It depends on the type of the company, size, public, private, etc. We recommend a solution that can display key information such as who has access to which area and a log of all changes at a minimum. We have also fond out that a good documentation of what each user group has access to is very welcomed by auditors!!