Who has the keys?
We can review important accounts, administrator access, multi-factor authentication and recovery options. Are shared logins still in use? Could an old account open something it shouldn't? Who could get in if the usual administrator was unavailable?