Prepare quarterly access review evidence
Before each access review, the system pulls who has access to which systems, flags leavers, dormant accounts and changes since last time, and sends each reviewer a short list to confirm. The evidence is stored for the auditor. For IT and compliance teams assembling spreadsheets for every review.
Function: IT · Industry: Any industry
Prepare quarterly access review evidence
6 steps
At a glance
- Trigger
- The quarterly review window opens.
- Typical inputs
- Account and group exports from key systems
- HR roster
- Last review results
- Reviewer assignments
- Systems it usually connects to
- Okta
- Microsoft Entra ID
- Google Sheets
- Jira
- How the work splits
4 rules, 1 model, 1 person steps
How it runs, step by step
6 steps, each tagged by what does the work. Rules are fixed logic, a model reads or drafts, and a person decides.
- Rules Fixed logic in code
- Model AI reads or drafts, with a confidence score
- Person A named person decides
- 1
Pull the access lists
RulesUsers, roles and last-login dates are exported from each in-scope system via API or file.
- 2
Compare with HR and last review
RulesLeavers, role changes, dormant accounts and new privileges since the last review are identified by rules.
- 3
Summarize for each reviewer
ModelA model writes a short summary per reviewer of what changed and which entries need a closer look.
- 4
Confirm or revoke
PersonReviewers confirm each entry or ask for its removal, and a manager covers non-responders.
- 5
Make the changes
RulesRevocations become tickets or direct actions, and the completion is verified.
- 6
Store the evidence
RulesLists, decisions, timestamps and verification are saved in the format your auditor accepts.
Where people approve
The decisions that stay with your team, whatever the confidence score says.
- Business owners confirm access for their team.
- Security approves privileged accounts.
- The IT lead signs the completed review.
KPIs to track
What to measure, before and after. Targets come from your own baseline.
- 01Days to complete the review
- 02Reviewers who responded on time
- 03Revocations completed within your target
- 04Auditor requests for more evidence
Questions about this workflow
Does this satisfy an auditor?
It produces the evidence trail; whether your control design meets a given framework is something your auditor decides. We build to the format and detail they ask for.
What about systems with no API?
We can use scheduled exports or controlled browser automation, and we state which systems need that during scoping.
Which steps use rules, a model and a person?
Rules: pull the access lists; compare with HR and last review; make the changes; store the evidence. Model: summarize for each reviewer. Person: confirm or revoke. Rules are fixed logic in code. A model reads or drafts and reports its confidence. A named person decides.
What do we need to start?
Typically: account and group exports from key systems; HR roster; last review results; reviewer assignments. You also need read access to Okta, Microsoft Entra ID, Google Sheets and Jira, or the equivalents you use. A workflow audit measures your volumes and past cases first, then gives a fixed price for the build, so you can decide with real numbers.