User Access Review Procedure: What to Document So Stale Accounts Get Caught

Short answer: A user access review procedure tells named reviewers which accounts to check, how often, what to compare them against and what to do with accounts that should not exist. Without it, test accounts, former employees and vendor logins survive for years. Write the procedure, keep the review records, and track every exception to closure. This is heavily-dependent upon the employee turnover within an organization, where small teams may remain static for years, while larger organizations experience daily employee turnover activities.

What can go wrong when access reviews are not documented?

A UK case reported on 21 October 2026 shows the risk. According to Infosecurity Magazine, the Information Commissioner's Office reprimanded an IT provider and a public sector data organization after attackers used a test account called "Test 2," protected by the password "Password1," that had stayed active for more than 12 years. The ICO cited missing password requirements, no regular audit of accounts the provider had created, and account reviews that were neither routine nor complete. About 3,300 people were affected, most of them children, and no fine was issued.

None of those failures needed new technology to prevent. They needed a written rule, a named reviewer and a record that the review happened.

What should a user access review procedure include?

• Scope: which systems and account types are in the review, including service accounts, shared accounts, test accounts and third-party accounts.
• Frequency: how often each scope is reviewed, with privileged accounts reviewed more often than standard users.
• Reviewer: the role responsible, usually the system owner or the user's manager, not the administrator who granted access.
• Source of truth: the HR roster, contract list or vendor register that accounts are compared against.
• Decision options: keep, modify or remove, with a required justification for privileged access.
• Timelines: how quickly removals must happen after the review closes.
• Evidence: the export reviewed, the reviewer's sign-off and the tickets for each change.
• Exceptions: how accounts that cannot be removed are approved, documented and re-reviewed.

The recommended review frequency for privileged vs standard accounts depends on the applicable laws, regulations and frameworks and staff turnover.

How does the procedure fit with policies and standards?

The procedure is one layer of a larger structure. In the Hierarchical Cybersecurity Governance Framework, an access control policy states that access is granted on least privilege and reviewed. A standard turns that into measurable rules, such as review frequency and maximum time to disable a departed user's account. The procedure explains the steps. The review records prove it happened. Our guide to policies vs standards vs controls vs procedures walks through each layer.

For defense contractors, account management sits in NIST SP 800-171. Our page on NIST 800-171 Rev 3 03.01.01 Account Management lists the requirement, assessment objectives and evidence assessors look for.

How do you run the first review?

1. Export every account from each in-scope system, including disabled accounts.
2. Match accounts to a current person, contract or approved service. Flag anything that does not match.
3. Look specifically for test, demo, training and default accounts. Disable them unless an owner justifies them in writing.
4. Send each reviewer only the accounts they own, with a deadline.
5. Open a ticket for each change and close the review only when the tickets are closed.
6. File the export, sign-offs and tickets together so the evidence is easy to produce.

If you outsource IT, require your provider to follow the same procedure for accounts they create, and include that duty in the contract. You should create a recurring calendar item to remind yourself to obtain evidence of the account review process, in case they do not send you evidence or a notification of that task being completed on their own.

Writing procedures like this from scratch takes time. ComplianceForge offers editable cybersecurity procedures templates that cover access management alongside the rest of your control set, and our FAQ explains what security procedures are.

Frequently Asked Questions (FAQ)

How often should user access reviews happen?

Set the frequency in a standard based on risk. Privileged and remote access accounts usually warrant more frequent review than standard user accounts. Check any specific frequency your contracts or frameworks require.

Who should perform the review?

The system owner or the user's manager, because they know whether access is still needed. The administrator who grants access should not be the only reviewer.

What evidence should we keep?

The account export reviewed, the reviewer's decision and sign-off, and the tickets showing changes were made.

Do test accounts need to be reviewed?

Yes. Test, demo and default accounts are easy to forget, which is exactly why they should be named in the procedure's scope.