Users should be asked to review a set of rules and regulations for system access. When user accounts are no longer required, the supervisor should inform the application manager and IRM office so that accounts can be removed in a timely manner. One useful secondary check is to work with the local organization's personnel officer to establish a procedure for routinely notifying the systems office of employee departures. Access and privilege administration is a continuing process. New users are added while old users are deleted.
Permissions change, sometimes permanently, sometimes temporarily.
New applications are added, upgraded, and removed. Tracking this information ensures that the principle of least privilege is maintained. In administering these accounts, managers must balance timeliness of service and record keeping. While sound record keeping practices are necessary, delays in processing change requests may lead to requests for more access than is necessary to avoid delays should such access ever be required. Managing the process of user access is one that is often decentralized, particularly for larger systems.