Printable checklist · quarterly
Client Document Access Review
A quarterly check of who can reach your firm’s client documents in Microsoft 365. Complete it with whoever manages your accounts, and keep the signed copy with your other review records.
To print, use your browser’s print command (Ctrl+P, or ⌘P on a Mac).
Record findings in general terms, such as “three guest accounts with no recent activity”. Don’t write client names, account numbers or passwords on this sheet.
1Staff and former staff
People who’ve left, or moved roles, are the most common source of access that shouldn’t still exist.
Everyone who left this quarter has had sign-in blocked and their licence removed.
Staff who changed role have lost access to client areas they no longer work on.
Administrator roles are held only by named people who need them, using separate admin accounts.
No shared or generic logins are used to open client documents.
2External sharing
Links and guest accounts outlive the reason they were created.
Sharing links to client folders have an expiry date.
No client files are shared with “anyone with the link”.
Guest accounts (clients, introducers, outside advisers) have been reviewed, and unused ones removed.
Client documents aren’t being sent as email attachments when a secure link is available.
3Sensitive locations
Check where client documents actually are, not where they’re supposed to be.
Client files are in the agreed client libraries, not in personal OneDrive folders or old shared drives.
Each client library is open only to the team responsible for that client.
Client libraries carry the expected sensitivity label by default, if your firm uses labels.
Retention settings still match your firm’s current record-keeping schedule.
4Sign-in protection
Access controls only help if the sign-in in front of them is strong.
Every account, including administrators, uses multi-factor sign-in.
Sign-in alerts or risky sign-in reports from the quarter have been looked at by someone.
Emergency-access accounts exist, are stored securely, and were tested this year.
5Findings and sign-off
List every “Action” with an owner and a date. Carry anything unfinished into next quarter’s review.
| Finding | Action | Owner | Due |
|---|---|---|---|
- Reviewed by
- Signature
- Approved by
- Next review due
Client Document Access Review · Willowcrest Advisory · willowcrestadvisory.com/access-review.html. This checklist supports an internal review. It isn’t a compliance assessment or audit. How Willowcrest sets up document access