What is an access review?

What a review covers

The reviewer receives a list of everyone who can reach a system and at what level, and confirms that each account is still needed. Anything that is not needed is removed or reduced, and the change is recorded. The systems in scope are usually the identity provider, cloud consoles, production databases, source code, and any business system that holds customer data.

Joiner and leaver processes are meant to prevent stray access. The review catches what they missed: people who changed roles and kept their old permissions, contractors past their end date, shared accounts and service accounts nobody owns. Privileged and third-party accounts are where most findings come from.

What auditors check

In a SOC 2 Type II audit the auditor picks reviews that fell inside the observation period and follows each one from the user list to the removals. ISO 27001 auditors do the same against control 5.18, which expects access rights to be reviewed at regular intervals.

A review where every account was approved and nothing changed, on a system with regular joiners and leavers, makes an auditor ask whether anyone really looked.

• Complete population. The user list was exported from the system itself and dated, not typed up by hand.
• Right reviewer. Someone who knows what the role needs decides, and nobody approves their own access.
• Decisions recorded. Each account is marked keep, change or remove, with the reviewer’s name and the date.
• Removals done. A ticket or log shows each removal was carried out, and when.

Running reviews that hold up

Set the frequency by risk and write it into the access control policy: quarterly for production and privileged access is a common choice, with less frequent reviews for low-risk tools. Then keep to it. A missed quarter becomes an exception in a Type II report.

Where access is granted through groups in an identity provider, review both who is in each group and what each group can do. Keep every cycle’s export, decisions and removal tickets together, so the evidence for one review can be handed over in one piece.

Related terms

Personnel security

Controls covering people: screening where the law allows it, onboarding and offboarding, training, acceptable-use acknowledgement, and removing access when someone leaves.

Evidence

Any record that shows a control operated: a configuration export, a ticket, a signed policy, an access review. Auditors sample evidence across the period they are reporting on.

Exception (audit)

An instance where a control did not operate as described during the audit period. A SOC 2 report lists exceptions, and readers judge how much they matter.

SOC 2 Type II

A SOC 2 report on whether controls operated effectively over an observation period. The report most enterprise buyers eventually ask for.

Control

A specific safeguard or activity that reduces a risk, such as requiring MFA on privileged accounts or reviewing access every quarter. Frameworks are, in large part, lists of controls.