A Drive ownership review should reveal where business-critical files live, who can remove or expose them, and which accounts the company cannot recover. The review must cover both My Drive ownership and Shared drive membership because transferring one employee’s files does not automatically correct direct shares, group membership, external access, scripts, or content stored in another organization’s drive.
Do not remove an owner, Manager, external collaborator, group, shortcut, or verification account until the business owner confirms the purpose and replacement access has been tested. A permission that looks unnecessary may support a client portal, form, published report, or automated workflow.
Our in-house team delivers Google Drive access, ownership, and security review for businesses around Lawrenceville, Suwanee, Gwinnett County, Metro Atlanta, and the rest of Georgia, while coordinating the applications, identities, devices, data, security controls, and employees affected by the work.
Evidence to collect before changing Drive ownership
A useful Drive review produces an asset and access record, not a folder cleanup impression. It identifies critical individual owners, Shared drive managers, externally shared content, public links, inactive users, unusual download or movement events, unresolved business ownership, and a tested remediation sequence.
- Critical folders and files still owned by individual users or outside accounts.
- Shared drive managers, members, groups, restrictions, and items with limited access.
- Files and folders shared externally, publicly, by link, or through groups with outside members.
- Inactive, suspended, former, service, agency, and personal accounts with access.
- Drive log events for sharing, downloads, deletion, ownership changes, and movement across organizations.
- Forms, scripts, Sites, reports, shortcuts, and integrations that depend on reviewed files.
Find ownership and administrator concentration
Critical My Drive ownership
What to check: List important contracts, client folders, reports, Forms, scripts, templates, and operating records owned by individuals. Record the owner status, manager, collaborators, sensitivity, and whether the item belongs in a Shared drive.
What to do next: Move or transfer durable content through a controlled test. Keep personal drafts in My Drive only when a documented business rule supports that choice.
Shared drive Manager access
What to check: Record every Manager, whether access is direct or through a group, the person's current role, last review, and whether at least two authorized internal managers exist for a critical drive.
What to do next: Remove stale managers after a replacement has been tested. Use groups for durable team membership and keep management authority narrower than editing authority.
Member role accuracy
What to check: Compare Manager, Content manager, Contributor, Commenter, and Viewer assignments with current duties. Identify direct access that duplicates a group or gives deletion and movement rights unnecessarily.
What to do next: Downgrade excessive roles, consolidate membership through approved groups, and retest required work before removing direct access.
Inspect Shared drive and external access
External and public sharing
What to check: Filter for externally shared content and record the item owner, outside domain, access level, last activity, business reason, link setting, and expiration where supported. Include Groups that allow external members.
What to do next: Remove access that has no current owner, narrow access to the required file or folder, set expiration where appropriate, and confirm the client or vendor still completes the intended task.
Inactive and former user access
What to check: List suspended, archived, inactive, departed, renamed, and service accounts that own content or retain access. Record whether My Drive data was transferred and whether Shared drive memberships were removed separately.
What to do next: Complete data transfer and access removal through the offboarding process. Validate manager access and automation before deleting accounts or revoking credentials.
Content owned outside the organization
What to check: Identify critical items owned by personal Gmail accounts, agencies, clients, former employees, or another Workspace domain. Record what the business can export, copy, transfer, or recreate and which workflows depend on the external owner.
What to do next: Create a company-controlled copy or migration plan with permission from the business owner. Test links and automation before retiring the externally owned original.
Limited-access folders and direct exceptions
What to check: Record folders with limited access, nonmember shares, direct user exceptions, and the reason inherited drive membership is not sufficient. Confirm Managers understand who can still access the parent drive.
What to do next: Keep exceptions only where the sensitivity and workflow justify them. Name owners, use clear folder boundaries, and retest after membership changes.
Trace risky activity and workflow dependencies
File movement across organizations
What to check: Review files moved into external Shared drives, copied out of the organization, downloaded in volume, or transferred between domains. Capture actor, item, source, destination, timestamp, and approved business reason.
What to do next: Escalate unexplained external movement, preserve logs, restrict access, and coordinate with security and business leadership before altering evidence or deleting accounts.
Workflow and published-content dependencies
What to check: List reviewed files that collect responses, run automation, feed dashboards, publish web content, or authenticate an integration. Record the owner and service account or user context for each dependency.
What to do next: Move ownership or redesign the workflow so it does not depend on a departing person. Test with a real submission or refresh before changing the original permission.
Recovery and backup evidence
What to check: Record available restore windows, who can restore content, covered users and Shared drives, recent failed jobs, legal holds, and the result of representative file restores.
What to do next: Close coverage gaps, assign restore authority, and schedule recurring tests that include My Drive, Shared drives, and business-critical linked content.
Rank findings by data exposure and continuity impact
Treat public exposure, unknown external ownership, unexplained file movement, and imminent offboarding as urgent. Treat single-person ownership, missing backup evidence, and fragile automation as continuity risks. Naming and organization issues matter after the business can prove it controls the data and can recover it.
Priority 1: Exposure or loss in progress
Use this level for public sensitive files, unknown external owners, suspicious downloads or moves, deleted records without recovery, or a departing account that uniquely controls critical work. Preserve evidence and assign an owner immediately.
Priority 2: Fragile ownership and recovery
Use this level for one-person Shared drive management, important My Drive ownership, untested backups, unsupported external dependencies, and scripts or Forms tied to a person who may leave.
