Almost every access review is a rubber stamp, and nobody in the process pretends otherwise.
Hand a manager a list of group names they have no way to interpret and they will approve every line, because the only alternative available to them is guessing. You end up with a completed cycle, a document for the auditor, and precisely no change in who can reach what. Making the review mean something is a design problem rather than a compliance one, and it is the difference between a comfortable SOC 2 audit and writing a management response to a finding.
- Approve-allThe outcome nobody admits to
- Translate itShow consequences, not group names
- RemovalsThe metric that matters, not completion
- RecurringA cadence, not a project
Eight design choices, and the first explains why nearly every review fails.
Translate access into consequences the reviewer understands
A row reading FIN-GL-POST-PROD tells a finance manager nothing at all. Rewrite it as can post journal entries to the live general ledger and they can judge it in two seconds, and they will start taking people off the list. This one change accomplishes more than any platform on the market, and it is the step almost every program skips, because writing the translation is real work and exporting group names takes a minute.
Give it to somebody who actually knows
Whoever reviews has to know what the person does on an average Tuesday, which almost always means their manager rather than IT or the system owner. IT understands what the access is without knowing whether it is warranted. The system owner understands the system without knowing the individual. Sending the review to the wrong person is the second most common design error, and it guarantees blanket approval before anyone opens the file.
Review what matters, not everything
Cover every system and every permission and you produce fatigue, and fatigue produces approval. Cover privileged access, the systems holding regulated or financial data, and anything an outside party can reach, and you get real decisions. Scope it tightly enough that people actually read it. One annual pass over everything is worth less than four quarterly passes over what matters.
Leavers, which is the specific test everyone fails
The recurring review is a safety net, not the control itself. The control is removing access when somebody walks out, evidenced with a timestamp, and this is where auditors get specific. SOC 2 testers sample leavers directly, and the HIPAA Security Rule expects documented termination procedures. Where offboarding works properly, the review finds very little. Where it does not, the review is quietly doing a job that should have been finished months earlier.
Movers, which nobody reviews at all
Somebody moves department, picks up what the new job needs, and keeps everything the old one required, because nothing anywhere triggers a check. This compounds for years unnoticed. Departures get attention because a process fires when someone resigns. Internal moves get nothing. In most companies we assess, the people holding the widest access are the longest-serving, and it is entirely an accident of being promoted repeatedly.
Privileged access, reviewed separately and more often
Administrative access deserves its own cycle rather than being buried inside a general review. The frameworks agree: least privilege and privileged account management run through NIST 800-171 and CMMC, NYDFS Part 500 requires limiting and periodically reviewing access privileges, and shared admin accounts defeat the attribution every framework assumes.
Measure removals, not completion
The number nearly everybody reports is the percentage of reviews completed, which measures whether people clicked a button. The number that tells you whether the control functions is how much access came off. A cycle that hits a hundred percent completion and removes nothing at all is a rubber stamp with excellent statistics, and somebody should say that plainly to whoever receives the report.
Evidence that satisfies whoever asks
SOC 2 auditors, general controls testers, and cyber underwriters all sample these, and they sample individual users rather than reading your policy document. What they want is the review itself, who performed it, when, and what actually changed as a result. A review that happened and left no artifact is indistinguishable from one that never happened.
A review that removes nothing has told you nothing.
Worth confronting head on, because this failure is invisible in every number companies normally report and becomes obvious the instant somebody asks a different question.
- Pull up the last completed cycle and count the entitlements that came off as a result. If that number is zero, or close to it, across a large population, the review did not do anything. Access genuinely accumulates in every organization, which means a real review always turns something up. A perfectly clean sheet across several hundred users means people approved rather than assessed.
- None of this is laziness on the reviewers part. They received a list of technical group names, no explanation of what any of it permits, no context about what the person actually does all day, and a due date. Under those conditions approving the lot is the rational choice, because the only alternative is stripping access on a hunch and stopping a colleague from working.
- The repair belongs on the sending side. Translate every entitlement into what it actually permits, show when it was last used wherever the system will tell you, flag anything unusual for that role, and pre-fill a recommendation the reviewer can accept or override. People engage with that. Nobody can engage with a column of group names.
- Then measure removals instead of completion. Completion records whether somebody clicked. Removals record whether the control does anything at all. Presenting a completion rate to a board or an audit committee while removals sit at zero is more misleading than presenting no number whatsoever.
