implementation evidence | Closure test |
|---|---|---|---|
| Seasonal worker still reaches an unrelated test client | Manager denies the old client assignment. | The granting role, group or share is changed by its owner; the decision alone is insufficient. | An authorized role test can still open the allowed client and cannot reach the excluded one through the tested paths. |
| Review is Completed but results were not applied | Reviewer has denied the membership. | The responsible administrator verifies the applicable apply step and handles unsupported membership paths. | Check actual resource membership and access; retain an unresolved exception if removal did not occur. |
| Directory is blocked but a separate portal session remains | Security owner requires the approved cutoff. | The application owner executes the supported local account/session action. | The authorized test confirms the intended denial, with the time and tested path recorded. |
| A scheduled client report has no replacement owner | Service manager assigns a new responsible person. | Ownership or supported delegation is transferred without sharing the former worker's password. | The replacement completes a fictional run through their own approved access; untested dependencies remain open. |
Use the seasonal onboarding setup guide to establish a repeatable readiness process for the next employee. Use the onboarding and offboarding cleanup checklist when this review finds stale permissions, missed departures or unowned work. ALLMSP’s cybersecurity services can help assess the technical evidence and implement the firm’s approved corrections.
Frequently Asked Questions
How should a CPA firm reconcile its employee roster with system accounts?
Use a dated worker roster and compare it with each system’s active identities using a stable worker identifier. Record the supervisor, role, status and approved start or end action, and classify separate administrator and service identities by owner. Investigate unmatched entries instead of treating account count as employee count. Report unresolved ownership and late cutoff actions separately from records that were successfully matched.
What evidence should managers review for employee client access?
Review the current client-assignment approval alongside the actual permission path: direct role, inherited group, folder, sharing link or application assignment. Use authorized fictional records to test an allowed client and an unrelated client. Record the scope tested and any untested paths. A manager’s attestation is useful evidence of intent; it is not evidence that a denied permission was removed.
How should financial firms review employee financial and administrative permissions?
Ask the responsible service owner who can prepare, review, transmit, release, reconcile and administer each relevant system. Capture the actual assignment, approving owner, exception and review date. Check high-impact permissions inside the application rather than relying only on directory roles. Where duties must be separated, use an authorized non-production test to establish that the same person cannot bypass the approved review or release step.
What should managers verify about employee devices and remote access?
Check custody and the most recent reliable device-management evidence, including supported updates, encryption and recovery custody, endpoint protection and remote paths. A stale inventory entry is not proof of current control. An offline device cannot be assumed to have received a revocation or wipe command. Keep missing devices and personal-device exceptions visible with an owner and an approved next action.
Why is training completion alone not enough for CPA firm security?
Completion records show that a course was recorded, not that the worker can use the secure process. Ask the person to handle a fictional portal request, suspicious tax notice or changed payment instruction through the firm’s real reporting route. Record the action demonstrated, any failed step and the retest. Also fix missing tools or unclear procedures that encourage people to bypass the approved process.
How should CPA firms audit seasonal and temporary worker access?
Sample active, recently ended and returning seasonal workers. Compare the approved dates and extensions with actual sign-in, application roles, client groups, devices and closure evidence. Check a cutoff test rather than merely checking that an end-date field is populated. A returning worker needs a current role and client review; an old identity must not be handed to a different person.
What access changes should be reviewed after promotion, transfer, or leave?
Compare old duties, current duties and the specific temporary coverage approval. Check which former client groups and financial roles were removed, who owns transferred work and when temporary delegation ends. Review again after return or reassignment. Added access with no record of removed duties is an incomplete move, even if the new role works correctly.
How can a financial firm verify that employee offboarding was complete?
Read the per-system closure record and supporting action times, then verify the high-risk paths through authorized tests and logs. Distinguish directory blocking, refresh-session revocation, application-owned sessions, direct logins and device custody. Check preservation and work ownership separately from account deletion. Mark each missing result open; a single closed departure ticket cannot establish that every access path was closed.
What should CPA firms transfer before an employee leaves?
Identify required client files, workpapers, deadlines, approvals, mailboxes, reports, automations and their new owners. Preserve records under the firm’s approved requirements and check that the replacement can continue the work using their own access. Do not postpone an authorized cutoff or share the former employee’s password. Make license removal or account deletion a separate reviewed step after the preservation decision.
How can support tickets improve employee access controls?
Use recurring tickets to select a control to test, such as seasonal client-group assignment or offboarding of a separate portal. Link the ticket to its root cause, approving owner, actual correction and retest evidence. Compare the next similar cases using the same definition of ready or closed. Report unresolved cases and scope so a falling ticket count is not mistaken for proven access control.
Sources
- Microsoft Learn: create an access review, scope, prerequisites and completion settings ↩
- Microsoft Learn: complete an access review, apply results and handle membership limitations ↩
- Microsoft Learn: revoke user access, including token and application-session limitations ↩
- IRS Publication 4557, Safeguarding Taxpayer Data (May 2024): employee access and training guidance ↩
