One of my responsibilities at work is to perform periodic user access reviews. A frustrating problem has been inconsistent to poor documentation,such as it becomes difficult to map users to roles. This poor documentation and general slipshod record keeping is making it difficult for me to properly audit whether user accounts are legitimate, and increases risk of unauthorized access to company data. Some quarters ago, there was an account where no-one knew the purpose of the account and the owner of the account has long since been termed.
Like many places,access management is centrally managed through MS Active Directory at my company. Loose IAM gives rise to related headaches such as IT in the shadows.
I have talked to my manager, but our job function is not viewed favorably for obvious reasons in the company. Audit is necessarily a adversarial activity, and one will make enemies. IA and Security departments are our most reliable allies.
What are some practical ideas to improve tracking of electronic employe identities within a smaller company?