An employee leaves the company and IT disables his account on his last working day. Four months later, during a licence reconciliation, someone notices that he still has an active user ID in the ERP, another one in time recording, and that his VPN access on a private laptop was never withdrawn. Nobody did anything wrong. IT disabled exactly what it knew about.
In an SME this is the normal case. Access rights management in an SME almost never fails on missing technology. It fails because access gets granted on request and withdrawn on request, and because people ask when they need something, and rarely when they no longer need it.
Access rights grow with every role, every project and every stand-in arrangement. They are rarely withdrawn, because taking something away is work while handing something out is a favour. Getting this under control in an SME does not take an identity tool. It takes one owner per important system who approves access and is allowed to say no. Swiss data protection law already demands that only people who need data for their work can reach it.
Why access rights only grow in one direction
Most access rights in an SME were never granted, they accumulated. Three moments create them, and only one of the three gets any real scrutiny.
When someone joins, IT sets the new account up by example. "Make her like the colleague in internal sales" is the fastest route to a working desk and at the same time the route by which somebody inherits rights that neither she nor her manager will ever hear about. The template colleague is usually someone who has been there a long time. A long time means plenty accumulated.
The internal move adds the second layer. New role, new rights, and the old ones stay because questions about the old job keep coming in during the first few weeks. That is well meant. Only rarely does anyone define when this transition period ends, so it mostly does not end. The internal move is the least visible gap in access rights management, because it leaves no trace. At least somebody looks when a person leaves.
And when a person leaves, somebody does look, but only at the systems IT knows about. The marketing tool the department subscribed to itself, and the authorisation in the banking portal: both granted, neither inventoried.
Behind this sits a lopsided incentive. Adding a right takes two minutes and makes somebody able to work. Removing a right can block a process tomorrow, and the call then goes to the person who removed it. As long as that holds, the sum of rights grows in most companies, regardless of tools and policies. That is the unglamorous constraint behind the topic, and it is an organisational one.
Who decides who may access which data?
Not IT. IT implements and should not have to decide. The decision belongs to whoever owns the business process behind the data: finance for payroll and receivables data, sales for the CRM, production for manufacturing and master data. Where you do not settle this, IT has decided by default, and IT does not know the business consequences of an access right.
The reason is practical. Only the business owner can judge whether a salesperson should see margins or only prices, whether an assistant needs every personnel file or only those of her department. IT can judge whether that is technically feasible. Two different questions, and only one of them decides risk.
This split has a second effect that matters more day to day than the theory behind it. It puts the uncomfortable no where it can be defended. When IT refuses a department head an access right, that is an obstruction. When finance refuses the same department head access to payroll data, that is a decision. The same answer, two completely different conversations.
Which data sets need this treatment at all is the same question as in data classification in an SME: rarely all of them, and usually five to fifteen.
What Swiss data protection law already says about this
Access rights management sounds like a voluntary maturity exercise. For personal data it is an obligation. The Swiss Data Protection Ordinance (DSV, SR 235.11) requires in Article 3 paragraph 1 letter a measures ensuring that "authorised persons only have access to the personal data they need to perform their tasks". The ordinance calls this access control.
Which means, in plain terms: what security slide decks have called least privilege for years has been ordinance text in Switzerland since September 2023. The same ordinance adds traceability, the requirement to be able to check which data was entered or changed, when, and by which person. Neither depends on a certification nor on company size.
Honestly, no authority in a Swiss SME is likely ever to inspect your role matrix. The relevance sits elsewhere. When something happens, the reach of the affected account decides the damage, and afterwards it decides the question of whether the measures taken were appropriate. And long before any authority, your first large customer asks in a security questionnaire whether you review access rights regularly.
The reflex at this point is a tool. An identity governance system automates request routes, documents approvals and tracks reviews. What it does not do is clean up. It administers the existing state faster and at a higher cost. More protection comes first from fewer rights, and removing rights costs no licence. More protection. Fewer tools. Lower cost.
How often do access rights have to be reviewed?
