A new adviser is a new access decision

A new adviser often receives access before anyone has recorded exactly what that access includes. Before onboarding, list the systems, documents, devices and people the adviser needs to reach, then give the narrowest practical permission and a named owner. Use individual accounts, require strong sign-in and set a review date. When the engagement ends, remove access promptly and confirm that shared links, tokens and local copies have been dealt with. Good due diligence is not suspicion of the adviser; it is respect for the access they have been trusted with.