Priority 3: Organization and policy debt
Use this level for inconsistent names, excessive duplicate folders, undocumented exceptions, stale shortcuts, and access that should be consolidated through groups. Correct it after exposure and continuity risks are controlled.
Official product documentation and ALLMSP resources
- Set up shared drives for a Google Workspace organization. Official administrator guidance for organization-owned shared drives, membership, migration, and sharing controls, with the planning steps on this page applying it to the work needed to audit Google Drive ownership, external sharing, and stale access.
- How access works in Google shared drives. Official explanation of shared-drive roles, member and nonmember access, limited-access folders, and external sharing, with the configuration checks here applied to the controls needed to audit Google Drive ownership, external sharing, and stale access.
- Google Workspace shared-drive overview. Official guidance on team ownership, persistence after employee departure, membership, restrictions, and file organization, with the review process on this page using that guidance to help the organization audit Google Drive ownership, external sharing, and stale access.
Frequently Asked Questions
How can a business find critical files still owned in My Drive?
Review the following systems and records: Drive search, department interviews, Admin console reporting, and user account review. List important contracts, client folders, reports, Forms, scripts, templates, and operating records owned by individuals. Record the owner status, manager, collaborators, sensitivity, and whether the item belongs in a Shared drive. If evidence is incomplete or a control fails, move or transfer durable content through a controlled test. Keep personal drafts in My Drive only when a documented business rule supports that choice. Retest and document closure.
How many Managers should a critical Shared drive have?
Review the following systems and records: Each Shared drive > Manage members and Admin console Shared drive management. Record every Manager, whether access is direct or through a group, the person's current role, last review, and whether at least two authorized internal managers exist for a critical drive. If evidence is incomplete or a control fails, remove stale managers after a replacement has been tested. Use groups for durable team membership and keep management authority narrower than editing authority. Retest and document closure.
What should be checked when reviewing Shared drive member roles?
Review the following systems and records: Shared drive member list and representative file and folder permissions. Compare Manager, Content manager, Contributor, Commenter, and Viewer assignments with current duties. Identify direct access that duplicates a group or gives deletion and movement rights unnecessarily. If evidence is incomplete or a control fails, downgrade excessive roles, consolidate membership through approved groups, and retest required work before removing direct access. Retest and document closure.
How can administrators find Google Drive files shared outside the company?
Review the following systems and records: Drive log events, Security investigation tool when licensed, file sharing panels, and Shared drive restrictions. Filter for externally shared content and record the item owner, outside domain, access level, last activity, business reason, link setting, and expiration where supported. Include Groups that allow external members. If evidence is incomplete or a control fails, remove access that has no current owner, narrow access to the required file or folder, set expiration where appropriate, and confirm the client or vendor still completes the intended task. Retest and document closure.
Why is transferring Drive files not enough during offboarding?
Review the following systems and records: Admin console > Directory > Users, Shared drive membership, Groups, and directly shared content. List suspended, archived, inactive, departed, renamed, and service accounts that own content or retain access. Record whether My Drive data was transferred and whether Shared drive memberships were removed separately. If evidence is incomplete or a control fails, complete data transfer and access removal through the offboarding process. Validate manager access and automation before deleting accounts or revoking credentials. Retest and document closure.
What should be done when an agency owns a critical Google Drive file?
Review the following systems and records: File details, sharing panels, Drive search, partner records, and external Shared drives. Identify critical items owned by personal Gmail accounts, agencies, clients, former employees, or another Workspace domain. Record what the business can export, copy, transfer, or recreate and which workflows depend on the external owner. If evidence is incomplete or a control fails, create a company-controlled copy or migration plan with permission from the business owner. Test links and automation before retiring the externally owned original. Retest and document closure.
How should limited-access folders in Shared drives be reviewed?
Review the following systems and records: Shared drive folder access settings and member list. Record folders with limited access, nonmember shares, direct user exceptions, and the reason inherited drive membership is not sufficient. Confirm Managers understand who can still access the parent drive. If evidence is incomplete or a control fails, keep exceptions only where the sensitivity and workflow justify them. Name owners, use clear folder boundaries, and retest after membership changes. Retest and document closure.
Which Drive log events can reveal files leaving the organization?
Review the following systems and records: Drive log events and investigation results for move, copy, download, and ownership events. Review files moved into external Shared drives, copied out of the organization, downloaded in volume, or transferred between domains. Capture actor, item, source, destination, timestamp, and approved business reason. If evidence is incomplete or a control fails, escalate unexplained external movement, preserve logs, restrict access, and coordinate with security and business leadership before altering evidence or deleting accounts. Retest and document closure.
How can a Drive review avoid breaking Forms and automated reports?
Review the following systems and records: Forms, Apps Script triggers, Sites, Looker Studio, embedded files, shortcuts, and third-party applications. List reviewed files that collect responses, run automation, feed dashboards, publish web content, or authenticate an integration. Record the owner and service account or user context for each dependency. If evidence is incomplete or a control fails, move ownership or redesign the workflow so it does not depend on a departing person. Test with a real submission or refresh before changing the original permission. Retest and document closure.
What recovery evidence should a Google Drive access review include?
Review the following systems and records: Drive trash, Shared drive trash, Admin console restore options, retention tools, and third-party backup reports. Record available restore windows, who can restore content, covered users and Shared drives, recent failed jobs, legal holds, and the result of representative file restores. If evidence is incomplete or a control fails, close coverage gaps, assign restore authority, and schedule recurring tests that include My Drive, Shared drives, and business-critical linked content. Retest and document closure.
