If the formation of company-specific groups and the delegation of rights to these groups is not systematically planned and implemented, this delegation will be difficult to control. It could then grant much more access than intended, for example, which could be abused by third parties. A lack of regular auditing of groups and their access rights can further exacerbate the problem. Even if standard groups are used and their rights are delegated to their own groups— such as when “account operators” are delegated to help desk employees—more rights are usually granted than are actually needed.