In a user access review, the owner of each in-scope system walks its account list and confirms three things: every account belongs to a current member of the team, every permission level is still justified by the person’s role, and access that should have been removed actually was. The output is a dated, signed record with findings and the tickets that resolved them.
Auditors lean on this control because it’s where paper meets reality. Policies describe intent; the access review shows whether anyone checks. It’s also perfectly testable — discrete, dated, recurring — so an auditor can request four quarters of records and see instantly whether the control operated all year or was reconstructed the week before fieldwork. Backfilled reviews give themselves away: identical timestamps, zero findings, no tickets.
And it catches the failure nearly every company has. Access accumulates: a contractor rolls off but the SSO account lives on, an engineer keeps admin from an incident rotation two quarters back, a service account outlives the project that created it. Without a forcing function nobody notices until an auditor — or an incident — does. That drift is an insider-risk problem before it’s a compliance one.
