Somebody who left in March still holds access to something, and nobody is going to find it before an auditor does.

All four come from the product overview, and they make a better diagnostic than any feature list ever will. If you cannot answer them about your own business, the gap those questions expose is exactly what this product exists to close.

• Which identities should have access to which resources? Note the word should rather than do. In most businesses the answer to that lives inside the memory of whoever originally set it up, and the two lists have been drifting apart quietly for years.
• What are those identities actually doing with the access they hold? Answering that demands access be visible, attributable and reviewable, rather than dissolved into a nested group structure nobody has ever fully unpicked.
• Are there organizational controls governing how access gets managed? That means a defined process carrying an owner and a decision point, not a habit resting on one particular person continuing to remember.
• Can an auditor verify those controls are genuinely working? This is the question separating a policy from a control. A written procedure producing no evidence fails it outright, and failing it is what generates SOC 2 exceptions and audit findings.