Who still has access to systems they no longer need?

Compare current user accounts and permissions with current employees, contractors, roles, and vendors. Look for former users, old projects, unused administrator rights, shared accounts, and dormant credentials. Remove or reduce access that no longer has a business reason.