I'm sure totally unrelatedly, we got dinged a bunch on our SOC2 reports improper "off-boarding" and not removing access from terminated folks since no one knew to remove them.
Once we added quarterly SOC2 controls to make sure only employees had accounts it was always a shock to see who had to be removed.
I know the intent was to improve morale, but it had the opposite effect.