A user access review (also called an access recertification) is a periodic check of who has access to a system and at what level. The owner of each system, or each user's manager, confirms that every account is still needed and appropriate, and access that is not gets removed.
It is how least privilege survives over time. Onboarding grants access and offboarding removes it, but role changes, temporary projects and forgotten accounts pile up in between.
What to check
- Accounts of people who have left, including contractors.
- Access that no longer matches the person's role.
- Admin and other elevated rights.
- Shared, generic and service accounts, and who holds their passwords.
- External users such as auditors, agencies and former vendors.
A common rhythm is quarterly for financial systems and admin rights, and yearly for everything else.
Example
Each quarter the controller receives the list of users in the accounting system (illustrative). She finds a former intern still active and a sales rep who can edit supplier bank details. Both are removed, and the review is saved with her sign-off, the date and the changes made.
Common pitfalls
- Rubber-stamping: approving the whole list without reading it.
- Removals that never happen. The review flags an account and nobody follows through.
- Reviewing only the identity provider and missing apps outside single sign-on.
- No evidence. A review nobody can prove happened will not satisfy an auditor or a customer's security questionnaire.