An employee spends three years in accounts payable, then moves into a supervisor role in operations. Nobody ever revokes her ability to approve vendor payments. Two years later, an internal audit finds $180,000 routed to a vendor that doesn’t exist. She wasn’t hired to commit fraud. She simply never lost the access that made it possible.
This is access creep, sometimes...