If you do not have SSO make sure the process around granting / revoking access is airtight. You would also be wise to implement a much as possible of your company's generic security practices, so e.g. if excel files are not allowed to be emailed you could also block them and similar. You should also keep a smaller repo of audit log exports, it can be automated to a large extent but I really like having that in sync with e.g. financial lose of period (audit on user access, role/permission changes etc.)