The Quarterly Access Review That Actually Removes Access

Every quarter the same spreadsheet goes around. Managers scroll, click approve, and send it back. Nobody's access changes. The review happened; the risk stayed.

A rubber-stamp review is worse than no review, because it creates a record that says someone checked. The fix is not a bigger spreadsheet. It is a review designed to remove things.

Five design choices turn the quarterly review from a signature exercise into actual access reduction.

TLDR

• Measure the review by removals, not completion.

• Review fewer things better: start with the access that can hurt you most.

• Every exception gets an owner and an expiry date.

• Ask managers what should go, not whether everything is fine.

• Keep an evidence pack: what was reviewed, what was removed, what expires when.

Design for removals, not approvals

The default question - "is this access still appropriate?" - invites a yes. Change the question to "what can we take away?" Give each reviewer a target: find the accounts this person no longer uses, the role they left, the project that ended.

NIST's access control guidance treats account management as an ongoing process of reviewing and adjusting accounts, not a quarterly signature. A review that never removes anything is not managing accounts; it is filing them.

Start where it hurts

Reviewing everything with equal care means reviewing nothing well. Put privileged accounts, finance systems and customer data at the front of the queue. Give the long tail a lighter touch: group-based checks, automatic expiry for dormant accounts.

The review evidence pack

One page per cycle tells leadership the review is real. The numbers below are illustrative.

Evidence (illustrative)	Last quarter	This quarter	What it tells you
Accounts reviewed	1,240	1,180	Scope is shrinking as access is cleaned up
Access removed	12	87	The review is actually reducing access
Exceptions granted with expiry	0	19	Judgment calls are recorded and time-limited
Expired exceptions re-approved silently	n/a	0	Expiry is enforced, not rolled forward

Completion is not the goal. A 100 percent complete review that removes nothing is a cost, not a control.

Make exceptions expire

Some access should stay even though it breaks the rule: the auditor, the emergency admin, the legacy system no one can touch. Fine. Record each exception, name its owner, and give it an end date. When the date passes, the access goes unless someone argues for it again.

Report what changed

Leadership does not need the spreadsheet. It needs the summary: how much access was removed, which exceptions are open and when they expire, and which systems were not reviewed at all. For the access review that follows an acquisition close, see the day-two access review nobody scheduled.

Frequently asked questions

How often should we review access?

Quarterly suits most organizations for privileged and sensitive access. Lower-risk access can run on a slower cycle or on automatic expiry for dormant accounts.

Who should do the reviewing?

The person's manager knows what they do all day; the system owner knows what the access can do. The best reviews ask both, briefly.

What about service accounts and vendors?

They belong in scope. Non-human accounts and third-party access are where reviews most often find things nobody remembers granting.

What if managers keep approving everything?

Change the measure. When leaders see "removals this quarter" next to each manager's name, behavior changes fast.

A Defensible Next Step

Pull the last two quarterly reviews and count how many accounts lost access. If the number is zero, the review is a signature exercise. Book a Decision-Clarity Call if you would like help redesigning it around removals and evidence.