If TBM or individual parts thereof are physically separated from the rest of an organisation's IT, a dedicated user and authorisation management system is usually also set up. If this is inadequately designed and implemented, the possibility of several employees using the same user account or the organisation failing to delete the authorisations of departed internal or external employees or service providers cannot be ruled out. This could allow TBM to be accessed without authorisation.