The single most common failure
Registering a business asset under an individual employee's personal account.
Volume 11, Chapter 5
Access Controls: Passwords, Bank Access, Social Media, Domains
Digital access is easy to forget about entirely, right up until the one person who held it is unavailable.
The Golden Rule
Never register a business asset under a personal account.
Every login, token, and domain registration should be owned by the business, recorded centrally, and never kept only in one person's personal phone or memory.
Bank accessCan lock the business out of its own money.
Social media and domainCan be lost entirely if tied to a personal account.
EmailOften the recovery method for every other account.
Keep one central record
An Access Register replaces scattered memory and personal phones.
Email can cascade
Losing control of it can mean losing access to everything else.
Remove access on departure
An access review should be a standard part of every exit process.
1
Definition
Imagine a website suddenly goes offline for no obvious reason. The cause turns out to be a domain renewal notice that was sent to a former employee's personal email address, the same address the domain was registered under years ago, back when it felt like a harmless convenience. Nobody had monitored that inbox in years. The business comes within days of losing its own web address permanently, and only notices because the site happened to go dark.
Access controls
decide who can log into, change, or fully control the business's digital assets: bank accounts, social media pages, the website domain, email, and shared files. Unlike cash or physical goods, digital access is easy to forget about entirely, right up until the one person who held it is unavailable.
In One Sentence
This chapter is Volume 04, Chapter 8's access rule applied to the business's digital identity, not just its records. Every login, token, and domain registration should be owned by the business, recorded centrally, and never kept only in one person's personal phone or memory.
2
The Core Digital Assets to Control
Bank Access/Tokens
The business can be locked out of its own money if the holder is unavailable.
Social Media Accounts
A key marketing channel can be lost entirely if registered to a personal, uncontactable account.
Vol 17Website Domain
Can lapse or be held hostage by whoever registered it personally.
Often the recovery method for every other account. Losing it can cascade into losing everything else.
Shared Files/Records
The records system is only as safe as who can access or delete it.
Vol 04| Asset | The Risk If Poorly Controlled |
|---|---|
| Bank access/tokens | The business can be locked out of its own money if the holder is unavailable |
| Social media accounts | A key marketing channel (Volume 17) can be lost entirely if registered to a personal, uncontactable account |
| Website domain | The domain can lapse or be held hostage by whoever registered it personally |
| Often the recovery method for every other account, losing it can cascade into losing everything else | |
| Shared files/records | Volume 04's whole records system is only as safe as who can access or delete it |
Warning
The single most common small-business access failure: registering the domain, social media, or bank token in an individual employee's personal name or account, rather than the business's own. When that person leaves, on good terms or bad, the business can lose control of its own identity.
3
The Access Register: One Place, Not One Person's Head
Every login deserves a central, access-controlled record, not a sticky note, not one person's phone, not scattered across memory:
| Field | Why |
|---|---|
| Asset (which account/system) | Identifies what's being tracked |
| Who currently has access | Named individuals, not just "the team" |
| Registered to (business or individual)? | Flags the exact risk from Section 2's warning |
| Recovery method | How access is regained if the primary method fails |
| Last reviewed | Confirms the record is still accurate |
Ready-to-use version: Access Register Template. This register becomes one of the most critical documents in Volume 24's succession planning (planned). A business that loses access to itself can be damaged just as badly as one that loses a physical asset.
4
Example Story: The Domain That Almost Disappeared
Here's the full version of the domain story from the start of this chapter.
MANIAC MINDZ's website domain had been registered years earlier under a former employee's personal email address, convenient at the time, forgotten since. When the domain's renewal notice went to that same old, no-longer-monitored inbox, the business came within days of losing its own web address entirely, discovered only when the site briefly went offline. The domain was recovered, re-registered under a business-controlled account, and added to a proper Access Register. That is the same discipline Volume 04's records system already applied to paper, finally applied to the business's digital identity.
5
Across Industries
Nimbus Labs
Access riskAccess to the live system held by a single developer, with no recorded second person who has full access
City Kitchen
Access riskA social media page with thousands of followers registered to one employee's personal account
Bright Path Academy
Access riskStudent record system access with no reviewed list of who currently holds it
| Business | A Digital Access Risk |
|---|---|
| Nimbus Labs | Access to the live system held by a single developer, with no recorded second person who has full access |
| City Kitchen | A social media page with thousands of followers registered to one employee's personal account |
| Bright Path Academy | Student record system access with no reviewed list of who currently holds it |
6
Common Mistakes
Common Mistake #1: Registering Business Assets to a Personal Account
The single most damaging habit in this chapter, see the domain story.
Common Mistake #2: No Central Access Record
If access lives only in individual memory or personal phones, the business can't even check who currently has it, let alone remove it cleanly.
Common Mistake #3: Never Removing Access When Someone Leaves
An access review should be a standard part of every departure, see Volume 06, Chapter 8's exit process.
7
Quiz Yourself
Quiz 1
What is the single most common small-business access failure?
Registering a business asset (domain, bank token, social media) in an individual employee's personal name or account rather than the business's own.
Quiz 2
Why does email deserve special attention among digital assets?
Because it's often the recovery method for every other account, losing control of it can cascade into losing access to everything else.
8
Practice Exercise
List every digital asset your business depends on (bank access, social media, domain, email, shared files). For each, confirm using the Access Register Template: is it registered to the business, who currently has access, and is that access still appropriate?
9
Quick Summary
Quick Summary
- Access controls extend Volume 04's records access rule to the business's digital identity: bank access, social media, domains, email, shared files.
- Never register business assets under a personal account, the single most damaging, most common failure.
- A central Access Register replaces scattered memory and personal phones.
- Volume 11 complete. Next, Volume 12: Procurement applies segregation of duties specifically to the buying process.
Related Topics