This user access review checklist is for IT managers and business owners at mid-size firms in India or the GCC who have run an access review and want to test their last one. A user access review is a person-by-person check that access still fits the job. The 15 checks, in five parts, look at what that review left behind, and each has a yes or no pass test. The checklist does not show compliance with any standard or law, and no source read for this page sets a review interval. Paste the tables, which are plain text, into whichever sheet you already keep.
Last reviewed 2026-11-01 by Manish Sharma.
What a User Access Review Checklist Tests, and How the Marks Work
This user access review checklist tests the evidence of a finished review, not the steps of running one. The review leaves its evidence in the systems, and the access of each user is where every check begins. Signisys wrote the marks, samples and pass tests; no standard sets them, and a Basis cell credits a source only for what it says.
Two guidance documents sit behind the Basis cells: NCSC’s 10 Steps to Cyber Security page (UK, published 11 May 2021) and the CISA and NSA best-practices guide for administrators (US, advisory in nature, no date in the copy read).
Marks. Score a check by what you can show. Dated proof that every sampled item passed is worth 2. A partial pass, or a full pass with nothing kept, is worth 1. A failed test, or one not yet run, is worth 0.
Total. The 15 checks give a top total of 30 points, by Signisys’ own sum, and no line marks a pass. Compare the five parts before adding up, because full marks in four parts can cover a part of 0s.
Samples. Where a test names three items, draw them from the complete list and note which, so a colleague can repeat the test. Draw again next time. A list of three or fewer is tested whole.
N/A. A check with nothing to test is N/A and lowers the top total by 2; a first review has no earlier findings, so check 12 is N/A.
Example (illustrative, not a client). For check 7, the returned list shows the same answer on every line, and the check scores 0.
Key Takeaway Work with no proof to show earns one point of two.
User Access Review Checklist, Part 1: Was Everything on the List?
The first three checks ask whether the review looked at everything it should. Each sample starts from the system itself and looks for its line on the review list, including the service account and the access held by each user.
A service account is a login used by a program or scheduled job, not by a person (our description). The glossary explains what access control means.
| Check | Evidence to keep | Pass test | Basis |
|---|---|---|---|
| 1: The scope note names the systems reviewed and the ones left out, with a reason for each. | The scope note, dated, beside the firm’s system list. | If each of three listed systems is named as in or out, and each exclusion has a reason. | Our check; no source’s text covers it. |
| 2: The accounts reviewed match the accounts that exist when the review starts. | An export taken from the system on the review date, and the list that went to reviewers. | If each of three accounts picked from the export is on the list that reviewers received. | CISA and NSA’s guide, on identity governance systems, describes an inventory of accounts and privileges that currently exist. The match test is ours. |
| 3: Service, shared and supplier-held accounts are on the list, each with a named owner. | List columns for account type and owner. | If each of three such accounts from the export is on the list and its owner can say its use. | NCSC’s 10 Steps says access policy should consider all types of user, contractors among them. The account types and owner test are ours. |
Part 2: Can You Show the Removals in the System?
Removals are where a review changes anything, and the system shows the new access of each user. These checks of the user access review checklist look at the system after the work, not at the task that asked for it.
| Check | Evidence to keep | Pass test | Basis |
|---|---|---|---|
| 4: The changes made in the application match the remove answers, no more and no fewer. | A second export taken after the removal date, the change log (or equivalent) for the review period, and the decisions. | If each of three removals picked from the decisions is missing from the second export. Each of three access changes picked from the change log must also match a remove answer. | NCSC’s 10 Steps says, in its joiners, movers and leavers policy, that access should be revoked when no longer needed. The two-way match is ours. |
| 5: A removed right is refused when someone tries to use it. | A dated test note from a person who does not hold the account. | If the note shows each of three removals refused when tried, where the firm’s rules allow such a test. | Our check, to run when the firm’s rules allow it. |
| 6: Removals were finished by the date set, unless a reason and a new date are written. | The decision date, the due date and the removal date for each line. | If each of three removals shows a removal date by the due date, or a reason and a new date. | Our check. |
User Access Review Checklist, Part 3: Did Real Decisions Come Back?
This part covers the answers that came back: who gave them, what they say and what became of the gaps. Each check works from the returned list, including its blank lines, and from what each user’s access looked like at the time of the review.
| Check | Evidence to keep | Pass test | Basis |
|---|---|---|---|
| 7: Answers read as decisions, unlike one bulk approval. | The returned list, as received. | If the answers differ and each of three keep lines picked from the list gives a reason naming the job. | Our check. |
| 8: The person who answered is placed to judge the access while not holding it. | A column naming the answerer and how they know the person’s work or the application. | If, for each of three lines, the answerer is not the holder and the column says why they can judge. | CISA and NSA’s guide says, of identity governance systems, that an access inventory enables application and data owners to review and reconcile accounts and privileges; choosing who may judge a line is our check. |
| 9: A line with no answer at close has a written outcome. | The closing list, with an outcome beside each unanswered line. | If each unanswered line shows what happened, such as a removal or a named person’s acceptance, or none was unanswered. | Our check. |
Key Takeaway Read the five parts before the sum of 30.
