Home / Knowledge hub / Access review
Knowledge hub
Access review
A regular check that each person still needs the access they hold.
What it means
An access review is a regular check, often every quarter or every half year, in which the owner of a system or a person's manager looks at who has access to what and confirms it is still needed. Anything not confirmed is removed.
It is a human decision on top of the system's data. The directory can list who has access, but only someone who knows the work can say whether they should. That judgement is the entire value of the review, and it cannot be automated away.
Why it matters
It is the main defence against privilege creep and against accounts left behind when people leave. It is also something auditors test: SOC 2, ISO 27001 and PCI DSS expect periodic review, and expect evidence that it was done and acted on.
Done badly it is a rubber stamp. If reviewers approve hundreds of lines without looking, the exercise creates a record but no safety. A short, focused review of high-risk access does more good than a long list nobody reads. A review should end with removals, not only a signature.
How it shows up
You meet it as a spreadsheet or a task in your identity tooling: a list of accounts, groups and permissions per system, sent to an owner to confirm or revoke. Include administrators, service accounts, shared accounts and third-party access first, since those carry the most risk.
Keep evidence of who reviewed, what was removed and when. Then test the outcome. A review shows what the records say, not what the application enforces, so check that removed access really stopped working and that nothing was reachable through another route.
Questions people ask
Access review, answered
How often should access reviews happen?
Quarterly is common for privileged access, and every half year or yearly for ordinary access. Many frameworks leave the interval to you but expect it to be defined and followed.
Who should do the review?
The system owner or the person's manager, since they know the work. IT staff can prepare the list but are poorly placed to say whether someone still needs access.
What evidence do auditors want?
The list reviewed, the date, who approved or revoked each item, and proof that revocations were carried out. A screenshot of an empty review does not help.
Is a review enough to know access is correct?
No. It checks assigned permissions, not whether the application enforces them. Testing shows whether an account can reach things its record says it cannot. Review shows intent. Testing shows what is enforced, and the two can disagree.
What about customers' access to our product?
Offer customer administrators a way to list and remove users and roles. It helps them meet their own reviews and keeps your product from collecting dormant accounts.
Related
Terms that sit next to this one
Privilege creep
People collecting more access over time than their current job needs.
Least privilege
Giving every person and service the minimum access the job requires.
Identity and access management (IAM)
The tools and rules that manage who your people and services are and what they reach.
Separation of duties
Splitting a sensitive task so no single person can complete it alone.
SOC 2
An audit report on how well a service provider protects customer data.
Does the record match reality?
A review shows what is recorded. We test the running app for what each signed-in account can actually reach, and each finding carries the request and response that proved it. Ask us to run it on one of your applications.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.