How do we run an access review that isn't rubber-stamped?

Start

An access review campaign is about to launch

An access review should produce decisions, not signatures. A reviewer who sees a bare list of account names, with no job titles or last sign-in, has nothing to judge, so they approve it. Fix the inputs and the choices first, then check the results before you close.

• Then: Prepare a dated extract with leavers and unused accounts flagged

Step

Prepare a dated extract with leavers and unused accounts flagged

Each extract must show every account with its name, role, permissions and last sign-in, taken on a stated date. Match it to HR's list of staff, leavers and movers, and flag leavers, accounts with no sign-in for 90 days and accounts with no owner. Reviewers then see the answer in front of them, and ignoring it becomes visible.

• Then: Does the extract reconcile and show last sign-in?

Decision

Does the extract reconcile and show last sign-in?

Reconcile means the number of entries equals the count the system itself reports. Check that privileged groups, service accounts and third-party accounts are present and every column is filled. Without last sign-in, reviewers cannot find unused accounts, which is the most common reason a review misses them.

• Yes: Send each entry to someone who can judge it
• No, or not known: Take the extract again before anyone reviews it

Step

Take the extract again before anyone reviews it

A decision made on an incomplete list is not a decision. Take the extract again. If a system's extract cannot be completed in this campaign, leave that system out and raise the gap as a finding, reported with the campaign.

• Then: Does the extract reconcile and show last sign-in? (back to an earlier step)

Step

Send each entry to someone who can judge it

Line managers decide whether their people still need the system for their current job. System owners decide the permissions, and every privileged, generic, service and third-party account. Nobody reviews their own access or the access of anyone who reviews theirs. A reviewer who cannot know the people on the list can only approve it.

• Then: Allow four decisions only, with a reason for each change

Step

Allow four decisions only, with a reason for each change

Keep, Modify, Revoke or Cannot decide. Anything other than Keep needs a reason. Cannot decide sends the entry to the system owner, so an unsure reviewer never has to keep something to be safe. Give reviewers the same questions in the same order, and brief them with worked cases, so that two reviewers reach the same answer.

• Then: Did every entry get a decision by the deadline?

Decision

Did every entry get a decision by the deadline?

An entry with no answer has not been reviewed. It is never counted as Keep. Open entries go up an escalation ladder, which “If a reviewer misses the deadline, then what?” sets out.

• Yes: Check every reviewer's list for the four warning signals
• No: Send open entries to the system owner to decide

Step

Send open entries to the system owner to decide

At the deadline, unanswered entries go to the system owner, who decides them within 2 working days in the pack's default. Anything still undecided then goes to the Head of Information Security. The reviewer is named in the campaign report.

• Then: Check every reviewer's list for the four warning signals

Step

Check every reviewer's list for the four warning signals

Information security runs this check on every campaign, after the deadline and before close. The signals are: a reviewer keeps every entry of a long list (more than 25 in the pack's default) in one sitting; decisions average under 5 seconds each; leavers or unused accounts are marked Keep; privileged or generic accounts are kept with no named owner. A spreadsheet can still show the first and third.

• Then: Which signal does the list show?

Decision

Which signal does the list show?

Check each list for all four. Reviewers are told in advance that these checks run, and being flagged is not an accusation. A list where everything genuinely should be kept is fine if the doubtful entries carry a reason.

• Leaver or unused account kept: Change it to Revoke, and sample the reviewer's other decisions
• Privileged or generic kept, no owner: Change it to Cannot decide until an owner is named
• Whole list kept, or too fast: Sample the list, and re-review it if any sample is wrong
• None: Close, and report what the review removed

Step

Change it to Revoke, and sample the reviewer's other decisions

This is the strongest signal: the data showed the answer and the reviewer ignored it. The system owner changes the entry to Revoke, and information security samples the rest of that reviewer's list.

• Then: Put every changed decision through removal and confirmation

Step

Change it to Cannot decide until an owner is named

Every privileged, generic and service account must have a named person who answers for it. A Keep without one is not a decision. It stays Cannot decide until the system owner names an owner, or the account is revoked.

• Then: Put every changed decision through removal and confirmation

Step

Sample the list, and re-review it if any sample is wrong

A long list kept whole is sent back, or re-reviewed by the system owner, and information security checks a sample of entries (10 in the pack's default). For decisions made too fast, information security checks a sample of 10; if any is wrong, the whole list is reviewed again.

• Then: Put every changed decision through removal and confirmation

Step

Put every changed decision through removal and confirmation

A decision the check changes is removed and confirmed like any other. Its removal window counts from the day of the quality check. The campaign does not close while any signal is unresolved.

• Then: Did the same reviewer show a signal last campaign too?

Decision

Did the same reviewer show a signal last campaign too?

One flagged list can be a bad day. The same reviewer twice in a row is a pattern that the next campaign's checks will not fix on their own.

• Yes: Report it to their manager and brief them before the next
• No: Close, and report what the review removed

Step

Report it to their manager and brief them before the next

The reviewer is reported to their own manager and gets a short briefing from information security before the next campaign. If more than 1 in 10 reviewers show a signal, the pack treats that as a sign the method or the instructions need changing.

• Then: Close, and report what the review removed

Outcome

Close, and report what the review removed

State how many signals were found and what was done, even when none were. Report the access removed and the accounts that should never have existed, not '100% reviewed': completion only says the lists came back. The signals catch obvious rubber-stamping only, so keep sampling, calibration and the re-performance test running too.