How Should Investment Firms Review Access to Sensitive Data?

Give business owners a clear way to approve permissions and help administrators verify that requested changes take effect.

Investment firms hold confidential research and sensitive investor information that employees need for specific assignments. As employees change teams or finish projects, they may retain access to information they no longer need. Leaders need a reliable way to identify and remove unnecessary permissions.

Consider an analyst who moves to another investment team but can still open the previous team's confidential research folder. The analyst may be trusted, but continued access creates unnecessary risk if they no longer need that information for their work.

Access reviews help investment firms confirm whether an employee's permissions still match their current assignments and fix issues when they don't. Leaders designate people to approve access to specific company assets. They also assign administrators to implement approved changes and formally confirm that those changes have taken effect.

Firms also retain records of access reviews and resulting permission changes so they can explain their decisions later. Staff can use these records during internal reviews and when responding to investor due diligence requests.

This article follows an analyst transferred between investment teams to explain how firms can organize their own access reviews. In this scenario, the research lead is responsible for the previous team's confidential research folder and decides whether the analyst should continue to have access. The administrator manages the technical permissions and verifies that approved changes take effect.

Establish who approves access before starting the review

To begin, leaders should identify an information owner for each sensitive asset they intend to review. That person should understand how employees use the sensitive asset and should have authority to approve their access. The research lead is the information owner for the confidential research folder in our scenario.

Leaders should also identify the administrator who will prepare a report of the asset’s existing permissions and carry out approved changes. An internal employee or an external IT provider can perform that work, provided the administrator has the authority and system access required.

During an access review in our scenario, the administrator directs questions to the research lead about business needs associated with the folder. The research lead may consult the analyst and the analyst’s new supervisors to better understand their new and ongoing responsibilities. The research lead should decide whether the analyst still needs access to the original research folder. The information owners responsible for any new sensitive assets should approve access to those assets.

A COO or another designated senior leader should oversee unresolved decisions. For the example in this article, the COO handles escalation when the research lead and administrator cannot resolve a problem within an agreed-upon timeline for the access review.

These responsibilities give everyone a clear point of contact. The research lead approves the business need, the administrator handles permissions, and the COO addresses overdue decisions or work.

Prepare permissions information that the research lead can use

In our scenario, the administrator should begin with a defined scope, such as the resources within the confidential research folder. Defining a single sensitive asset allows the information owner (i.e., the research lead) to evaluate access without having to interpret permissions across unrelated systems. Here are the steps administrators can take to ensure information owners can successfully proceed.

Give the reviewer a dated permissions report

The administrator should prepare a report showing who can currently access the folder and what each person can do. The research lead should be able to distinguish someone who can read documents from someone who can edit or share them.

If administrators have assigned access through one or more groups, they should identify the employees in each of those groups. A group name alone may be insufficient for the research lead to evaluate whether everyone still needs access.

The administrator should date the report and retain it with the review materials. It describes the permissions at the time of the review. After the review, the administrator should prepare updated information for future reviews.

Use a separate review record to track decisions

The research lead and administrator also need somewhere to document their work. Depending on the firm's systems, they might use a controlled spreadsheet, an access review tool, or linked service-desk tickets.

For each person reviewed, the research lead should record whether access should continue or change. After implementing approved changes, the administrator should record what changed and how they verified the result. Both the permissions report and the review record contain sensitive information and should be protected accordingly. Staff should retain the completed review according to the firm's recordkeeping policy and applicable obligations.

[The Center for Internet Security’s CIS Controls v8.1[(https://www.cisecurity.org/controls/cis-controls-navigator) recommend assigning data permissions according to a user’s need to know. Safeguard 6.8 calls for documenting the access rights required for each role and reviewing access at least annually to confirm that privileges remain authorized. These are security recommendations, not universal regulatory requirements.

Ask the research lead to make a specific decision

The research lead should compare the permissions report with each employee’s current work and decide whether to retain, limit, or remove access.

If the analyst is finishing a project for the previous team, the research lead might approve temporary access, record the assignment, and set a date for reviewing access again. Simply writing “still required” does not provide enough detail about the decision. If the analyst only needs to consult the research, read-only access may be enough. If no business need remains, the research lead should request removal, identifying the employee and folder.

