The Unclaimed Key: A Year-End Review of Dormant Accounts in UK Firms

Account hygiene is frequently filed under IT housekeeping. In a UK professional firm, that classification is too narrow. A dormant mailbox, an orphaned login or a shared account with no named owner is an access-control weakness with a confidentiality dimension. Clients entrust firms with sensitive information on the understanding that access is deliberate, documented and withdrawn when no longer needed. As 2026 draws to a close, a structured review of dormant accounts is therefore a governance exercise, not merely a technical one.

Why an account review belongs with confidentiality

Confidentiality obligations do not pause because an account has fallen out of use. A mailbox that still receives client correspondence, a document system login retained after a departure, or a third-party portal account created for a completed matter can all preserve access long after the business reason has gone. Under the UK GDPR, firms must also be able to demonstrate accountability for the measures they take to protect personal data. Professional regulators and client terms may add further expectations around access control and record keeping.

The practical risk is rarely a dramatic breach. It is usually quieter: an ex-colleague who can still open a shared folder, a contractor whose portal access was never removed, or a generic team login whose password is known to several people. A year-end review creates the opportunity to find these exceptions before they become an incident, an audit finding or a client complaint.

Defining the accounts in scope

A useful review starts with clear categories. Dormant accounts are those with no legitimate activity for a defined period, but which remain enabled. Orphaned accounts are those without a current, identifiable business owner. Shared accounts are those used by more than one person without individual attribution. Third-party accounts belong to contractors, consultants, referrers or client personnel. Service accounts support systems rather than people and should be governed separately.

Firms should avoid a single blanket definition of dormancy. A partner's mailbox may be quiet for a month during a long matter; a reception inbox may be active daily. The review should instead set a threshold by account type, record that threshold in the audit register and apply it consistently. The aim is not to close every quiet account, but to ensure every retained account has a named owner and a stated purpose.

A four-stage year-end routine

1. Reconcile the identity inventory. Begin with the HR or engagement list of current partners, employees and contractors. Reconcile it against the directories that grant access: email, practice management, document management, finance systems, cloud storage, remote access and client or regulator portals. The reconciliation will rarely be perfect, which is precisely why it is useful. Record every mismatch rather than resolving it informally in an inbox.

2. Test status and ownership. For each account, confirm the holder's current status and the business owner of the account. Leavers should already have been processed, but year-end is the moment to test whether the joiner-leaver process actually worked. Long-term absentees, retired partners, alumni accounts and contractors need explicit decisions. Shared mailboxes should have a named accountable owner, not merely a team name. Third-party portal users should be matched to a live engagement or contract.

3. Apply decision rules. Classify each account as active, dormant, orphaned, shared, third-party or service. Then apply a documented decision: retain with owner and review date, transfer to a named successor, disable pending archive, archive content in line with the retention schedule, or delete. Decisions should be made by the business owner, not delegated silently to IT. Where a mailbox or folder may contain client records, the retention decision should follow the firm's records policy rather than convenience.

4. Close the loop with evidence. Each decision should generate an audit trail: the account identifier, system, holder, account type, last activity date, business owner, decision, date of action and evidence reference. The evidence may be a ticket number, a signed checklist or a register entry. The key point is that the firm can show who decided, on what basis and when the action was completed. A register held in a shared spreadsheet is acceptable if access to it is controlled and changes are logged.

The audit register in practice

A workable register need not be elaborate. It should capture the account name or identifier, the system, the individual or team associated with it, the account category, the last confirmed activity date, the accountable business owner, the decision taken, the confidentiality risk rating and the completion date. Exceptions should be flagged with a reason and a review date. A short management summary should accompany the register, showing the number of accounts reviewed, closed, retained with conditions and still outstanding.

A review cadence that holds

The year-end review should sit within a wider rhythm. Joiner and leaver checks belong in the monthly operational cycle. Shared and privileged accounts warrant a quarterly check. Third-party access should be reviewed whenever a contract ends or an engagement closes, with a consolidated review at least annually. The year-end exercise then becomes the full reconciliation and assurance step rather than the only time anyone looks. Firms should also trigger a review after a reorganisation, a merger or a security incident.

Common traps and reporting

Three traps recur. The first is treating a shared mailbox as a permanent record with no owner. The second is retaining an ex-employee account 'just in case' without a documented decision and review date. The third is overlooking portal and third-party accounts because they sit outside the main IT directory. Reporting should therefore cover all systems, not only email, and should distinguish between accounts closed and accounts merely disabled.

A year-end account review is a modest routine with a disproportionate assurance value. It confirms that access remains connected to a current purpose, that client confidentiality is not resting on forgotten credentials and that the firm can evidence its decisions. In 2026, with clients and regulators alike asking sharper questions about data handling, that evidence is worth having.