Running a SaaS Access Review: Who Has Access to What — and Should They?

Access reviews — the periodic process of verifying that every user's system access remains appropriate — are required by SOC 2, ISO 27001, HIPAA, and most enterprise security frameworks. They're also one of the most consistently poorly executed governance activities in practice.

Why Access Reviews Fail

The typical access review failure mode is a spreadsheet sent to 50 managers asking them to confirm their team's access is appropriate. Response rates are low, responses are often rubber-stamped without real review, and the process produces documentation but not genuine assurance.

A Better Approach

Effective access reviews are tool-by-tool rather than manager-by-manager. For each critical application, the tool owner receives a list of current users and their last activity date. They're asked to confirm or revoke access for each user, with a specific deadline. This keeps the review scoped and actionable.

Frequency and Scope

Quarterly reviews for your most sensitive systems (financial tools, customer data systems, HR platforms) and semi-annual reviews for other business applications is a practical rhythm that most security frameworks accept. Annual reviews are insufficient for high-risk systems — too much changes in twelve months.

Automating the Access Review Process

Manual access reviews are slow, error-prone, and don't scale. Platforms that integrate with your SaaS management system can generate access review tasks automatically, send them to the appropriate tool owner with pre-populated user lists and last-activity data, track responses, and escalate when reviews are overdue. This automation transforms access reviews from a weeks-long manual exercise into a structured, trackable process that completes in days.

For tools connected to SSO, the access review system can automatically deprovision users whose access is not re-confirmed within the review window — removing the manual step between "review complete" and "access revoked." This is the gold standard for access review automation and is achievable for most organisations using Okta, Entra ID, or Google Workspace as their identity provider.

Evidence and Documentation

The output of each access review must be documented in a way that satisfies auditors. Required evidence includes: the date the review was initiated, the list of users reviewed, the reviewer's decision for each user (confirm or revoke), the date decisions were recorded, and the date revocations were completed. A system that captures all of these automatically — without requiring manual documentation — is essential for running access reviews at scale without drowning in administrative overhead.

Store access review records for at least three years — the typical lookback period for SOC 2 Type II and ISO 27001 audits. Cloud-based SaaS management platforms typically retain records indefinitely, but verify your platform's data retention policy and export records before migrating to a new system to ensure continuity of your compliance evidence trail.

Closing the Loop: Acting on Review Findings

An access review that identifies issues but doesn't act on them is worse than no review — it creates documented evidence that you knew about an access problem and didn't address it. Establish a defined SLA for completing revocations identified in access reviews: 24 hours for high-sensitivity systems, 5 business days for standard tools. Track revocation completion rates as a metric and escalate to leadership when SLAs are missed. The access review is only as valuable as the action it drives.