The access you gave away in a minute is still working today

Somewhere in your Google or Microsoft account there is a list of every app, tool and vendor you have ever given access to your business data. Most owners have never seen it. When small business owners review this list for the first time, the reaction is almost always the same: I don't remember connecting that. A scheduling app from two summers ago still reads the owner's email. A free AI tool, tried once on a Friday afternoon, still holds permission to open every file in the company Drive. A bookkeeping add-on connected by an employee who left last spring.

The connections were all reasonable on the day they were made. Access was the price of saving time, and the time really was saved. The problem is that the access never expired when the usefulness did. It sits there quietly, month after month, and it costs money in ways most owners never trace back to that one quick click on a permissions screen.

An audit is an inventory, and inventories find money

Security people will tell you to run this audit because dormant access is a risk, and they are right. But the reason to prioritise it is more basic: the connected apps screen is the only complete list most small businesses have of what their software actually touches. It is an inventory, and inventories find money.

First, it finds subscriptions that should have died. Software is sold by the seat and billed by the month, and a tool nobody has opened since March looks exactly like a tool everybody loves when the invoice arrives. When owners work through their access list, they regularly find two or three tools still connected, still syncing and still billing that the business stopped using a year ago. Revoking access and cancelling the subscription turn out to be the same conversation, and the audit is what starts it.

Second, it finds people who no longer work for you and still hold keys. Offboarding usually covers the obvious things: the email account is closed, the laptop comes back. Third-party connections are almost never on the checklist, so an integration a contractor set up, connected to your files or your accounting package, survives their last day. Every one of those connections is a paid seat in some tools and an open door in all of them.

Third, it removes the cheapest way into your business. Attackers do not need to break down your front door when a forgotten app already holds a key. If that app is breached, or was never trustworthy to begin with, its permission to read your email or your files becomes the attacker's permission. This is why the first rule is simple: never connect an account that has a payment card attached to a low-trust app. One incident, even a small one, costs more than every subscription mentioned in this article combined.

What fifteen minutes actually looks like

This is not a project, and it does not need a consultant. It needs one coffee and the account you run the business on.

In Google Workspace, sign in to your Google Account, open Security, and find the page listing third-party apps and services with access to your account. In Microsoft 365, open your account's app permissions and the list of applications your organisation has consented to. The screens differ, but the question on both is the same, and it is not whether you recognise the name. It is what the thing can do.

Sort the list by power, not by name. Anything that can read your email or open your files deserves scrutiny, because those two permissions are the business. Anything you do not recognise goes immediately. You can always reconnect a tool that turns out to be essential, and in practice owners reconnect almost nothing they remove.

Then work in this order. First, access connected with people who have left, whether that is a former employee's app or a vendor from a finished project. Second, tools you trialled and abandoned, especially free AI tools connected during a burst of experimentation. Third, anything attached to an account that holds a payment method. As you clear each one, turn on two-factor authentication for the accounts that stay. There is little point tidying the guest list while the front door still opens with a password alone.

Owners worry they will break something. In practice the breakage rate is close to zero, because the list is self-selecting: the tools you use every day are the ones you recognise instantly. Everything else has already stopped mattering to the business. It just has not stopped costing, and it has not stopped watching.

The point of doing it quarterly

Do this once and you will save a little money and sleep a little better. Do it every quarter and the economics change, because the list never gets long again. The second audit takes five minutes. Keep a one-page checklist: the date, what you revoked, what you cancelled, who left. The next person who joins and connects a tool to do their job faster, which they should, is no longer adding to a pile nobody inspects.

Most security advice arrives as a bill: buy this, hire that, insure against the other. The access audit is the rare exception. It is the one security habit that puts money back, because a business that knows exactly who and what can reach its data is almost always a business that has stopped paying for access it no longer needs.

Sammy Cheung is the founder of Vaelolab, which publishes practical AI guides and tool comparisons for small businesses. He writes about how small teams adopt new tools without losing control of their data and their budget.