A CPA firm's guidance on user access reviews, published on 3 December 2025, says the entire review is often done by one person in IT or compliance, and that this is not enough. The people who know what access a person should have are department managers, system owners and data owners. At a software company that means you, the engineering manager.
If your company is starting SOC 2, expect these five duties.
What's affected
- Access reviews. Each quarter or on the schedule your policy sets, you confirm that every person on your team still needs the access they have. The firm lists the questions: does the user still need access, does the permission level match the job role, are terminated people still enabled.
- Onboarding and offboarding steps. You request access through the ticket flow instead of in chat, and you confirm removal when someone leaves or moves teams.
- Change approvals. Your team's pull requests need an approver who is not the author, and emergency changes need a recorded reason afterward.
- Training and policy acknowledgments. You make sure your team completes them by the deadline.
- Incident participation. You take part in the incident process and in the annual exercise.
What to do now
- Ask for the access list for each system your team uses and read it. Remove what is not needed and file the confirmation.
- Use the ticket template for access requests. If none exists, ask for one, with approver, reason and date.
- Check branch protection on your repositories: required reviewers, no direct pushes to the main branch, required checks.
- Put the quarterly review, training deadline and incident exercise in your calendar now.
- Keep your sign off where the auditor can find it: a ticket, a saved export, a dated message. The CPA firm's rule is that undocumented work is treated as if it never happened.
Why it matters
Auditors sample. They pull a few people or changes from the period and ask for the approval trail. A manager who approves in chat and never records it creates an exception that no one else can fix later.
Why should access reviews include managers and not only IT?
Managers and system owners know what access their people need to do their jobs. IT can list permissions but cannot judge whether they match the role.
