What is an access review?
An access review, also called access recertification or a user access review, is a scheduled check of who can reach what. People who understand the business, a user's manager or the owner of an application or data set, go through each account, group membership and role and either confirm it or mark it for removal. The goal is to catch access that was right when it was granted but isn't anymore. No system setting can say whether someone still needs to approve payments; that takes a person who knows the work.
What a review finds
- Privilege creep: rights kept after a transfer or promotion.
- Orphaned accounts: accounts whose owner has left, or that nobody can identify.
- Stale guest and vendor accounts that outlived the project or contract.
- Excess privileged roles, such as more global administrators than the work requires.
- Toxic combinations that break separation of duties, such as one person who can both create vendors and pay them.
How a review campaign runs
- The identity team sets the scope: one application, every privileged role, or all guest accounts.
- Each reviewer receives a list of the people and entitlements they answer for, ideally with the date each access was last used.
- Reviewers approve or deny every line by a deadline, with a reason for anything unusual.
- Denied access is removed, automatically where the platform supports it, and unanswered lines follow a preset rule, often removal.
- The finished review, with decisions and timestamps, is kept as audit evidence.
A few lines from a quarterly review of a finance application:
| User | Access | Last used | Decision |
|---|---|---|---|
| akhan | Payment Approver | 2 days ago | Approve |
| jkim | Payment Approver | 214 days ago | Deny: moved to marketing |
| vendor-ops2 | Read reports | Never | Deny: contract ended |
Frequency and common failures
Frequency follows risk. Many organizations review privileged roles every quarter and ordinary access once or twice a year, and some frameworks set a floor: PCI DSS v4.0.1 requires user accounts and their privileges to be reviewed at least once every six months. Reviews go wrong when they turn into rubber-stamping, with a busy manager clicking approve on every line without reading. Short lists, last-used dates, recommendations based on inactivity and removal on non-response keep reviews honest. Reviews also fail when the reviewer is the wrong person: a manager can confirm what a job needs, but the data owner decides whether that job should reach the data at all.
Access review vs. account audit vs. privilege creep
- Access review: a business decision about whether access is still needed.
- Account audit: a technical check of account settings, such as inactive accounts, passwords set never to expire or unexpected changes to privileged groups.
- Privilege creep: the problem; the access review is the detective control that finds it.
Access review on the CompTIA Security+ exam
On SY0-801, access reviews are part of identity and access management under objective 4.5. A scenario about an employee who changed departments and kept old rights, contractor accounts still active after the engagement ended, or an auditor asking for proof that access is periodically confirmed points to an access review, sometimes worded as recertification or manager attestation. Distractors include an account audit, which checks configuration rather than need; mandatory vacation, which can expose fraud but doesn't confirm access; and role-based access control, which assigns access cleanly but doesn't remove what people accumulate over time.