Four things that separate a review that works from one that merely finished.
We write the translation layer, which is where the work really is
Every reviewable entitlement gets mapped to a plain sentence describing what it permits. It is tedious, it takes genuine effort, and skipping it is why most reviews fail, because exporting group names takes minutes and translating them takes days. Once written it is reused every cycle, so the cost lands once and the benefit repeats indefinitely.
We scope down until reviewers will actually read it
A short review people genuinely read beats a comprehensive one that gets approved wholesale, and we will make that argument even when a framework seems to push toward completeness. Privileged access first, then systems holding regulated or financial data, then anything an outsider can reach. The remainder can go annual, or be sampled, or be reasoned about rather than certified line by line.
We report removals, and we tell you when that number is zero
Where a cycle finishes and nothing comes off, you hear that plainly instead of receiving a completion percentage. Access accumulates everywhere, so a genuine review across a real population always finds something. A clean sheet means people approved rather than assessed, and saying so is considerably more useful than a green dashboard.
We close the leaver and mover gaps first, so the net comes up mostly empty
The recurring review is a net, not the control. Where offboarding removes access properly and a role change triggers a check, the review should find very little, and finding very little for that reason is exactly the goal. Where former employees still have access months after leaving, that is the more urgent problem, and we deal with it before designing any review cadence.
Six situations where this stops being optional.
A company in or approaching a SOC 2 cycle
User access reviews are among the controls SOC 2 auditors sample most consistently, and they sample leavers specifically. A review that runs on a defined cadence, with the reviewer, date, and outcome recorded per item, is the difference between a sampled control and an exception in the report every prospect reads.
A public company or one preparing to be
SOX ITGC testing covers access to the systems supporting financial reporting, and external auditors sample individual users rather than reading policies. The entitlements that matter most, journal posting, vendor master changes, payment release, are exactly the ones a translated review makes reviewable.
A healthcare organization under HIPAA
The Security Rule's administrative safeguards include information access management and workforce termination procedures, and shared clinical logins sit awkwardly against all of it. A designed review, plus a fast evidenced offboarding process, addresses the findings that recur in healthcare environments.
A financial services firm under NYDFS Part 500 or GLBA
NYDFS Part 500 requires covered companies to limit user access privileges and review them periodically, and FTC Safeguards Rule programs expect access controls as part of the written information security program. These are testable expectations, which makes a designed review considerably easier to evidence than an informal one.
A business with high turnover
Restaurants, retail, distribution, and construction, where people arrive and leave constantly and offboarding tends to happen by conversation rather than by process. Here the review is doing real work rather than acting as a net, and the first cycle usually strips out a great deal. The lasting fix is the leaver process rather than running reviews more often, though the review is what finally shows everyone the size of the problem.
A firm answering customer or insurer questions about access control
How access is granted, reviewed, and removed now appears on almost every security questionnaire and insurance application that crosses your desk. Those answers go onto documents somebody signs, which makes accuracy a legal matter rather than a matter of good practice. A review that exists and removes nothing is genuinely hard to describe honestly, and the honest description costs more than fixing the underlying problem would have.
Same activity, three entirely different outcomes.
| Feature | Designed to be answerable | Rubber stamp | No review at all |
|---|---|---|---|
Entitlements described in business terms | Not applicable | ||
Reviewer knows the person and their job | Sometimes | Not applicable | |
Last-used information shown | |||
Scope narrow enough to be read | Not applicable | ||
Access actually removed as a result | Regularly | Almost never | Never |
Privileged access on its own cycle | |||
Movers trigger a check | |||
Management time consumed | Moderate | Moderate | None |
Survives an auditor asking what changed | Awkwardly | ||
Reported metric | Removals | Completion | None |
The same entitlement, presented two ways.
