How Do I Keep Track of Who Has Access to My Business Accounts?

By Bill Stilwell · Last reviewed October 17, 2026

The short answer

An access inventory is one list of every business account, who owns it, who else can get in, what they can do, and how it’s protected. It also lists the devices, keys, and codes each person has. Keep it current, review it on a set schedule, and use it every time someone joins or leaves.

What this means

11.7.5 Access inventory

A spreadsheet works fine. One row per account. Columns can include:

Account name and website
Purpose (email, GBP, bank, payroll, and so on)
Owner email
Other users and their role (owner, admin, manager, user)
Multi-factor authentication (MFA) status and type
Recovery email and phone type (not the codes themselves)
Where the login is stored (password manager folder)
Renewal date and who pays
Date last reviewed

23.7.5 Access record for each person

Flip the list around for each employee or contractor: every account, device, key, and code they have. This becomes their offboarding checklist (see 11.7.7 Removing Access When People Leave).

23.10.2 Device assignment

Record every laptop, phone, tablet, vehicle, tool, key, fob, and alarm code given to each person, with serial numbers and the date given and returned.

Made-up example: Golden Hour Cleaning has six cleaners and one office helper. The owner’s inventory shows 22 accounts. When she reviews it, she finds that a former marketing contractor is still an owner on the company’s GBP and a manager on its Facebook page. She removes both the same day.

Why it matters

You can’t remove access you don’t know about.
Former agencies and helpers often keep access for years. On GBP, an owner can add or remove other users and even remove the profile.
Renewals get missed when no one knows which card pays for which account.
Lost devices are worse when you don’t know what was on them (see 11.9.1 Lost Device).

Who this applies to

Every business. Solo owners need it too. It’s the list someone else would need to keep things running if you couldn’t (see 11.7.8 Emergency Account Access).

How to do it

Start a spreadsheet in your business file storage, with access limited to the owner and one trusted admin.
Walk through your money first. Bank and card statements show every paid service.
Check your email for welcome and receipt messages to find free accounts.
Log in to each account and record every user and role. For GBP, look under Business Profile settings, then People and access.
Add MFA and recovery details from your earlier setup (see 11.7.3 and 11.7.4).
Add a people tab listing each person’s accounts, devices, keys, and codes.
Remove anyone who shouldn’t be there as you go.
Set a review schedule. For example, a quick check monthly and a full review each quarter (see 28.3 Quarterly Review Checklist).
Update it the same day someone joins, changes roles, or leaves.

Never put passwords or backup codes in the inventory. Those belong in the password manager.

What proof to keep

The inventory itself, with a “last reviewed” date on each row
Dated notes of each review and what you changed
Signed device and key receipts from staff
Screenshots of user lists for key accounts

Common mistakes

Listing accounts but not users. The risk is in who else can get in.
Forgetting free accounts like listings, review sites, and old social pages.
Writing passwords in the inventory.
Building it once and never updating it.
Skipping devices and physical keys.

When to get help from a pro

Information technology (IT) specialist: if you have many staff or systems, or want to automate the review. Questions to ask:

Can we pull a user list from our email and file systems automatically?
How do we track company devices and their serial numbers?
How often should we review access for a business our size?

Bill’s note

[Bill: add a short note. For example, how often you find old agencies still listed as owners on a client’s Google Business Profile, or what your own SiteSmarty access list looked like the first time you built it.]

If you’d rather have this done for you, SiteSmarty handles Google Business Profile setup and can review who has access to your profile.

How I did this for SiteSmarty

[Date I did this:]
[What I actually did, step by step: building the SiteSmarty access inventory and what I removed]
[What it cost and how long it took:]
[What surprised me or what I’d do differently:]
[Screenshot or photo to add, with private info blurred: the inventory headers and sample rows]
[Result so far:]

Questions people ask

What should an access inventory include? Every account, its owner, every user and role, MFA status, recovery setup, where the login is stored, renewal dates, and review dates.

How often should I review it? Update it the same day people come or go, and do a full review on a regular schedule, such as quarterly.

Should I track devices and keys too? Yes. List every device, key, fob, and code given to each person so you can collect them later.

Where should I keep it? In business-owned file storage with access limited to the owner and one trusted admin. Keep a printed or offline copy for emergencies.

Audit check

Line	Question	Pass looks like	Fail looks like	Evidence to collect
11.7.5 Access inventory	Is there a current list of every account, user, and role?	Inventory covers all accounts, reviewed on schedule, no unknown users	No list, or a list missing users and roles	Inventory with review dates
23.7.5 Access record	Does each person have a record of their accounts, devices, keys, and codes?	People tab complete and current	No per-person record	People tab or employee file
23.10.2 Device assignment	Is every assigned device and key recorded?	Serial numbers, dates given and returned, signatures	Devices with no record	Device log and signed receipts

Where this fits

Do this first: 11.7.4 Account Recovery Methods

Do this next: 11.7.6 Least Privilege Access

Sources

Google Business Profile Help, "Manage your Business Profile owners and managers" (checked October 17, 2026)
Cybersecurity and Infrastructure Security Agency, "CISA Releases Cyber Essentials for Small Businesses and Governments" (checked October 17, 2026)
Federal Trade Commission, "Cybersecurity for Small Business" fact sheets (checked October 17, 2026)

This page explains general rules and Bill's own experience. It is not legal, tax, or insurance advice. Talk to a qualified professional about your situation.