How do you conduct an access review?

Required tools

• System administrator — For extracting cast lists and making changes.
• The Managers — They are the ones who know who needs what.

Map

1. 1.Export a list for each security role

   Who has which role. Start with the system administrators—the list is usually longer than expected.

2. 2.Find inactive accounts

   No login activity in the past ninety days. These are usually former employees or people who have changed roles.

3. 3.Include service accounts and integrations

   They are systematically forgotten because no manager owns them. Find out what each one is used for and who owns it.

Clear

1. 4.Send the lists to the managers

   Ask them to confirm or decline. Set a deadline. Without a deadline, the responses will never come.

2. 5.Remove anything that cannot be confirmed

   The standard should be that access which no one confirms is removed. The opposite rule results in a review with no effect.

3. 6.Note the discrepancies

   If the same problem keeps recurring—for example, if a change of role never triggers a clean-up—it is the role-change procedure that needs to be fixed, not the review.