A supplier's final invoice can be paid while their admin account still works. The commercial relationship has ended. The access hasn't.
That gap belongs in a security review. When a contractor changes roles or a support agreement ends, somebody has to check what the person can still reach. A note in the procurement folder won't close an account.
The Canadian Centre for Cyber Security's baseline controls recommend individual accounts, minimum permissions and a process to revoke accounts that are no longer needed. Those are practical controls for a small business, not paperwork reserved for a company with a security department.
I'd start with the people outside the company who can change a system or download business data. For each one, ask what they need access to now, who inside the business owns that decision and when it will be reviewed again. If nobody can answer, the permission has outlived its explanation.
Shared support logins deserve attention too. If several people use the same account, an activity log can tell you that the account acted without telling you which person did it. That's an expensive mystery to leave for an incident.
Removing access also needs care. Confirm what a service account does before disabling it, and plan the change with the person who owns the system. Breaking payroll in the name of security is still breaking payroll.
The next review can be small: one supplier, one system, the actual account list. Compare what's there with what the current job requires. Old access doesn't become safe because everyone forgot about it.