SaaS access after a role change

A fictional organization uses a managed collaboration service for internal planning documents. The provider maintains the application and underlying servers, while the organization configures users, groups and sharing settings. A staff member moves from one project to another, but keeps an administrator role in the former project and a public sharing link to a budget document. A former contractor’s account is also still active. The organization has evidence of the provider’s security certification but no recent review of its own access assignments. Its manager argues that purchasing SaaS transferred all security duties to the provider. No specific national privacy law, retention period or notification deadline is supplied in this exercise. The security team must propose immediate access corrections and a repeatable process that addresses this type of drift.