Every quarter, a spreadsheet lands in a manager's inbox. It lists a few hundred user accounts and their access rights across a system they barely use themselves. The instruction is simple: confirm that each person still needs this access. The manager scrolls, recognises most of the names, ticks the box at the bottom and sends it back. The control is complete. Nothing has changed.
User access reviews are one of the most common controls in any organisation and one of the least effective. They are cheap to perform, easy to evidence and almost impossible to fail. That is exactly the problem. For privileged accounts, the ones that can change systems, read sensitive data or switch off security tools, a review that confirms everything is a review that protects nothing.
Why the review becomes a signature
The reviewer usually lacks the context to answer the question. A line that reads GRP_PRD_ADM_02 means nothing to a business manager. They cannot tell whether it grants read access to a report or full control of the production database, so they trust that IT set it up correctly and approve it.
The list is also incomplete. Reviews are typically run on the main application or the directory, while real privilege lives elsewhere: local administrator rights on servers, database accounts, cloud console roles, firewall management, backup platforms and the service accounts that run scheduled jobs. If an account is not on the list, nobody can remove it.
Finally, there is no consequence for approving everything. Removing access creates a risk of breaking something and a complaint from a colleague. Approving it creates no visible risk at all. Human nature does the rest.
Making the review mean something
1. Start with a complete list of privilege
Before you review access, find it. Pull administrators from the directory, every server, every database, every cloud account and every security tool. Include service accounts, shared accounts and vendor accounts. This inventory is often the most valuable output of the whole exercise.
2. Translate access into plain language
Replace technical group names with what the access actually allows: "can change payment records", "can delete backups", "can read all mailboxes". Reviewers make better decisions when they understand what they are approving.
3. Give reviewers the evidence
Add the last login date, the person's current role and whether they have left or moved. An administrator account unused for six months answers its own question. Reviewers should be able to spot the obvious removals in seconds.
4. Make removal the default
For privileged access, require a reason to keep access rather than a reason to remove it. Better still, move towards access granted only when needed and for a limited time, so standing privilege shrinks and there is less to review.
5. Close the loop
A review is only complete when the removals have actually happened. Check the systems afterwards, not the signed spreadsheet.
What auditors should test
- Completeness. Compare the review population with privileged accounts extracted directly from the systems. Anything missing is a finding.
- Reviewer independence. Make sure nobody reviewed their own access, and that the reviewer understood what they were approving.
- Rubber stamping. A review with zero removals across hundreds of accounts, completed in a few minutes, deserves a closer look.
- Leavers and movers. Match privileged accounts against the HR leaver list. Active accounts for people who left are the clearest evidence the control is not working.
- Follow through. Pick the removals the reviewer requested and confirm they happened, and when.
Four questions for leadership
- How many people can administer our most critical systems today, and do we think that number is right?
- Does our access review include databases, servers, cloud and service accounts, or only the main application?
- How many accounts did the last review actually remove?
- How quickly is privileged access removed when someone leaves?
Privileged accounts are what attackers want most, because they turn one stolen password into control of everything. The access review is meant to keep that population small and known. Give reviewers a complete list, plain language and real evidence, and the quarterly spreadsheet stops being a signature and starts being a control.
References and further reading
- ISO/IEC 27001:2022, Information security management systems (Annex A controls 5.18 Access rights and 8.2 Privileged access rights)
- NIST, SP 800 53 Rev. 5, Security and Privacy Controls (AC 2 Account Management and AC 6 Least Privilege)
- Center for Internet Security, CIS Critical Security Controls v8 (Controls 5 and 6, Account and Access Control Management)
- ISACA, COBIT 2019 (DSS05, Managed Security Services)