Tracking this information ensures that the principle of least privilege is maintained. In administering these accounts, managers must balance timeliness of service and record keeping. While sound record keeping practices are necessary, delays in processing change requests may lead to requests for more access than is necessary to avoid delays should such access ever be required. Managing the process of user access is one that is often decentralized, particularly for larger systems. Regional offices are typically granted the authority to create accounts and change user privileges.
Proper oversight can help avoid major security risks.
Privileges are typically changed when there is a change in job role, either temporarily, such as covering for an employee on sick leave, or permanently, following an in-house transfer or termination. During the absence of others, users are often required to perform duties outside their normal scope, requiring additional access privileges. Such necessary access privileges should be granted sparingly and carefully monitored, consistent with the need to maintain separation of duties for internal control purposes. Also, these privileges should be removed in a timely manner when no longer required. Permanent changes in access privileges are usually necessary when employees change positions within an organization.