The Quarterly Review That Takes Twenty Minutes

We started doing a quarterly review of our crypto access after a departure exposed how little we knew about our own setup. It has found something every quarter since. The thing that made it click was reading an institutional crypto wallet alongside.

What we check

Who has access, and should they. List every user and confirm each is still appropriate for their role.

Which addresses are on the allowlist, and whose are they. Every entry should map to a live supplier or an account we control.

What the log shows. Every action for the quarter, including failed and rejected attempts.

Whether the approval rules are still configured correctly. Settings change, sometimes by accident.

What it has found

First quarter: two addresses nobody could identify. Both turned out to be from a project that ended. Removed.

Second quarter: a person who had changed roles and no longer needed approval rights. Removed.

Third quarter: notifications were going to a shared inbox rather than to individuals, because someone had tidied up email routing. Fixed.

Fourth quarter: an approval rule named a person who had left, which meant the rule could never be satisfied. We found it in the review rather than when a payment stalled.

None of these were incidents. All of them were the conditions in which an incident becomes expensive.

The failed attempts

The log includes rejected withdrawals and failed logins.

A run of rejected withdrawals is the clearest early sign that an account is compromised, and most people only ever look at successful transactions. For client money the rules are stricter, and a corporate crypto wallet with segregated accounts is set up for that.

We have not seen one. I would rather be looking than not.

Why quarterly

Monthly is too often for a company our size and gets skipped.

Annually is long enough that a departure or a role change sits unaddressed for months.

Quarterly takes twenty minutes and has caught something every time.

The departure procedure alongside

Separate from the review, and written down: revoke access first, review addresses that person added, read the log for the previous ninety days. Compare anything you are offered against a crypto exchange with published fees before committing.

Fifteen minutes. It is the highest value thing a small company can do here and it only works if someone owns it.

What I would tell another small company

The controls you configure at setup decay. People change roles, settings get adjusted, addresses accumulate.

The review is what keeps the setup you designed and the setup you have from drifting apart.