System Access Review Template

This review is one step in a larger programme. Using it for work that belongs to a neighbouring template produces records that are hard to report on later.

Access review is a named control in the management system, not a general good-practice suggestion, and the 2013-to-2022 Annex A renumbering moved where it lives without changing what it requires.

ISO 27001 sets the control itself. Two other regimes make the review consequential in practice: a US customer due-diligence framework that tests it directly, and UK data protection law that treats a stale account as a security failure.

The form records that a review happened. Whether the record is defensible turns on four judgement calls that the fields alone don't settle.

The findings below are what a review of this kind actually turns up, not a hypothetical list.

An IT contractor was given domain administrator rights for a three-month migration. The engagement ended, the offboarding ticket was closed, and the contractor's standard user account was disabled on schedule. The administrator account was not, because it had been created as a local privileged account outside the normal joiner-mover-leaver process, and the offboarding checklist only ever looked at accounts that process had created.

The next review, four months later, listed it as active and asked the system owner to confirm it. The owner didn't recognise the name and marked it justified anyway, assuming IT would know. It took a second cycle before anyone traced it to a contract that had ended two review periods earlier, and nobody could say whether it had been used meanwhile. The finding that mattered wasn't the dormant account; it was that a review built on the assumption provisioning followed the standard process cannot see the accounts that didn't.

The form is the easy part. Chasing a real confirmation from system owners, tracing an account back to a contract that ended two cycles ago, and closing the loop into offboarding is the work that actually slips.

KnowComply

Holds the access review register against your systems list, routes each record to its system owner, and keeps the leaver and privileged-access evidence together.

KnowContractor

Tracks contractor engagement dates and access grants, closing the gap where a project-scoped administrator account outlives the contract that justified it.

KnowOps

Feeds joiner, mover and leaver events from daily operations into the review, so the account list reflects who currently works there, not last cycle's snapshot.

Ella

Chases system owners for an actual confirmation rather than a blanket yes, flags accounts unresolved across two cycles, and holds every write for your approval before it touches a record.

Privileged access

An account with elevated rights beyond standard use, such as administrator, root or configuration access, which most reviews treat as a separate and higher-scrutiny category.

Dormant account

An account that still authenticates but has not been used for an extended period, which a review should surface even where no one has left.

Segregation of duties

Splitting a sensitive process across two or more people or roles so that no single account can complete it unchecked.

Service account

A non-human account used by an application or automated process to authenticate to a system, frequently overlooked because it has no leaving date to trigger a review.

Leaver account

An account belonging to someone who has left the organisation or ended a contract; the review's most common and most consequential finding is one still active.