A user access review is the periodic process of examining who has access to what systems, applications, and data within your organization, verifying that each person's access level is appropriate for their current role, and revoking access that is no longer needed. User access reviews are required by SOC 2, ISO 27001, HIPAA, and other compliance frameworks as a core identity and access management control.
A user access review (sometimes called a user access certification or entitlement review) is the process of verifying that every user account in your systems has the right level of access for their current role, and only that level of access. It answers three questions:
The goal is to enforce the principle of least privilege over time. People change roles, leave the company, or accumulate permissions they no longer need. Without regular reviews, access drifts, and that drift creates security risk.
A thorough access review examines:
NIST SP 800-53 (AC-2) requires organizations to review accounts for compliance at an organization-defined frequency. In practice, the standard cadences are:
Most startups default to quarterly reviews across the board because it satisfies SOC 2 requirements and is manageable with the right tooling. The critical thing is consistency: auditors want to see that reviews happened on schedule throughout the audit period, not just right before the audit.
Fencer auto-discovers accounts across your connected services, including both human and non-human identities (service accounts, bots, API keys). It flags accounts missing MFA, users with excessive permissions, and inactive accounts that should be deprovisioned. When it's time for a quarterly review, Fencer generates exportable CSV reports that satisfy SOC 2, ISO 27001, and other audit requirements, reducing review time from days to minutes.
For a startup with 20 to 50 employees and 15 to 30 SaaS tools, a manual access review (logging into each tool, exporting user lists, cross-referencing against HR records, documenting findings) typically takes 2 to 5 days per quarter. With automated tooling that discovers accounts and flags issues, the same review can be completed in under an hour. The bottleneck shifts from data gathering to decision-making: reviewing flagged accounts and confirming whether access should be maintained or revoked.
The terms are often used interchangeably, but there's a practical distinction. A user access review is the periodic internal process of verifying that access is appropriate. An access audit is typically the external validation (by your SOC 2 auditor, for example) that your review process exists, is followed consistently, and produces documented evidence. The review is what you do; the audit is someone else checking that you did it. Your auditor will sample your access review records to verify they happened on schedule and that issues were remediated.
Prioritize based on data sensitivity and risk. Systems that store customer data, financial records, source code, or infrastructure credentials should be reviewed every quarter without exception. Lower-risk tools can follow a lighter cadence. Your SOC 2 auditor will focus on systems that are in scope for the audit, which typically includes anything that touches customer data, production infrastructure, or security controls. When in doubt, include it.
