What it is
Privileged accounts can change data and settings, so a weak review of them undermines the automated controls and reports that depend on the system. This checklist covers administrator, super-user, database, service and emergency accounts in systems that support financial reporting.
It starts with the completeness of the account list, then reviews each account for need and approval, asks seven questions about use, logging and segregation of duties and records the changes made. A standard user access review has its own template.
When to use it
- For the periodic privileged access review.
- Before testing ITGCs.
- After a role change in IT or a system migration.
What’s inside
- Completeness steps for the account population
- Account review table with decision and date
- Seven questions on use, logging and segregation of duties
- Changes made and sign-off
Standard cited
This template follows ITGC / COSO control activities. It is written in our own words, except for phrases the standard requires the document to contain, with [bracketed placeholders] for client details, amounts in USD and dates as MM/DD/YYYY. Check it against the current standard and your firm’s methodology before use.
Questions
Who should do the review?
Someone who does not hold privileged access in the system, so that no one reviews their own access. The data or system owner usually signs off.
Why check completeness first?
A review of an incomplete list proves little. Get the list from the system, not from the administrators, and include built-in, shared, service and vendor accounts at every layer in scope.
Related templates
- ITGC and User Access Review Checklist (Financial Statement Audit)
- SOX User Access Review Test Worksheet
- Risk and Control Matrix: IT General Controls
- Segregation of Duties Conflict Matrix
Last updated 11/05/2026. All free templates.