Reviewing report and folder access in Salesforce

1. List the folders that matter: the ones used in recurring reviews or shared outside the team that built them.
2. For each folder, note the reports inside and whether each is used, duplicated elsewhere, or retired.
3. Record the intended audience for each folder in a sentence — a role, a team, or named individuals.
4. Record the current sharing: folder access, and any report shared individually outside its folder.

Reporting on access is best done as a written table rather than a screenshot, because the point of the exercise is the comparison and the reasoning, not the current state on its own.

• The folder is in the wrong place. A folder created inside a personal or team area inherits that area's sharing, which may not match the report's audience.
• Role or permission set. The person's role in the hierarchy and the permission sets assigned to them determine what they can reach, and both change quietly when people move.
• Record-level visibility. A shared report can return nothing if the underlying records are outside the user's access. The report looks broken; the sharing is doing what it was configured to do.
• Historical workarounds. Reports shared individually to resolve one request, never revisited when the request was superseded.

Where a change is warranted, state the audience it serves and what it exposes, then grant the minimum that meets it. That might mean moving a report into the folder its audience already accesses, adjusting one folder's sharing, or assigning a permission set to the role that needs it. Each of those has a narrower effect than opening the folder to everyone, and each can be explained later.

Where the intended audience is genuinely broad, say so explicitly and record the decision. The review's value is that access becomes a decision with a reason, rather than an accumulation — not that access becomes narrower as a principle.

The example below is hypothetical and describes a pattern rather than a client account.

Report and folder access review sits inside Salesforce consulting, part of the Operations & Systems capability and the CRM consulting scope. Where the reports themselves disagree, the dashboard definitions work comes first.