Identity & access / 01

Access review

Review business need, privilege combinations and evidence of removal together.

This work is currently open on this device. Sign in to save it and continue on another device.

Role changes and completed projects can leave access behind. This workflow connects the completeness of the account population to a closure test. Managers explain business need, technical teams explain effective privileges and data owners validate scope. Additional review frequency and event triggers depend on risk and applicable requirements.

Map the process

0 / 6 steps reviewed.

Step 1 / 6

Validate the population

Reconcile HR, directory and application-local accounts using a dated snapshot. Record inherited group permissions and excluded systems separately. Do not report an incomplete system population as a completed review.

Expected evidence

Source system, snapshot date, record count and coverage gaps.

One control, three perspectives

Did effective access actually change?

Verify the permission path and session after the change.

Before/after role output and ticket.

Evaluate evidence

Claim: Payment approval access was removed.

Weak support

A manager’s “approved” email with no account, role or date.

Stronger support

What evidence would you request before closing this claim?

Decision desk

A person moving from finance to procurement can both create suppliers and approve payments.

What is your first decision?

Worked example

This record is fictional. Do not treat sample results as evidence for your own work.

Record ID	Account / role	Business rationale	Business owner	Decision	Exception expiry	Evidence / ticket	Closure test
ACC-001	Example ERP / payment approval	No longer needed after role change	Finance process owner	Remove	No exception	Fictional CHG-017 and role output	Group and direct role removed; retested

Closure checklist

0 / 4

Checks on this screen last for this session only; they do not create closure evidence or compliance approval. Keep organizational records in the downloaded workpaper.

Population sources and snapshot date verified.Owner and separation of duties checked.Removal or exception decision is justified.Implementation and retest records exist.

Take it to work

Files in the selected language. The workbook includes blank records, a worked example and a checklist.

Complete workpackZIP · EN Editable workpaperXLSX · EN Printable workpaperPDF · EN Blank record templateCSV · EN Full guide and scenarioMD · EN

Keep learning

Explore related Academy courses

Sources and edition

Checked: 2026-10-21 · Edition 2026.10