The Unclaimed Master Key: Putting Administrator Access on the UK SME Risk Register

Most businesses can name the person who approves invoices. Far fewer can name the person who holds global administrator rights to the finance system, the domain registrar, the website, the payroll platform and the managed service provider's remote monitoring console. Administrator access accumulates quietly. It is granted during a project, inherited from a predecessor, shared in a password vault, or held by a supplier whose contract was signed several years ago. The accounts remain long after the reason for them has passed.

That is not simply an IT housekeeping issue. Administrator access is a continuity asset. It determines whether the business can recover a locked account, remove a departing contractor, respond to a cyber incident or evidence control to an insurer, auditor or acquirer. When nobody owns the key, nobody can say who should have it, who used it or how it would be recovered.

Why the risk register is the right home

In UK SMEs, administrator access sits at the intersection of several obligations. UK GDPR accountability requires appropriate technical and organisational measures, and access control is part of that picture. Cyber Essentials asks organisations to control administrative privileges and manage passwords. Insurers increasingly ask similar questions in their proposal forms. Prospective buyers and lenders ask them during due diligence. None of these processes is satisfied by a spreadsheet that lists only the current IT supplier's helpdesk number.

The operational risk is just as concrete. If the only super-admin for the finance platform is on holiday, ill or has left, the business may be unable to change a payment mandate, recover a domain, close a compromised account or restore access after a failed migration. A supplier-held administrator may be convenient, but it creates dependency and blurs accountability. The aim is not to remove every administrator. It is to make administrator access visible, owned and reviewable.

Four categories of access

A useful audit separates access into four categories. Named individual access belongs to a current person, ideally with multi-factor authentication and a named deputy. Shared credentials use a generic login such as admin or operations, often with a password stored in a document or email. Orphaned access is tied to a former employee, an agency that no longer works for the business, or an identity nobody can explain. Provider-held access belongs to an external IT company, web agency, software reseller or fractional technology partner.

A fifth category should be deliberate: the break-glass account. This is an emergency administrator identity kept for recovery when normal authentication fails. It should be sealed, monitored and tested, not used for routine work. Service accounts and API tokens also deserve a place in the record, because they can carry powerful permissions without looking like a human login.

The one-hour audit

An hour is enough for a first pass. It is not enough for full remediation. Work in a small group: an operations lead, someone from finance or HR, and the person closest to the IT provider. Use a shared screen and record what you find rather than changing credentials during the session.

0–10 minutes: list the systems that matter

Start with systems that can change money, identity, data or public presence. Include the domain registrar, DNS, email, identity provider, cloud storage, finance and payroll platforms, e-commerce, website content management system, backup, remote monitoring and the password manager. Add any software that holds customer records or payment details. The list does not need to be exhaustive; it needs to cover the places where a lost key would hurt.

10–25 minutes: enumerate the highest roles

For each system, open the administrator or user list and record every account with the highest role. Include service accounts and supplier accounts where they are visible. Note the account name, the apparent person or organisation behind it, and whether multi-factor authentication appears to be enabled. If the platform shows last login, record it, but do not treat a recent login as proof of ownership.

25–40 minutes: classify and challenge

Place each account into one of the four categories: named, shared, orphaned or provider-held. Mark anything unknown as orphaned until proven otherwise. Ask a simple question for each shared or provider account: who can use this, and who would notice if it were misused? If the answer is nobody, the account belongs on the action list.

40–50 minutes: check recovery routes

For each critical system, identify the recovery email address and phone number. An administrator account is only as strong as its recovery route. If the recovery address belongs to a former employee or a supplier, record it as a gap. Check whether the break-glass account exists, where its credentials are held and whether it has been tested in the last twelve months.

50–60 minutes: assign provisional owners

Give every administrator account a named owner and a named deputy. The owner is accountable for reviewing who has access and why. The deputy provides continuity during absence. Record any action that requires the supplier, such as removing a former agency account or changing a contract clause. Book a thirty-minute follow-up within a week to close the gaps.

The ownership register

Keep the output in a simple register, not another platform. It should sit alongside the risk register and be reviewed quarterly and whenever someone joins or leaves. A workable register has columns for the system, tenant or domain, administrator role, named owner, deputy, whether the credential is shared, provider access and the relevant contract clause, multi-factor authentication status, recovery route, last review date and next review date.

The register should not contain passwords. It should contain the answer to a different question: who is responsible for this key, and how would the business recover it? That distinction keeps the document useful to operations, finance and the board without turning it into a security liability of its own.

Making it stick

Administrator access should appear on the joiner, mover and leaver checklist alongside email and payroll. Offboarding should remove access to shared accounts, not just disable a mailbox. Contracts with IT providers should require named administrators, notification when those administrators change, and a clear handover process at the end of the agreement. Break-glass credentials should be sealed, monitored and tested. Routine administration should use named accounts with multi-factor authentication, not a shared login that everyone knows and nobody owns.

The unclaimed master key is rarely the result of negligence. It is usually the residue of growth, supplier convenience and staff turnover. A one-hour audit will not solve it permanently, but it will make the invisible visible. Once every key has a name against it, the business can decide whether that is the right name — and what would happen if it were not.