> strict internal controls on financial information. Which means that password rotation is necessary so that people who are not anymore allowed to access information does not have access to these information any more

How does rotating a password prevent access? That's access control, not authentication.

Unless it's a shared password, which is a bigger problem.