Why recurring reviews exist
User access reviews are the control that turns "who has access" from a snapshot into a living answer. Many organisations use recurring access reviews as part of their control environment, including teams working towards SOC 2, ISO 27001 or NIST-aligned programs. Confirm the cadence and evidence your applicable framework requires with your auditor or adviser.
Scoping a review
Before opening a review, decide what is in scope:
- Applications: which SaaS applications and directories are included.
- Populations: employees, contractors, external collaborators, service accounts.
- Attributes: licences, roles, group memberships, sign-in activity, privileged flags.
A common mistake is reviewing everything at once. Start with the highest-risk surface: privileged roles, external users and licensed-but-inactive accounts.
Choosing a cadence
- Monthly: licence-heavy environments where seat cost is material.
- Quarterly: the default for most organisations.
- Annually: a common minimum for many frameworks — confirm with your auditor.
Whatever cadence you choose, the review window must be short enough that reviewers can complete it while the data is still current.
What evidence to keep
- The review window and the data snapshot it was based on.
- Who was asked to review, and when.
- Each decision (approve, revoke, defer) with the reviewer and timestamp.
- Exceptions and their rationale.
Evidence should be immutable: once a decision is recorded it must not be editable, so an auditor can trust the record.
Common failure modes
- Reviewer fatigue: too many users per review leads to rubber-stamping. Split by owner or application.
- Stale data: reviewing against a month-old snapshot misses changes.
- No follow-through: decisions to revoke are never actioned. Track revocation to completion.
Source notes
Use these primary references alongside your organisation's own policy, risk and legal requirements: