How do you audit which vendors have access to dealership systems?

Start with the system of record

Request from the DMS and CRM providers a current list of every integration, every third party and every user with access, including what each can read and write.

Reconcile against contracts

Every access should map to a current agreement with a named internal owner. Anything unmatched is either an undocumented arrangement or a leftover. Both should be closed.

Check leavers and former vendors

Access frequently outlives the relationship. Terminated vendors and departed staff are the most common findings, and the easiest to remediate.

Make it recurring

A one-off audit decays. Tie the review to a fixed cadence and to the offboarding process for both staff and vendors, so removal happens at the point of departure.

What to collect for each access

For each vendor or user: the system, the account name or interface, the permissions granted, the date created, the last time it was used, the internal sponsor and the contract that authorizes it. Access unused for many months is a candidate for removal. Sponsors should confirm in writing that the access is still needed and at what level.

Tightening what remains

Where possible, replace shared logins with named accounts, apply multi-factor authentication, give the lowest permission that works and set an expiry date on temporary access. Ask vendors to use a controlled method of access instead of dealer employee credentials. Log changes so that any later question about who could see what has an answer.

Common mistakes in access reviews

Reviewing only staff and forgetting vendors, accepting a vendor's statement without a list from the system, doing the review once and not scheduling the next, and not closing access when a contract ends are the usual gaps. Tie the review to the offboarding checklist for staff and vendors so removal occurs on the day of departure.

Questions to ask each vendor

Which accounts and connections do you hold in our systems? Who at your company can use them?

How are credentials protected? Do you use multi-factor authentication?

How do you tell us when staff with access leave? Ask for a written list and compare it with what the system provider reports.