What is a user access review?
Also called: access review, access recertification, entitlement review
Last updated
A user access review is a regular check that each person’s access to systems and data is still needed and appropriate for their role. Managers or system owners confirm or remove each account and permission, removals are carried out, and the review is recorded as evidence for security and compliance audits.
In more detail
Access tends to grow over time: people change roles and keep their old permissions, projects end, contractors leave. Reviews catch what joiner, mover and leaver processes miss. Privileged accounts, such as administrators, are usually reviewed more often than standard ones.
Most frameworks, including SOC 2 and ISO 27001, expect access reviews at a defined interval, quarterly being common for important systems. The auditor will ask for the list that was reviewed, each decision, proof that removals happened and the date.
Example
Each quarter, IT exports the users of the finance system. Each department head confirms or removes their team’s access; two former interns and one leftover administrator role are removed, IT confirms the removals, and the review is filed with the date.
Access reviews in CheckFlow
In CheckFlow a schedule starts the review each quarter. The list of systems can come from a Data Set, each reviewer records Keep or Remove in a required drop-down, a removal step appears only when it is needed, and the activity feed is the evidence of who decided what and when.
Related terms
Templates with a live demo
Each one opens as a live checklist you can try without signing up.
Run your next process as a checklist.
Build it once as a template, then run it with owners, due dates and a record of every step.
14-day free trial, no credit cardFull refund in your first 30 daysUS hosting, EU on request