Look beyond the document folder to the people, links and applications that can reach matter information.
Begin with the firm’s access decision
The matter owner should establish who needs information and why. A technical review can then compare that intended audience with the actual permissions. Do not infer confidentiality requirements from a folder name or assume every member of a practice group needs the same access.
Trace more than one platform
The working record may span document management, email, a client portal and approved exports. Identify the locations used for the matter and the person responsible for each. This is a map of access and ownership, not an invitation to collect unnecessary copies of confidential material.
Include indirect access
Inherited groups, shared links, guest accounts and connected applications can broaden the effective audience. Review the route and purpose of each. If the team cannot explain why access exists, record the question and obtain the appropriate decision before changing permissions.
Use milestones as review points
A new external contributor, staff movement or matter closure can change the required audience. Incorporate access decisions into those milestones so the review is part of the work rather than an unrelated annual exercise.
Separate retention from continuing access
The firm may need to retain records after active work ends. That does not mean every former contributor needs continuing access. Apply the firm’s authorized retention and closure decisions, record exceptions and assign a review date. Any legal interpretation remains with the firm and its advisers.
A matter can remain accessible through several routes
A team removes a departed colleague from a matter workspace, but an exported folder remains in a shared project area and an external link still works. The central membership list now looks correct while the information remains reachable. Review the routes by which matter information was shared: the document workspace, email attachments, synchronised devices, collaboration channels and third-party portals. Work with the responsible matter owner so that changes do not obstruct authorised client work or conflict with preservation requirements.
Evidence to collect
- List the matter owner, current working team, approved external participants and review date.
- Check direct membership and inherited permissions separately; a parent group may restore access unexpectedly.
- Review external links and exports, including the business purpose and intended expiry of each route.
- Record exceptions requiring further review rather than removing access without understanding its purpose.
What a useful result looks like
Useful evidence identifies the route checked and the resulting decision. “Access reviewed” is less helpful than a record that names the workspace, group, link or portal and its owner. Where an export cannot be recalled, document the practical follow-up required. Retention, confidentiality and preservation decisions should remain with the people authorised to make them.
Does removing a user from one workspace finish the review?
No. It confirms a change to that workspace. Other groups, shared links, downloaded copies and connected services may have separate controls. Scope the review to the information routes actually used for the matter.