Twice a year for the systems that carry money, personal data or production, once a year for the rest. The frequency is the least important decision here. What matters more is that the result lands with somebody who is allowed to say no, and that something follows from the list.
A review that produces a list and nothing else is worse than none. It creates documented knowledge about rights that somebody identified as unnecessary and left in place anyway. In a customer audit that is the more awkward position, compared with an honest "we do not review this systematically yet".
A review also only catches what the process ahead of it lets through. When joining, moving and leaving have clean triggers at your company, the review finds little. When they do not, it finds the same thing every time, in growing quantity. Introduce only the review and you have automated the symptom list.
Where unused rights cost money
Unused access rights sit in two budget lines, and in both of them they sit invisibly. The first is the licence. ERP systems, industry solutions and part of the cloud services are billed by vendors per named user, not per concurrent use. An account belonging to a person who left the company a year ago keeps getting invoiced reliably. The same goes for add-on modules that IT once enabled for a project. Nobody has cancelled them, because nobody is looking for them.
The second line is the more unpleasant one, because it only falls due in an emergency. The reach of a compromised account decides whether an incident is an annoyance or a business interruption. An account that reaches three file shares and one mailbox costs a day of cleaning up. An account that has collected rights over the years and therefore sits half in accounting and half in production costs negotiations with the insurer. That is the real bill behind this topic, and it is rarely drawn up, because it only becomes visible in hindsight.
Both items respond to the same measure, and that measure is free. Take away what nobody uses. This is why we start with the rights in a mandate, before anyone talks about procurement.
What this looks like in a company with 190 employees
A building technology group with four sites, grown through two acquisitions. The IT team is two people and does good work. The trigger was not an incident but a security questionnaire from a general contractor, with the question about regular reviews of access rights. The honest answer was no.
Taking stock, we found considerably more active accounts than employees, spread across three ERP tenants and two directory services dating from before the acquisitions. What made management sit up was something else though. Through a nested group membership, the payroll accounting folder was readable for a large part of the administration. Nobody had granted that. It was the result of two reorganisations and one migration.
What happened next was unspectacular. Six systems got a named owner from the business side. Finance reduced access to payroll and personnel data to a handful of people. HR now triggers the leaver process itself instead of calling IT. And ERP licences were freed up, because some of the accounts belonged to people who were no longer with the company.
In the end it was not the risk assessment that had an effect in the management team, it was the licence line. That is neither cynical nor wrong, it only says something about the currency in which security topics arrive in a management team.
What this means for security leadership
Access rights management is a good test of whether security at your company is led or merely operated. It is operated when IT processes requests and disables accounts. It is led when somebody has decided who may approve, who answers for which data set, and what happens when a review finds something.
These decisions are neither expensive nor technical. What they need is somebody who takes them and then defends them against the friction of the first few months. That friction is exactly why the topic has been sitting on the list in many SMEs for years. The tool is not what is missing, the ownership is.
The same pattern shows up when a customer security questionnaire arrives. The questions are answerable as soon as it is clear who is allowed to answer.
Frequently asked questions
Do we need a dedicated tool for access rights management?
Between 50 and 500 employees, usually not as the first step. A tool pays off when many systems and many joiners per month come together. Where ownership is unclear, it only moves the problem into an interface. Buy the tool first and you document the current state cleanly without improving it.
What about administrator and service accounts?
These are the accounts with the greatest reach and the rarest review. Two things count here more than any policy: that administrative rights do not sit on the daily working account, and that business-critical access requires more than a password. In its baseline protection measures for companies, the Swiss National Cyber Security Centre BACS recommends multi-factor authentication for all business-critical access.
How long does it take to get access rights under control?
The first pass over the most important systems is a matter of weeks. It only holds up once joining, moving and leaving have clean triggers, and that takes HR and the business units, not just IT. After that the ongoing effort is small, in our experience considerably smaller than the one-off clean-up.
If it is unclear at your company whether the approval or the withdrawal is the real problem, one conversation narrows that down quickly. What a mandate covers in terms of exactly these decisions, and what it costs, is set out under packages and pricing.