Part 4: What Stayed On, and Why
This part covers access that stayed despite a doubt, which a user’s manager or the review itself may have raised. It also covers rights that should not sit together when one person holds them.
| Check | Evidence to keep | Pass test | Basis |
|---|---|---|---|
| 10: Access kept when in doubt is on an exceptions list with an approver and a recheck date. | The exceptions list. | If each of three exceptions picked from it shows a reason, an approver who is not the account holder and a date to look again, or if the list is empty and says who confirmed that. | Our check. |
| 11: Pairs of rights that one person should not hold together are written down and were compared with the list. | The written pairs and the result of the comparison. | If the pairs are written and each of three people picked from the list holds no pair, or holds one that is on the exceptions list. | CISA and NSA’s guide says identity governance systems can use segregation-of-duties rules to identify non-compliant combinations of privileges. NCSC’s 10 Steps asks policy to say which actions need more than one person. The written pairs and the sample are ours. |
| 12: When a finding repeats from the previous review, it has a cause noted and an owner. | Both reviews’ findings side by side, with notes. | If each finding present in both reviews carries a cause and an owner, or if no finding repeated. | Our check. |
User Access Review Checklist, Part 5: Follow and Repeat the Review
The last group is written for the person who was not there, such as the next person to read the review record and find the access that each user ended up with.
| Check | Evidence to keep | Pass test | Basis |
|---|---|---|---|
| 13: One decision can be traced from the list to the change in the system. | The list line, decision and system change for each sampled removal. | If a person who was not on the review finds the list line, the decision and the system change for each of three removals unaided. | CISA and NSA’s guide says, of identity governance systems, that account creation and modification events can be reviewed and correlated with approved access requests; tracing a removal is our test. |
| 14: The review’s evidence sits with a named keeper, and edits show when made after close. | The store’s location, its keeper’s name and its edit history or read-only setting. | If a person outside the review can open the store. A change made after close must also show in its history or be blocked. | NCSC’s 10 Steps says policy should cover how audit records are safeguarded against tampering; the keeper and edit test are ours. |
| 15: The firm’s own interval, the reason for it and the next date are written down. | One line in the review policy or the closing note. | If the interval, its reason, an owner and a next date are written; the firm sets the length and it is not judged here. | NCSC’s 10 Steps advises regular reviews for unnecessary privileges, and CISA and NSA say, of identity governance systems, that owners can review periodically; neither gives an interval. The written line is ours. |
Using Your User Access Review Checklist Result
Treat the sum as a reading, not a ruling, and set no target for a review of any size, whether it covers the access held by one user or by fifty. In our view, start with check 2, since checks 7, 8 and 11 draw their samples from the list it tests and a 0 there weakens those marks. Then take the part with the lowest marks and clear its 0s before its 1s.
Write who will change what and the date you will test it again.
Run the checklist again on a date you choose, then keep the new sheet beside the old one. Dates on proof are the dates the work was done. If a mark is low, do not create or alter proof afterwards to raise it. When a check scored 1 for lack of proof, keeping proof next time fixes it.
The wider identity set-up has its own list: see the broader access-controls checklist. Unlike this page, it holds a check on the review record.
Audits, Standards and the Limits of a Score
This checklist does not show compliance with any standard or law, and no mark here is an audit result. Which standards and laws bind a firm are questions for its own advisers. The same goes for what they ask of the review, and of the access any user holds, whether the firm is in India or the GCC. No standard or regulation text was read for this page, so it claims nothing about what an auditor expects.
NCSC’s 10 Steps is UK guidance for cyber security professionals. The CISA and NSA guide is US guidance for administrators. Both are ideas to use, not rules for firms in India or the GCC. Neither gives an interval, although both mention reviews. A total of 30 shows only that the sampled items passed the tests that applied when you ran them.
Not covered: why access builds up, how to run a review in order, and whether to compare software or stay with a manual review. Those are separate topics. For how Signisys approaches access recertification in practice, see the use-case page on access certification.
In our view, a second reading is worth having when the weak marks fall in more than one part, or when no one in the firm can say what a listed service account is for.
Key Takeaway A score here is not an audit result and shows no compliance with any standard.
Signisys’ Identity and Access Management solution helps organizations control who can access what. The scope is agreed for each engagement. Our Solution: Identity and Access Management (IAM). Our Service: Cybersecurity Services.
User Access Review Checklist FAQ
What do these 15 checks test?
Who should mark the checks when the same team ran the review?
What should I do with a review nobody can evidence?
What interval should I write for check 15?
Will a score of 30 satisfy an audit or a standard?
Security Insights, Delivered.
Practical, vendor-neutral analysis of threats, tools, and architecture decisions.