When more information is needed, the research lead should contact the analyst’s manager and set a deadline for resolving the question. While the decision is pending, staff should follow a procedure established by the COO for handling access based on the information’s sensitivity.

Have the administrator apply and verify approved changes

After the research lead approves a change, the administrator should check how the analyst receives access. Removing the analyst from the research group may not be enough if they also have individual permission to open the folder. Before changing group membership, the administrator should also check whether it would remove access the analyst still needs and obtain approval for a narrower change if necessary.

The administrator should apply the approved change, verify the resulting access, and record the completion date with supporting evidence. For temporary access, configure an expiration date where the system supports it; otherwise, schedule a follow-up review with the research lead.

The same responsibilities apply when an external IT provider performs the work: the research lead approves access, and the administrator implements and verifies the decision.

Check unfinished work before closing the review

Before closing the review, the research lead should confirm that every employee in scope has received a decision. The administrator should check that all approved changes have been completed and verified. An approval alone does not show that access has changed.

Record unfinished decisions and technical changes, including who will resolve them and by when. Send overdue items to the COO with the reason for the delay and a proposed resolution date. Involve security or compliance staff as needed, especially when sensitive information remains exposed.

All team members can identify and take note of recurring problems to improve upon in the next review. Reports that aren’t clear may need revision, while permissions that are difficult to change may require work on the underlying configuration.

Revisit access when employees’ responsibilities change

The COO should establish when access reviews take place. This includes a regular review schedule, with more frequent checks for particularly sensitive information, and additional reviews when an employee changes teams or responsibilities. Staff should not wait until the next scheduled review to check permissions affected by a transfer.

For the analyst moving teams, the process should begin with a notification to the administrator. The COO should assign responsibility for sending that notice and specify when it must be sent. Potential candidates include the employee’s manager or the person coordinating the transfer.

The administrator should then identify the analyst’s existing access to the previous team’s research folder and ask the research lead whether it should continue. The research lead makes the business decision; the administrator carries out any approved changes and verifies the result.

The person coordinating the transfer should check that the access review has been initiated and follow up if it has not. This gives someone responsibility for making sure the notification leads to action.

Keep the research lead’s decision and the administrator’s completion evidence in the same review record. If staff use a separate transfer ticket, link it to that record so a later reviewer can follow the process from notification through to the verified result.

Firms developing their procedures can consult NIST SP 800-53 Revision 5, a catalog of security and privacy controls that organizations can adapt to their needs. Nongovernmental organizations may use the publication voluntarily.

Use completed reviews to answer investor questions

When an investor asks how the firm reviews access, the person preparing the response should use records that connect business decisions to verified changes.

If the analyst’s old access was removed, the response could explain the reason and how the administrator verified the removal. If supporting evidence is requested, provide an approved, appropriately redacted extract without exposing unnecessary employee information or sensitive system details.

How Option One Technologies can help

A useful access review connects a clear business decision to a verified result. Information owners decide who needs access; administrators carry out and document approved changes.

Option One Technologies can support the technical work through its managed IT and cybersecurity services, helping investment firms identify permissions, implement approved changes, and verify the results. Contact a member of our team to discuss support for your firm’s access review process.

Executive FAQs

How often should investment firms review access to sensitive data?

Investment firms should set a recurring schedule based on the information's sensitivity and applicable obligations. Leaders should also require checks when employees change responsibilities. In the example above, the administrator should refer the analyst's old research access to the research lead when the transfer occurs, even if the next scheduled review is months away.

Who should approve access during a review?

The person responsible for the information should approve the business need. For a confidential research folder, that may be the research lead. An administrator should explain the existing permissions and implement the approved decision. Leaders should assign these responsibilities before starting the review and use consistent role names in the procedure.

How can investment firms demonstrate that an access review was completed?

Staff should retain the dated permissions report and the review record. The research lead should document decisions, and the administrator should confirm any resulting changes. The person reporting completion should identify open items separately, so an investor or internal reviewer can understand which work has finished and which actions still require follow-up.