A good access review record shows the scope reviewed, who reviewed it, when, what they decided and proof that any removals were carried out. A signed spreadsheet with ticks but no follow up is the common weak spot, and it is easy to fix.
The five things the record should show
- Scope: which systems and which accounts were in the review.
- Reviewer: a named person with enough knowledge to judge, ideally not reviewing their own access.
- Date: when it happened, from a system or ticket, not typed afterwards.
- Decisions: keep, change or remove for each account.
- Follow through: evidence that removals and changes were done.
The fifth is the one that gets missed. A review that ends in a decision nobody acts on has not reduced risk.
Make the starting list complete
The review is only as good as the list it starts from. Export accounts directly from each system, including service accounts, shared mailboxes and contractor logins. If the list comes from HR, accounts that were never in HR will be missing.
Compare against the previous review. New accounts and role changes need extra attention.
Reviewers need context
A manager who sees only a username cannot judge access. Show the role, the groups, the last login and the permission level. Flag admin rights and accounts that have not logged in for a long time.
Avoid rubber stamping. If a review always returns "keep all", sceptics will ask whether anyone is looking. Some removals or changes in a healthy review are normal.
Evidence of follow through
For each removal or change, link a ticket or system log that shows it happened and when. Then check that the access is gone in the source system, not just closed in the ticket.
How often
Frequency is a decision you set in your own policy, based on risk. Whatever you write, follow it. Reviewing quarterly while your policy says monthly creates an exception on its own.
Automating without losing judgment
Pulling the account list and recording decisions can be automated. The judgment itself stays human. Safeguard's compliance and evidence automation can gather account data and store review records, and your reviewers still decide.
A practical tip: run the review in a ticket or workflow tool rather than email. Each account gets a line, the reviewer records a decision, and each removal is linked to the task that carried it out. At the end, export the whole thing with timestamps. That single export answers most auditor questions and leaves little to reconstruct from memory.
Record the review date, the reviewer names and the ticket numbers in the same sheet, so the whole review can be found in one place later.
Quick check
Can the reviewer be the account owner?
A person should not approve their own access. Use their manager or the system owner instead.
Do service accounts need to be reviewed?
Usually yes. They often hold broad permissions and no one watches them, so include them and name an owner for each.
Last reviewed: 19 October 2026.
