When a person changes role, previous logins can stay active while new ones are added. Management should check which permissions are still needed. The transition concerns continuity of work and control of information, with procedures consistent with applicable responsibilities and rules.
I propose linking the review to the tasks transferred. It is necessary to know which activities are concluded and which remain temporarily in charge. Permissions must be changed through the authorized path, avoiding sudden withdrawals that make it impossible to complete an already agreed passage.
In a hypothetical example, a person leaves order management to deal with communication. Some information may remain useful, others are no longer needed. The distinction must follow the concrete work, without retaining all access only because it was available in the past.
A subsequent verification checks that the new configuration is usable and that unnecessary accesses have been managed. Clarity of responsibilities facilitates passage. Permits remain consistent over time when the review accompanies organizational changes and is not treated as an occasional activity.