Credential auditing needs to detect when users are no longer needed

My whole cred auditing needs to be redone to make the results easier to take action on, but one problem is if you advise an access key be removed since it hasn't been used in a year, then you may end up with a user with no creds, and so really the guidance should be to remove the user. Similarly, accounts sometimes already have users with no creds that should be removed.