Periodic access reviews act as the safety net that catches whatever the Joiner-Mover-Leaver process missed — the orphaned account, the entitlement nobody remembered to remove, the access that made sense a year ago but not today.
| Access Type | Typical Frequency |
|---|---|
| Privileged/admin access | Quarterly |
| Standard business application access | Semi-annually or annually |
| High-risk systems (core banking, payments) | Quarterly |
| Segregation-of-duties combinations | Quarterly, or on every role change |
| Step | Owner | Action |
|---|---|---|
| 1 | IAM/Compliance | Generates the access review campaign (list of users and entitlements per system) |
| 2 | Manager | Reviews each direct report's access; attests "still needed" or flags for removal |
| 3 | System Owner | Reviews access from a system perspective, independent of the manager's view |
| 4 | IAM | Executes removals for anything not attested |
| 5 | Compliance/Audit | Reviews completion rate and evidence; escalates overdue reviews |
- Context, not just entitlement names — a manager attesting to "GL_Posting_Access" without knowing what that grants is a rubber stamp, not a review. Reviews should show a plain-language description of what each entitlement allows.
- Independent second view — manager attestation alone tends to default to "approve everything." Pairing it with a system-owner review catches what managers don't think to question.
- Consequences for non-completion — an access review with no enforcement mechanism (e.g., auto-revoke on overdue reviews) becomes a formality within a year.
- Evidence retention — who reviewed, when, what they decided — needed for every audit that touches this control.
Meridian runs quarterly reviews for its core banking system and the AML case management platform, and annual reviews for general business applications (email, HR self-service, shared drives). Overdue reviews past 30 days trigger an automatic escalation to the CISO's office and, at 60 days, an automatic access suspension pending review.
flowchart LR
A[Campaign Generated] --> B[Manager Attestation]
B --> C[System Owner Review]
C --> D{Attested?}
D -->|Yes, needed| E[Access Retained]
D -->|No / Not reviewed| F[Access Removed]
E --> G[Evidence Logged]
F --> G