Why GBP access is a digital-ops problem
Your website can be solid and your hosting locked down—and a departed contractor can still change your Google Business Profile hours, photos, and posts overnight. Google Business Profile (GBP) is where many customers check whether you are open, where you are, and whether they trust the place. Manager and Owner seats decide who edits that public face. If those seats still belong to ex-staff or an old vendor, you do not fully control the listing.
This is a practical audit TwoQM recommends for small businesses that already run a website and digital stack: inventory who has Owner or Manager access, reclaim ownership when needed, remove stale managers, set recovery contacts, and document who may edit hours, photos, and posts. It is not an SEO ranking guide.
GBP sits next to DNS, hosting, and CMS admins as a high-impact control surface. A Manager can update categories, attributes, photos, Q&A, and posts. An Owner can add or remove other people. When access lived in a personal Google account—or was granted “temporarily” during a website project—offboarding the person does not automatically offboard the listing.
Treat the audit like credential hygiene: named seats, company-controlled ownership, and a written roster of who can publish what.
Step 1: Open the Users list and export what you see
Sign in to Google Business Profile Manager with the account you believe owns the listing. Open the location, then find Users (sometimes labeled managers or people with access).
For every person listed, record:
Name / email — Prefer company addresses over personal Gmail when possible.
Role — Owner, Manager, or Site manager (note exactly what Google shows).
Why they have access — Owner-operator, marketing contractor, or “we don’t remember.”
Still needed? — Yes / no / transfer first.
Last verified — Date you confirmed they still need the seat.
If you cannot open Users at all, stop. You may only have Manager access, or the Primary Owner may sit under an account you do not control. That is the reclaim path—not a reason to ignore the listing.
Step 2: Confirm Primary Owner is a company-controlled account
Ownership is the difference between editing the listing and controlling who else can. Goals for most small businesses:
At least one Owner seat on a Google account your team monitors long-term (ideally company Workspace or a dedicated ops mailbox).
Prefer two Owners when two trusted people share responsibility—so one vacation or lost phone does not strand the listing.
Avoid a sole Owner on a freelancer’s personal Gmail, an agency shared login, or an employee who left last year.
If the Primary Owner is wrong, use Google’s ownership transfer or request flow—not a second listing. Start from the account that should own the business, keep verification materials ready, and do not delete the live listing while you wait.
Step 3: Remove stale Managers—after you can still get in
Stale seats are the common failure mode: an old web vendor, seasonal social help, a former GM’s personal account, or a “temporary” SEO shop that still posts.
Before you remove anyone:
Confirm your Owner account can sign in and edit hours, photos, and posts.
Confirm recovery phone and email on that Google account are current.
Screenshot the Users list for your records.
Then remove people who no longer need access. Prefer a calm weekday over a holiday hours rush. Afterward, confirm remaining Owners can still publish a test post or temporary attribute change and reverse it.
If someone refuses to leave and they are the only Owner, document communications and use Google’s ownership tools—do not create a competing profile.
Step 4: Set recovery contacts and login hygiene
A clean Users list fails if the Owner account has a dead phone number for 2-step verification. For every Owner (and ideally every Manager):
Update recovery email and phone on the Google account.
Turn on 2-Step Verification and store backup codes offline (company password manager or printed codes in a locked ops binder—not a Slack pin).
Prefer named Google accounts with roles over one shared “marketing@” password in chat.
Note which company mailbox receives GBP notifications (reviews, suggestions, ownership alerts).
Use the same discipline as registrar and hosting MFA—GBP is another production system with a public blast radius.
Step 5: Document who may edit hours, photos, and posts
Access roles are not a content policy. Write a one-page GBP runbook:
Who may change hours — Including holiday and temporary closures.
Who may upload photos — Brand standards and customer privacy.
Who may publish posts or offers — Cadence and offer accuracy.
Who responds to reviews — Tone and escalation for complaints.
Who may add or remove Users — Usually Owners only.
Store the runbook next to your website admin inventory. When you hire a vendor, grant the minimum role, set an end date, and remove the seat when the contract ends—same day you revoke CMS access.
A short recurring check
Once a quarter beats never; monthly is better for busy or high-turnover shops:
Open Users — anyone unexpected?
Confirm Owners can still sign in.
Spot-check hours, phone, website URL, and primary category.
Review recent photos and posts for accuracy.
Log the check date on your ops sheet.
GBP is not “marketing fluff” when wrong hours send customers to a dark door—or when a stale Manager publishes an offer you never approved.
When to get help
Call in help when ownership is contested, the listing is suspended, duplicates exist, or the only Owner left with the business. Include GBP Users in the same access workbook as DNS and CMS admins. TwoQM’s bias: company-controlled Owners, short-lived Manager grants, and a written roster—so the listing stays yours after people and vendors change.
Audit the managers this week. Your future self—and customers reading the map pin—will thank you.