Quarterly Account Hygiene Review for Operators

Most business account problems do not arrive suddenly. They accumulate quietly: a contractor who left six months ago still has access, a second factor tied to a phone nobody uses any more, a payment method on file that expired last quarter, a record that says one person owns an account while the team all believes it belongs to someone else. None of these is a crisis on its own. Together, over a year of nobody looking, they become one. A quarterly review exists to catch drift while it is still cheap to fix.

Quarterly is the right rhythm for most operators because it matches how businesses actually change. People join and leave, roles shift, new accounts get opened for new functions, and old ones stop being used. A yearly review finds a year of drift at once and turns into a project. A monthly review is too frequent to sustain and starts getting skipped. Every three months is short enough that the changes are still fresh in memory and long enough that the review feels worth doing.

The review also protects the business when something goes wrong later. If an account is ever compromised, or if a dispute arises about who authorised a payment, the first question is always what the records show and who had access at the time. A business that reviews its accounts every quarter can answer that question from its own notes. A business that does not is left reconstructing history from memory, which is exactly when the expensive mistakes happen.

The first step of every review is the access list: a simple record of every business account, who can sign in to it, and what level of access each person holds. If you do not already have such a list, building one is the first review, and it is the most valuable thing the review will produce. Go account by account, through email, exchanges, payment processors, and any shared tools, and write down every person with credentials, every shared login, and every administrator.

Once the list exists, the review is a matter of checking it against reality. Has anyone left the team since the last review? Has anyone changed roles and no longer needs the access they were given? Is there a shared login that three people use because nobody set up individual accounts? Each yes is a small job: remove the departed person, downgrade the changed role, split the shared login into named accounts. The bookkeeping guide on the /blog index explains why named, individual access matters for records as well as security.

Pay special attention to the accounts with the most power. Administrator access, the ability to move funds, and the ability to change security settings should belong to as few people as the business can manage, and those people should be named in the record. If two people hold the keys to everything and both are on holiday at the same time, that is a continuity problem the review should surface. The access control guide on the /blog index covers how to think about who should hold which keys.

Access is not only about who has a password. It is also about which devices and applications are currently signed in. Most services let you see active sessions, and the review should include a pass through them. A session on a laptop that was sold, a phone that was replaced, or a browser on a shared computer is access that should have ended and did not. Sign those sessions out and make a note of it.

Connected applications deserve the same attention. Over time, accounts accumulate connections to tools, integrations, and third-party services that were tried once and forgotten. Each connection is a door into the account, and the review should ask whether every connection still serves a purpose. Revoke anything the business no longer uses, and check that the ones that remain are still needed by the people who set them up.

This is also the moment to look at notification settings. If security alerts go to an email address nobody checks, or to a person who left, the business will not hear about the next problem in time. Confirm that login alerts, withdrawal notifications, and password-change notices reach someone who is actually watching, and that there is a backup contact if that person is away.

A hygiene review is not only a security exercise. It is also a records exercise, and the two go together. For each account, check that the ownership record is current: the legal owner, the named administrator, the deputy who can act if the administrator is unavailable, and the email address and phone number on file. The handover playbook on the /blog index explains why these details matter most at the moment someone leaves, which is exactly when nobody has time to fix them.

Check the payment details on file as well. Cards expire, bank details change, and billing addresses move. A payment method that fails at the wrong moment can lock an account or interrupt a service the business depends on. The review should confirm that every account has a working payment method and that the business knows which card or account is attached to which service, so a surprise charge can be traced to its source.

Then check the bookkeeping side. Are transactions for the quarter recorded, reconciled, and filed where the business can find them? Are the records for each account kept separate from personal activity, as the guide on separating personal and business crypto activity on the /blog index recommends? A review that finds clean, separated records is a review that has done its job, and a review that finds a mess has found it early enough to fix.