What is usually sent
FIN-GL-POST-PROD
- What the reviewer can act on
- Can post journal entries to the live general ledger
What is usually sent
Domain Admins
- What the reviewer can act on
- Full control of every server, workstation, and account
What is usually sent
HR-SYS-ALLEMP-RW
- What the reviewer can act on
- Can open and change any employee record, salary included
What is usually sent
SP-SITE-LEGAL-OWNER
- What the reviewer can act on
- Can manage and share the legal document library externally
What is usually sent
AP-VENDOR-MAINT
- What the reviewer can act on
- Can change supplier bank details, the invoice fraud path
What is usually sent
Global Reader
- What the reviewer can act on
- Can read everything in the tenant, including all mailboxes
What is usually sent
CRM-EXPORT-ALL
- What the reviewer can act on
- Can export the entire customer database to a file
What is usually sent
No usage information
- What the reviewer can act on
- Last used 14 months ago
What is usually sent
No peer context
- What the reviewer can act on
- Nobody else in this role has this access
What is usually sent
No recommendation
- What the reviewer can act on
- Suggested: remove. Accept or override with a reason
Five steps, with almost all the cost landing in the first cycle.
- 1
Establish what is actually worth reviewing
Privileged access comes first, then anything holding regulated, personal, or financial data, then anything an outside party can reach. We deliberately cut scope until the population is small enough that reviewers will genuinely read it, because a comprehensive review approved wholesale is worse than a narrow one that gets real attention.
- 2
Build the translation layer
Each reviewable entitlement gets a plain sentence describing what it allows, a last-used date wherever the system supplies one, and a flag where the entitlement looks unusual for that role. This is the substance of the engagement, and because it is reusable it gets built once and maintained rather than recreated every cycle.
- 3
Fix leavers and movers before the first cycle
We check the most recent leavers against their removal timestamps and establish whether anything at all fires when somebody changes role. Where former employees still hold access, that is more urgent than any review design, and running a campaign over a population littered with ex-staff squanders the reviewers first impression of the whole process.
- 4
Run the first cycle with support
Reviewers receive a short briefing, a pre-filled recommendation they can accept or overrule with a reason, and a named person available for questions while the window is open. Removals are then actioned quickly, because nothing teaches somebody to stop caring faster than flagging access for removal and finding it still there next quarter.
- 5
Set the cadence and report removals
Privileged access runs on a shorter cycle than general access, with the interval set by risk rather than by habit. Reporting to leadership opens with entitlements removed rather than reviews completed, and where a cycle removes nothing we say so and go looking for the reason instead of presenting it as a clean bill of health.
What organizations ask about access reviews.
Fifteen questions about the last access review you ran.
Was the last one real
- How many entitlements were removed as a result?The one question worth asking. Zero is not a good result.
- How long did reviewers spend on it, on average?Hundreds of lines cleared in a few minutes means nobody read it.
- Did any reviewer ask a question during it?Not one question across an entire cycle is a warning sign, not a smooth run.
- Were reviewers shown what each permission actually allows?Or a list of technical group names.
- For any single line, can you name the reviewer, the date, and what happened?What a SOC 2 or SOX auditor will sample.
Design of the next one
- Does whoever reviews actually know what that person does?Nearly always the line manager, rather than IT or whoever owns the system.
- Is it short enough that a busy manager will genuinely read it?Privileged, regulated, and externally reachable access first.
- Can you show last-used dates for entitlements?No other column helps a reviewer as much as this one.
- Does each line arrive with a recommendation they can accept or overrule?Turns an open question into a decision.
- When somebody marks access for removal, does it actually come off?Nothing trains a reviewer to disengage faster than a removal that never happens.
The surrounding process
- Is leaver access removed promptly at exit, with a timestamp?Auditors sample your last ten leavers.
- Does anything trigger a check when somebody changes role?Movers are the accumulation nobody reviews.
- Is privileged access on a separate, more frequent cycle?It should not be buried in a general review.
- Are shared privileged accounts eliminated?They defeat attribution, which every framework assumes.
- Do you report removals to leadership, or completion?Completion is the more misleading of the two.
The pages around this one.
Take your last access review and count the removals.
That single number tells you whether you own a control or an artifact, and finding out costs nothing at all. If it comes back at zero across a large population, the problem is almost certainly what your reviewers received rather than who they are.
Related Services
Explore more solutions that work great with this service
Zero Trust Architecture Assessment
Your architecture measured against NIST SP 800-207
Learn moreSOC 2 Readiness
Get audit-ready for the report your buyers ask for
Learn moreMicrosoft Entra
Identity and access management solutions
Learn moreM365 Tenant Management
Your tenant run properly, end to end
Learn moreTenant Security Baseline
Documented controls mapped to CIS
Learn more