# Access review

Review business need, privilege combinations and evidence of removal together.

SecNet.Work | 2026.10 | 2026-10-21

Role changes and completed projects can leave access behind. This workflow connects the completeness of the account population to a closure test. Managers explain business need, technical teams explain effective privileges and data owners validate scope. Additional review frequency and event triggers depend on risk and applicable requirements.

## Work boundary
Human accounts, local application roles, cloud groups and external users. Use the non-human identity pack for service identities. Examples are fictional; do not upload real identities or passwords.

## Process

### 1. Validate the population
Reconcile HR, directory and application-local accounts using a dated snapshot. Record inherited group permissions and excluded systems separately. Do not report an incomplete system population as a completed review.

Expected evidence: Source system, snapshot date, record count and coverage gaps.

### 2. Assign business ownership
Describe data and actions enabled by each role. Separate the manager’s and data owner’s approval responsibilities. Keep ownerless access visible rather than losing it in a routine approval queue.

Expected evidence: Role description and named decision owner.

### 3. Review combined privileges
Check combinations such as creating and approving payments alongside individual permissions. Last use is only one input; infrequent emergency access may be necessary. Tie the decision to the current role and business rationale.

Expected evidence: Separation-of-duties analysis and rationale.

### 4. Record the decision
Record retain, restrict or remove. Temporary exceptions need a risk owner, compensating control and expiry. Escalate unanswered records instead of treating silence as approval.

Expected evidence: Decision, rationale, approver and exception expiry.

### 5. Apply the change
Link the decision to an implementation ticket. Inspect group membership, external sharing and active sessions as well as direct roles. Define communication and rollback needs for affected workflows.

Expected evidence: Implementation ticket and post-change output.

### 6. Verify closure
For the sample, check that removed access does not remain through another route. Report exceptions and overdue actions. Close the review after the owner understands coverage and residual risk.

Expected evidence: Retest result and outstanding actions.

## One control, three perspectives

### Operator
Did effective access actually change?
Verify the permission path and session after the change.
Evidence: Before/after role output and ticket.

### Auditor
Was the reviewed population complete?
Reconcile the sample population with source records.
Evidence: Count reconciliation and decision trail.

### Leader
Which risk remains open?
Prioritize ownerless privileges and expired exceptions.
Evidence: Overdue removals and risk acceptance list.

## Evaluate evidence

**Claim:** Payment approval access was removed.

**Weak support:** A manager’s “approved” email with no account, role or date.

**Stronger support:** An account/role-specific decision, closed implementation ticket and scoped retest showing the permission path was removed.

**Rationale:** Approval does not prove implementation. The stronger example links the decision to the result; population completeness still requires separate validation.

## Decision desk
A person moving from finance to procurement can both create suppliers and approve payments.
Start: start

### start
What is your first decision?

- **Ask the owner to justify combined privileges** (good)
  This considers both current duties and conflicting permissions. Now inspect how the decision was implemented.
  Next: verify

- **Approve because the employee is trusted** (risk)
  Trust in the person does not explain separation of duties. The workflow still needs protection against misuse or error.
  Next: repair

- **Close with unanswered records** (incomplete)
  Silence is not decision evidence. Keep missing owners and privileges visible and raise an escalation.
  Next: revise

### verify
The owner requested removal of payment access. The ticket is closed, but group membership remains.

- **Fix the permission path and retest** (good)
  You are checking effective access rather than ticket status. Link the retest result to closure.
  Next: planned

- **Accept the closed ticket** (risk)
  Group-based access remains, so the removal claim is unsupported. Separate decision from implementation.
  Next: revise

### repair
Conflicting roles are discovered after approval. How do you recover?

- **Assign an owner, interim control and retest plan** (good)
  The remediation path is traceable. Closure follows a complete rationale and implementation evidence.
  Next: planned

- **Rewrite the old approval email** (risk)
  Rewriting the trail hides the original decision and correction. Add a new decision while preserving the prior record.
  Next: revise

### supported
This decision is supported by the evidence in the example. Verify closure conditions in your own scope.

### revise
The decision lacks support. Record the rationale and required evidence, then reassess.

### planned
A remediation path is defined. Keep the matter open until implementation and verification are complete.

## Worked example
Entirely fictional.
- Record ID: ACC-001
- Account / role: Example ERP / payment approval
- Business rationale: No longer needed after role change
- Business owner: Finance process owner
- Decision: Remove
- Exception expiry: No exception
- Evidence / ticket: Fictional CHG-017 and role output
- Closure test: Group and direct role removed; retested

## Closure checklist
- [ ] Population sources and snapshot date verified.
- [ ] Owner and separation of duties checked.
- [ ] Removal or exception decision is justified.
- [ ] Implementation and retest records exist.

## Official sources
- [CISA / NSA — Identity and Access Management](https://www.cisa.gov/sites/default/files/2023-12/ESF%20IDENTITY%20AND%20ACCESS%20MANAGEMENT%20RECOMMENDED%20BEST%20PRACTICES%20FOR%20ADMINISTRATORS%20PP-23-0248_508C.pdf)
- [NIST Cybersecurity Framework 2.0](https://csrc.nist.gov/pubs/cswp/29/the-nist-cybersecurity-framework-csf-20/final)

https://secnet.work/learn/toolkits/access-review