Every review should include a check of the credentials themselves. Are passwords unique to each account, stored in the business password manager, and known to the right people? Is any password shared in a chat message, a spreadsheet, or a sticky note, where it should instead live in the vault? If a password has not changed since a team member left, change it now, and change it again whenever access changes in future.

Second factors need the same check. Confirm that each important account has a second factor enabled, that the authenticator or security key is in the hands of the right person, and that the recovery codes are stored somewhere the business can actually reach them. A second factor tied to a phone number that belongs to a former employee is not protection, it is a lockout waiting to happen. The guide to hardware keys on the /blog index is a useful reference when the review finds accounts that still rely on text-message codes alone.

Finally, check the recovery paths: the backup email, the recovery phone number, the security questions, and the support contact for each service. These are the details that decide whether a locked-out account is recovered in an hour or in a week. If any of them points at a person who has left, an address nobody monitors, or a number nobody answers, update it during the review, not after the lockout.

Every business accumulates accounts it no longer uses: a trial account from a tool that was never adopted, an exchange account opened for a project that ended, a social account for a campaign that finished. Dormant accounts are easy to forget and easy to attack, because nobody is watching them, nobody updates their passwords, and nobody notices if they are compromised. The review should list them and decide, account by account, whether to close them or to bring them back under the same hygiene as the active ones.

Closing an account is not always the right answer. Some accounts hold balances, records, or history the business needs to keep, and closing them would destroy that. In those cases the review should record the decision, make sure the credentials are in the vault, confirm the second factor works, and set a reminder to check the account again next quarter. What the review must not do is leave an account in limbo, unlisted and unwatched.

The same logic applies to the people side. If a contractor or agency had access for a project that ended, confirm that their access is actually gone, not just assumed gone. A quick check during the review is far cheaper than discovering the access was still live after an incident. The business continuity guide on the /blog index covers what happens when account holders leave, and the same preparation applies to anyone who held access, however briefly.

A checklist that nobody has tested is a hope, not a plan. Once a year, and ideally once a quarter for the most important accounts, the review should include a small live test: pick one account, sign out everywhere, and sign back in using only the recovery path the records describe. If the recovery codes are where the record says they are, and the backup email is reachable, the test takes ten minutes. If they are not, the test has just found the problem before a real lockout did.

The test should also cover the people, not just the systems. Does the deputy named in the records actually know they are the deputy, and do they know how to reach the vault? Does the person who holds the second factor know what to do if the primary administrator is unreachable? A plan that exists only in a document nobody has read is not a plan, and the quarterly review is the moment to check that the people involved have actually read it.

Keep the test small and safe. Do not test recovery on an account that holds funds in motion, and do not change a working second factor just to prove a point. The aim is confidence that the recorded recovery path works, not a disruption to the business. A short note in the review record, saying what was tested and what happened, is enough, and it becomes the evidence that the plan is real.

The last step of the review is to make the next one easier. Write down what was checked, what was changed, and what is still outstanding, and file that note where the next review will find it. A short written record, even a single page, turns the review from an event into a routine, and it gives the next person a starting point instead of a blank page. Over four quarters, those notes become a history of the accounts that is worth more than any single review.

Put the next review on the calendar before this one ends, with a named owner and a short list of what it will cover. A review without a date and an owner is a review that will be postponed until the next incident. Give it a fixed slot, the same week every quarter, and treat it like any other business obligation, because it is one: the accounts are the business, and keeping them clean is part of running them.

A quarterly account hygiene review is not exciting work, and that is the point. It is the routine maintenance that keeps a business from discovering its problems during a crisis. An hour or two every three months, spent on access, sessions, records, credentials, dormant accounts, and a small recovery test, is a modest price for accounts that stay under control. The /buy-crypto-accounts pages on this site can help when the review concludes that a new account type is needed, and the /blog index holds the guides mentioned here for the details behind each step.

This article is educational and does not constitute financial, legal, or tax advice. Account features, security settings, and regulatory requirements vary by service and region and change over time, so always check the current guidance of the services you use and consult a qualified professional for your situation.