--- title: Reviewing service and generic accounts description: Service and generic accounts often go unmanaged, posing risks. Learn why to secure these accounts to protect your models effectively. image: https://riskinsights.com.au/hubfs/Reviewing%20service%20and%20generic%20accounts.png --- [Skip to content](https://riskinsights.com.au/blog/reviewing-service-and-generic-accounts#main-content) [![Risk Insights - Logo - (RGB, Horizontal, Small)](https://riskinsights.com.au/hs-fs/hubfs/Risk%20Insights%20-%20Logo%20-%20(RGB%2c%20Horizontal%2c%20Small).png?width=200&height=40&name=Risk%20Insights%20-%20Logo%20-%20(RGB%2c%20Horizontal%2c%20Small).png)](https://riskinsights.com.au) - [Articles](https://riskinsights.com.au/blog) - [Approach](https://riskinsights.com.au/approach) Show submenu for Approach - [Commissions (Accuracy)](https://riskinsights.com.au/broker-partner-commission-accuracy-reviews) - [Claims Fraud (Fairness)](https://riskinsights.com.au/claims-fraud-fairness-reviews) - [Fees and Charges (Accuracy)](https://riskinsights.com.au/fee-and-charge-accuracy-reviews-risk-insights) - [About](https://riskinsights.com.au/about) - [Contact](https://riskinsights.com.au/contact) Open main navigation Close main navigation - [Articles](https://riskinsights.com.au/blog) - [Approach](https://riskinsights.com.au/approach) Show submenu for Approach - [Commissions (Accuracy)](https://riskinsights.com.au/broker-partner-commission-accuracy-reviews) - [Claims Fraud (Fairness)](https://riskinsights.com.au/claims-fraud-fairness-reviews) - [Fees and Charges (Accuracy)](https://riskinsights.com.au/fee-and-charge-accuracy-reviews-risk-insights) - [About](https://riskinsights.com.au/about) - [Contact](https://riskinsights.com.au/contact) --- 06 Aug 2026 # Reviewing service and generic accounts ![Picture of Yusuf Moolla](https://riskinsights.com.au/hs-fs/hubfs/Yusuf_Moolla_Headshot-transformed.png?width=50&name=Yusuf_Moolla_Headshot-transformed.png) [Yusuf Moolla](https://riskinsights.com.au/blog/author/yusuf) Share: [linkedin-in icon](http://www.linkedin.com/shareArticle?mini=true&url=https://riskinsights.com.au/blog/reviewing-service-and-generic-accounts) [envelope icon](mailto:?body=https://riskinsights.com.au/blog/reviewing-service-and-generic-accounts) **TL;DR** • User access reviews typically focus on human users. • Service and generic accounts are sometimes ignored or missed. • They tend to hang around, often with more access than they need.   [This recent article](https://riskinsights.com.au/blog/orphaned-access-what-removal-leaves-behind) was about access that gets left behind when someone leaves. That's about people. But there's another set of accounts that we need to manage. Service accounts run the connections between systems: a model pulling features from a warehouse, or a scoring engine writing back to a decisioning platform. Generic accounts are shared logins, like "modelops", where several people might use the same credentials. These accounts matter: when a customer questions a decision, or when we need to show how a model came to be set up the way it is, the underlying process can very easily involve these types of accounts. When I first started auditing ~20 years ago, we didn’t touch these much. They have become both more important, and more risky, over the last decade or so. That’s why system audits usually include them nowadays.   ## There are at least three problems with these types of accounts: ### **1. They linger** Offboarding is triggered by a person leaving, which has no effect on these accounts. Regular access reviews often miss them, or ignore them. So old accounts, like those set up for a project that has since finished, can still be there. Nobody removes them because nobody's sure what will break. A fair concern, but it's also an argument for checking what they’re used for, not for leaving them alone. ### **2. They can be powerful** It's easier to grant broad access than to work out the minimum. A service account that only needs access to one table might have write access across a database. For example, access was thought to be the source of an error, so we granted more. We then found the real coding error, but forgot to take that extra access away. A generic account set up for testing might also be able to change model settings. It needed to at the time we were testing. The architecture has now changed, but the access remained. ### **3. They can’t always be tied to a person** Generic account credentials get shared, written down, and passed on. When someone leaves, the password often doesn't change. Because activity shows the account name rather than a person, a change made through one of these accounts can't be traced back to anyone. If a model threshold changes and the log says "modelops", we can't tell who did it or whether it was approved. You might be able to trace the IP or link the login to a known laptop, but this doesn’t always work.   ## **Where to start** List the service and generic accounts that the decision system uses, then: - make sure each one has a named owner - check what they can do, and remove access they don’t need (carefully, since something may depend on it) - check when the credentials were last changed (change if it’s been a while, then plan for how to do that going forward) - start monitoring their use, or at least when they’re accessed.   --- Disclaimer: The info in this article is not legal advice. It may not be relevant to your circumstances. It was written for specific contexts within banks and insurers, may not apply to other contexts, and may not be relevant to other types of organisations. ---     ## Related posts [![Insurance written on a chip, with finger pointed at it](https://riskinsights.com.au/hs-fs/hubfs/image_fx%20%281%29.png?height=200&name=image_fx%20%281%29.png)](https://riskinsights.com.au/blog/curated-insight-2) ## [Curated Insight: The Use of AI in Insurance (NAIC)](https://riskinsights.com.au/blog/curated-insight-2) 09 May 2025 TL;DR • This featured resource is from the U.S. National Association of Insurance Commissioners •... [Read more](https://riskinsights.com.au/blog/curated-insight-2) [![Core questions we need to be able to answer about our decisioning systems](https://riskinsights.com.au/hs-fs/hubfs/Core%20questions%20to%20answer%20about%20our%20decisioning%20systems.png?height=200&name=Core%20questions%20to%20answer%20about%20our%20decisioning%20systems.png)](https://riskinsights.com.au/blog/core-questions-we-need-to-be-able-to-answer-about-our-decisioning-systems) ## [Core questions we need to be able to answer about our decisioning systems](https://riskinsights.com.au/blog/core-questions-we-need-to-be-able-to-answer-about-our-decisioning-systems) 24 Sep 2026 There are (at least) 5 key sets of questions we should be able to answer quickly about our... [Read more](https://riskinsights.com.au/blog/core-questions-we-need-to-be-able-to-answer-about-our-decisioning-systems) [![Would you put your model on a performance plan](https://riskinsights.com.au/hs-fs/hubfs/Would%20you%20put%20your%20model%20on%20a%20performance%20plan.png?height=200&name=Would%20you%20put%20your%20model%20on%20a%20performance%20plan.png)](https://riskinsights.com.au/blog/would-you-put-your-model-on-a-performance-plan) ## [Would you put your model on a performance plan?](https://riskinsights.com.au/blog/would-you-put-your-model-on-a-performance-plan) 19 Feb 2026 TL;DR • Evaluate models on performance: Apply the same decision quality standards to your models... [Read more](https://riskinsights.com.au/blog/would-you-put-your-model-on-a-performance-plan) We acknowledge Aboriginal and Torres Strait Islander peoples as the Traditional Custodians of the lands on which we live and work. We pay our respects to Elders past and present, and honour the rich diversity of the world's oldest living cultures. [View our LinkedIn page](https://www.linkedin.com/company/riskinsightsap) [email us](mailto:info@riskinsights.com.au) [Call us](tel:+61408946143) 2026 Risk Insights Pty. Ltd. | [Privacy](https://riskinsights.com.au/privacy-policy) | [Disclaimer](https://riskinsights.com.au/disclaimer) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Yusuf Moolla", "url" : "https://riskinsights.com.au/blog/author/yusuf" }, "dateModified" : "2026-08-09T04:01:47.640Z", "datePublished" : "2026-08-05T20:30:00.000Z", "headline" : "Reviewing service and generic accounts", "image" : [ "https://riskinsights.com.au/hubfs/Reviewing%20service%20and%20generic%20accounts.png" ], "mainEntityOfPage" : { "@id" : "https://riskinsights.com.au/blog/reviewing-service-and-generic-accounts", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://riskinsights.com.au/hubfs/Risk%20Insights%20-%20Logo%20-%20(RGB%2c%20Horizontal%2c%20Small).png" }, "name" : "Risk Insights Pty. Ltd." } } ```