Review workspace members, roles, shared resources, and external services against the work people do today. Use this checklist to record decisions, preserve business continuity, and verify changes in the system that controls access.
On this page
A contractor finishes an assignment. A colleague moves from operations to sales. Someone receives temporary administrator access to solve a problem. The work changes quickly; the access can remain long after the reason for it has disappeared.
A workspace access review gives the team a deliberate moment to compare today's responsibilities with today's permissions. Its output is a short list of justified access decisions, named owners, and verified changes. A small team can start with its most important workspace and the services connected to that work.
The checklist below is an operating practice. Adapt its frequency and evidence to your business's sensitivity, agreements, and security requirements.
Review an app connection against its purpose, permissions, data direction, mapping, owner, and observed result. Distinguish saved configuration from verified data movement.
·6 min read
Security & Trust
Define the boundary and name the reviewer
Choose the workspace, the review date, and the person authorized to coordinate it. Ask the owners of sensitive business areas to confirm who needs their information. One coordinator can collect decisions; permission changes still belong to the administrator authorized for each system.
Include external contractors and temporary assignments. Add important services outside the workspace, such as a document drive, customer support inbox, or scheduling account. A review restricted to one member list can miss resources whose sharing settings are managed elsewhere.
Set a workable cadence. A quarterly review may suit a stable team; frequent contractors or sensitive information may justify more frequent checks. Treat a departure, role change, or project ending as a separate trigger rather than waiting for the next scheduled review.
Record what the review covers and what remains outside its scope. That prevents a completed workspace review from being mistaken for a company-wide security assessment.
Reconcile members and outstanding invitations
Compare the current member roster with the people who should work in that workspace. Confirm each person's identity, business relationship, responsible manager, and current assignment. Names alone can be ambiguous; use the account identifier shown by the service.
Review outstanding invitations as well as active members. Check the intended recipient, requested access, business sponsor, and whether the invitation is still needed. A pending invitation is a future access path, even when the recipient has not accepted it.
For former staff or completed contractor assignments, find the relevant departure or handoff record. Confirm the administrator has handled access in each affected system. Avoid assuming that a completed personnel task proves the external accounts have changed.
Keep employee details, credentials, and recovery information in their approved locations. The review register needs a reference and a decision, not a copy of private personnel records or authentication secrets.
Match permissions to current responsibilities
Ask a practical question for every broad permission: what current work requires this access? Distinguish viewing information, editing records, exporting data, and managing settings or members. Those activities can carry different consequences.
Review access within each business area, alongside the workspace role. A person who coordinates projects may have no reason to administer finance or view sensitive employee information. Conversely, a restricted workspace role does not tell the whole story if specific resources are shared separately.
NIST's Small Business Quick-Start Guide recommends understanding employees' information access, limiting sensitive information to those who need it for their jobs, and removing access when it is no longer needed. Use that principle to challenge historical grants without making the review a test of trust in the person.
Ask for a current business reason and an accountable owner. If the reason is a temporary assignment, record the end date or next review point. An uncertain answer should become an investigation with a due date.
Check shared resources and external services
Walk through the resources that hold important business information. The system controlling each resource is the place to inspect and verify its access.
Scrollable article table
Review area
Questions to answer
Useful evidence
Workspace members
Who belongs here, and who can manage access?
Current roster and role view
Business areas
Who needs sensitive records or administrative actions?
Current permissions and owner's decision
Shared files and folders
Which people or links can reach these resources?
Sharing view from the file service
External accounts
Do contractors or former staff retain separate accounts?
Provider's current account or group view
Integrations
Who owns the connection and what can it access?
Current installation settings and service owner
Review links shared for an old project, external collaborators, and accounts that have no clear owner. For integrations, confirm the business purpose and the administrator responsible for maintenance. Removing a person's membership can leave a separately authorized connection in place; inspect that connection directly.
Record a decision and protect continuity
Use a small decision register rather than collecting screenshots without conclusions.
Scrollable article table
Decision
Required record
Retain
Current business reason and approving owner
Narrow
Required access, authorized administrator, and verification date
End access
Reason, handoff dependencies, administrator, and verification result
Investigate
Unresolved question, owner, and due date
Before changing broad administrative access, confirm who will manage the workspace, billing, integrations, and shared resources afterward. Transfer necessary responsibilities through the relevant supported workflow. Preserve required business records and agreed retention obligations.
Have the authorized administrator make the approved change. Then inspect the resulting state in the controlling system. Record an incomplete change as incomplete, even if a task has been marked done or a request has been sent.
A hypothetical review after a contractor's project
Consider a hypothetical eight-person design studio. A contractor finished a client project last month. The studio's reviewer finds three separate entries: an active workspace membership, a shared project folder, and a guest account in a scheduling service.
The project owner confirms that deliverables have been handed over and no support assignment remains. The workspace administrator handles the membership change. The folder owner checks its sharing settings and preserves the agreed deliverables. The scheduling administrator reviews the guest account separately.
The reviewer records three outcomes with three verification references. The review stays open until all three are resolved. If the contractor needs limited support access for another week, that exception receives a named sponsor, a defined purpose, and a review date.
This example is illustrative; it describes a review process, not a customer result or an automatic Figena workflow.
Run the review with a reusable checklist
Use these questions to finish each review:
Has an authorized reviewer confirmed the scope and date?
Does every member have a current business relationship and sponsor?
Are outstanding invitations still intended and necessary?
Can the relevant owner explain each administrative or sensitive permission?
Have shared files, links, external accounts, and integrations been checked?
Do temporary exceptions have an owner and a review date?
Are handoffs and administrative continuity resolved before access changes?
Has the resulting access been verified in each controlling system?
Does every unresolved item have an owner and a due date?
Store the register in an approved location with appropriate access. Keep evidence concise: the account or resource reference, decision, responsible person, completion date, and verification reference. Follow the organization's retention policy instead of keeping sensitive evidence indefinitely.
Keep workspace and provider decisions connected
Figena separates workspace membership and roles from permissions in business areas. Authorized administrators can review available member and role information and use the supported management controls. The exact controls visible depend on the workspace configuration and the administrator's authority.
Figena's access and security overview explains the workspace and role boundaries behind these workflows. Use the review register to connect those decisions with the external services your team uses. A change inside Figena does not establish that an independent provider account, shared link, or previously exported copy has been removed.
For a person leaving or changing responsibilities, pair this review with an employee work handoff. Keep both records accurate: one tracks who takes over the work; the other tracks which access has been reviewed and verified.
Prepare for a lost device with approved backup authentication, a known recovery route, clear business coverage, and checks after access is restored. Use a practical recovery plan.
Check the purpose, content, version, recipient, and delivery method before sharing a business record. Use a practical checklist for internal and external handoffs.
