Authentication and Permission Audits
A point-in-time check of every account across your systems and what each one can actually do, compared against what that job needs. GullySystem reviews what you already have and hands you a list to act on.
What an Authentication and Permission Audit Checks
This audit does not build anything new; it examines your existing accounts, roles and login policies as they stand today, and produces a list of exactly which accounts, roles and settings should change. Where a business wants the underlying access system rebuilt rather than reviewed, that is separate work.
What Usually Turns Up in an Audit
- An intern's account still carries full administrator rights, granted years ago and never narrowed
- Two staff members share one login because a second seat was never purchased
- The one account that can see everything in the business has no multi-factor authentication turned on
- Nobody can currently produce an up-to-date list of who has access to what across your systems
Roles, Passwords and Sessions: What Gets Compared
Account Inventory
Every user, admin and integration account across your systems, listed in one place.
Role-to-Access Match
What each account can actually do, compared against what that person's job requires.
Password and MFA Policy
Whether password rules and multi-factor authentication are actually enforced, not just written down.
Session and Ex-Staff Cleanup
How long sessions stay open, and whether accounts belonging to people or vendors who left are still active.
What You Get at the End
A list of accounts to remove, roles to narrow, and policies to switch on, ordered by what carries the most risk. Where accounts or access are deliberately kept broader than the audit recommends, that decision is written down along with the reason, so it is a record rather than an oversight.
When to Run This Audit
- Ahead of a customer or partner security questionnaire
- After a reorganisation, merger, or a round of hiring and departures
- As routine housekeeping on a schedule your business sets for itself
- Before deciding whether a full identity and access management setup is worth the investment
Frequently asked questions
How is this different from setting up identity and access management?
This audit reviews the accounts and permissions you already have and tells you what to fix. Setting up identity and access management is building or restructuring the underlying system — roles, sign-on, the process for joiners and leavers — which is separate, larger work an audit can lead into if you choose.
What drives the cost of an audit?
The number of systems and accounts to review, and how many of them use separate, disconnected logins rather than a shared identity system. A business with one central login system is faster to audit than one with a dozen standalone tools.
What determines how long an audit takes?
How quickly a current account list, or admin access to pull one, is made available for each system in scope. Businesses with no existing account list take longer, since compiling one is part of the audit itself.
Does this cover third-party and vendor accounts too?
Yes. Integration accounts, vendor logins and any access given to contractors are included in the inventory, since these are commonly the accounts nobody remembers to switch off.
Who owns the resulting list and any changes made?
You do. The account inventory and recommendations belong to your business, and any account removals or policy changes made during the engagement are carried out in your own systems using access you control.
What access do you need to run the audit?
Admin-level access, or a current export of accounts and roles, for each system in scope, and a person who can confirm what each job in your business actually needs to access.
Tell us what you need.
Send a short brief and one of our engineers will come back to you — usually the same day.
- No obligation
- We reply the same working day
- Your details stay private