Definition
A user access review is a periodic control in which a system or data owner reviews a list of users and their permissions, confirms each is still needed, and documents removals or changes. It covers new hires, role changes, terminations and privileged accounts.
Why it matters in an audit or review
Weak access controls undermine other controls. If terminated employees keep access, or users can post and approve their own entries, the integrity of financial data is weakened. The auditor tests whether the review happened on schedule, whether the list reviewed was complete, whether the reviewer acted on exceptions, and whether removals were actually made in the system.
Example
A client reviews ERP access each quarter. The auditor inspects the Q2 review, compares the reviewed list to a system-generated user list for the same date to confirm it was complete, and checks that the three removals the reviewer marked were gone from the system. The reviewer signed off but the list left out service accounts, so the team notes that completeness gap.
Common mistakes
Accepting a signed review without testing that the user list given to the reviewer was complete and accurate.
Sources
- AICPA, AU-C Section 315 (IT applications and general IT controls; as amended by SAS No. 145)
Definitions paraphrase AICPA and FASB guidance; read the standard itself before relying on a requirement. Example figures are illustrative. This page is guidance, not professional advice. Report an error