Updated October 30, 2026. The original publication date is retained.
A user access review checks whether accounts and permissions remain appropriate for the people or services using them. A useful review produces decisions and follows necessary changes through to completion. A list of accounts or a report of findings alone does not show that inappropriate access was removed.
The steps below are a practical example, not a guarantee that a particular SOC 1 or SOC 2 control is sufficient. Set the scope, frequency and evidence requirements around your risks, commitments and control design. For SOC 2 context, see the AICPA Trust Services Criteria and our CC6.3 access-control examples.
1. Define the Scope and Decision Makers
Identify the systems, account types and permissions included. Consider privileged users, service accounts, shared accounts and outside users as applicable. Name an owner who understands which access is appropriate, a coordinator, and any required reviewer.
2. Obtain a Complete, Understandable Listing
Retain the source and date of the listing and explain how its completeness was checked. Include enough information for a decision, such as the user or account owner, status, role, groups and significant permissions. Reconcile different sources where one listing does not cover the intended population.
3. Record an Actual Decision
Ask the responsible reviewer to determine whether access remains appropriate, should change, or needs further investigation. Record the decision and reviewer rather than treating an unopened spreadsheet or blanket approval as a completed review.
Example Scenario: An employee moved from finance to sales. The reviewer checks whether the old finance permissions are still justified, records the decision, and requests removal of permissions that are no longer needed.
4. Assign and Complete Corrections
Give each required change an owner and a due date appropriate to the risk and the organization’s requirements. Track the removal or modification in a ticket or other controlled record. Escalate overdue or unexplained access rather than closing the review with unresolved items hidden in a spreadsheet.
5. Verify Closure and Retain the Evidence
Confirm that the requested changes occurred and record who checked them. Keep the original population, decisions, approvals, correction references and closure evidence together or linked. Clearly identify unresolved exceptions and how they are being handled.
A review is detective: it can identify access that is already inappropriate. It complements timely onboarding, role-change and offboarding controls rather than replacing them. If the same problems recur, investigate the upstream process as well as correcting individual accounts.
One Response