A Quarterly Access Review for Executive Assistant Support
Delegated access tends to expand quietly. An executive assistant receives access to a calendar, then a document library, then a shared mailbox or project workspace. Months later, nobody can explain which permissions are still needed. A quarterly access review keeps remote executive support useful without allowing old access to become permanent by accident.
Inventory by purpose
List every system, shared folder, calendar, mailbox, and recurring report the assistant can reach. For each one, record its purpose, owner, access level, last meaningful use, and the approved alternative if access is removed. Group the list by work such as calendar coordination, inbox triage, meeting preparation, travel, or vendor follow-up.
Purpose matters because an access request can outlive the task that created it. If a project ended, the related workspace may no longer belong in the assistant’s routine. If the assistant needs only to view a document, editing permission is difficult to justify.
Check least privilege
Review whether the assistant can do more than the job requires. Viewer access may be enough for a briefing folder; comment access may be enough for a draft; administrative access may belong only to a system owner. Avoid broad permissions that make the assistant responsible for information they were never expected to manage.
Test the practical experience too. A permission that looks narrow may expose an entire shared drive. A permission that looks broad may be harmless only because the folder is empty today. Record what the access actually reveals, not merely how a settings screen labels it.
Review people and devices
Confirm that every account belongs to the right person and uses the approved identity. Remove dormant accounts, old guest invitations, and duplicate access routes according to the organization’s process. Check whether work is occurring on approved devices and whether sensitive downloads are being retained locally.
Remote support introduces handoff risk. If coverage changes across time zones or during leave, document the backup path and its limits. Do not share credentials as a shortcut. Use the system’s delegated access or a named backup account wherever available.
Reconcile work with access
Compare actual recurring tasks to the permission inventory. If an assistant has not needed a system for a quarter, ask whether the access should remain. If a new responsibility has been added, request the smallest permission that allows it and define an expiry or review date when appropriate.
The assistant can prepare the inventory and flag anomalies, but the system owner or executive should approve changes. This preserves accountability and makes it clear that support work does not include silently changing security policy.
Handle sensitive repositories carefully
Personnel, legal, financial, and security material should receive a separate review. Confirm that links are not being copied into broad meeting notes and that notification settings do not disclose confidential titles. If a document must be shared for preparation, share the least necessary version with the intended recipients.
Use neutral names in a visible calendar when privacy requires it. Keep the detailed explanation in the approved restricted system, and make the retention expectation clear. A secure process should still let the assistant prepare the executive efficiently.
Record decisions and exceptions
For every change, capture who approved it, what changed, why, and when it should be reviewed again. An exception may be reasonable during a time-sensitive project, but it should have an owner and an end date. Unrecorded exceptions become the next quarter’s unexplained risk.
If a permission cannot be reduced because a system lacks granularity, record the limitation and the compensating practice. That might be a restricted folder, a separate account, or a manual review. The goal is informed risk, not a fictional claim that the system is more precise than it is.
Make the review routine
Put the review on the calendar with a short agenda. Start with new responsibilities, then dormant access, sensitive repositories, backup coverage, and pending exceptions. End with a list of owners and due dates. The assistant should leave with clear instructions rather than a vague reminder to “be careful.”
A quarterly access review protects both sides of the relationship. The executive knows where delegated authority exists, the assistant can work confidently inside a defined boundary, and the organization has a current record when responsibilities change.
FAQ
Can the assistant remove their own access? Follow the organization’s process; changes should normally be approved by the system owner.
What if the inventory is incomplete? Mark the gap, identify the owner, and treat unknown access as a review item rather than assuming it is safe.
Include a simple joiner, mover, and leaver check in the quarterly conversation. Ask whether any colleague changed role, whether a project team was dissolved, and whether a temporary backup is still present in a shared space. These changes often create access through ordinary collaboration rather than through a formal request. The assistant can surface the names and dates, then route the technical change to the correct owner. This keeps a support review connected to real operating changes instead of treating permissions as a static inventory.
Questions for the executive
Ask whether the executive’s priorities have changed since the last review. A new board role, a team reorganization, a paused project, or a change in personal working hours can alter which access is necessary. Ask which systems the executive expects the assistant to use independently and which should always produce a notification. Then compare those answers with the technical inventory. This conversation catches a common failure mode: permissions remain broad while the working relationship has become narrower. Record the agreed boundary in plain language and connect it to the system owner’s change process.