The Evidence That Wasn't There

Your external auditor reviews your Q3 access review documentation. She confirms: 94% completion rate, 127 inappropriate access grants revoked, evidence package delivered on time. Everything looks perfect.

Then she asks: "Can I see proof that the 127 revocations were actually executed?"

You show her Jira tickets marked "complete."

She asks: "Did anyone test that users can no longer access the system after revocation?"

You check. They didn't. The tickets were closed as "complete" without anyone verifying that the user's access was actually removed.

Your auditor's risk rating jumps from "acceptable" to "significant risk."

This is access review audit failure.

What do auditors test during access reviews?

When an auditor reviews your access review documentation, they're looking for evidence that:

• Your access review was actually conducted (not just claimed)
• The right people reviewed the right access (appropriate segregation of duties)
• The access reviewed was complete and accurate (no missing users or permissions)
• Access identified as inappropriate was actually removed (remediation was executed)
• The entire process is documented (evidence for future audits)

Most organizations fail on item 4: proving that inappropriate access was actually removed.

1. Proof that your access review was actually conducted

Auditors want to see evidence that an access review actually happened—not just a document claiming it happened.

What auditors test:

• A list of systems reviewed (with evidence that each system was actually queried)
• A complete list of users from each system
• A record of who reviewed what and when
• Dates of the review (when it started, when it was completed)

What auditors are looking for: Evidence that you didn't just make up a list. You actually extracted data from each system and reviewed it.

How to pass this test:

• Use a tool that keeps a record of data extraction (timestamps, data line counts, system names)
• Keep export data with timestamps
• Document which systems were reviewed and the date of the review

What most people do wrong: They create a spreadsheet from memory or old data, then claim the review was done. Auditors can usually tell the data is stale.

2. Proof that the right people reviewed the right access

For access reviews to be effective, the right people need to review the right access. This means:

• Managers review the access of their direct reports
• System owners review system access
• Not the same person reviewing and approving (segregation of duties)

What auditors test:

• A mapping of who reviewed what
• Confirmation that the right manager reviewed the right user
• Confirmation that the reviewer is authorized to review that access

What auditors are looking for: That you have a process (not random) for assigning reviewers, and that you can prove the right people reviewed the right users.

How to pass this test:

• Document your reviewer assignment logic ("managers review their directs")
• Use a tool that enforces this routing (so you can't accidentally assign the wrong reviewer)
• Keep records of who was assigned to review what and when

What most people do wrong: They send all access to all managers with "review yours." Managers don't know what's theirs. Some review access that's not their responsibility. It's a mess.

3. Proof that your access list was complete and accurate

Auditors want to know that your access review captured all users and all access—not just some of it.

What auditors test:

• A complete list of users from each system (not a sample)
• Confirmation that the list matches the system of record
• No unexplained gaps or exclusions

What auditors are looking for: That you didn't just "spot check" a few users. You reviewed all of them.

How to pass this test:

• Extract user lists from each system completely
• Compare against your HR system or identity provider (to confirm you got everyone)
• Document any exclusions (service accounts, test users, etc.) and why they were excluded

What most people do wrong: They manually pull data from a few key systems and ignore others. They spot-check instead of reviewing comprehensively. They forget to include test accounts or service accounts.

4. Proof that inappropriate access was actually removed

This is where most organizations fail.

Your auditor sees:

• 127 inappropriate access grants identified
• 127 Jira tickets created for remediation
• 127 tickets marked "complete"

Then she asks: "Did you verify that the user's access was actually removed?"

What auditors test:

• A record of access remediation (what was removed)
• Proof that the removal was actually executed (not just claimed)
• Confirmation that the user no longer has the access
• Timestamps of when access was removed

What auditors are looking for: That you didn't just mark tickets as complete. You verified that access was actually gone.

How to pass this test:

• After remediation, re-export user access from the system and confirm the user no longer has that access
• Document the before/after state (access existed, now it doesn't)
• Keep records of remediation actions with timestamps
• For sensitive access, have an independent person verify the removal

What most people do wrong: They mark a Jira ticket as "complete" without verifying. They don't do a post-remediation audit. They trust that the system owner removed the access without confirming.

5. Proof that the entire process is documented

Auditors want a complete record of the access review: from start to finish, every decision, every remediation, every sign-off.

What auditors test:

• A documented access review plan (scope, timeline, reviewers)
• Evidence of reviewer sign-offs (who reviewed, when, what they approved)
• A record of all identified risks (inappropriate access)
• A record of all remediation actions (what was removed, when, by whom)
• A final summary report (what was reviewed, what was found, what was done)

What auditors are looking for: A complete audit trail from the first day of the review to the last remediation action.

How to pass this test:

• Use a tool that generates an audit trail automatically
• Document your review process and timeline upfront
• Create a sign-off from leadership confirming the review was completed
• Keep all evidence in one place (don't scatter it across spreadsheets)

What most people do wrong: They create a 50-slide PowerPoint with nice charts. Auditors want documentation, not presentation. They keep evidence scattered across multiple tools and spreadsheets. When an auditor asks "show me the proof," they can't find it quickly.

The real difference between passing and failing an access review audit

Organizations that pass access review audits have:

• Complete, accurate data extracted from every system
• Documented proof that the right people reviewed the right access
• Post-remediation verification that inappropriate access was actually removed
• Complete documentation of the entire process as an audit trail

Organizations that fail don't have these. They have spreadsheets, good intentions, and Jira tickets marked complete. But they don't have proof.

The fix is switching from a manual, spreadsheet-driven process to a documented, auditable process that generates evidence automatically.

Summary

Auditors test access reviews for five things: that the review was actually conducted, the right people reviewed the right access, your access list was complete, inappropriate access was actually removed, and the entire process is documented. Most organizations pass on the first three and fail on the last two. The solution is moving to a documented, auditable process with built-in evidence generation and post-remediation verification.