# Access Review: [system] – YYYY-MM-DD

> Periodic user-access audit – who still needs what, and who lost it.
> Deprovisioning evidence is the artifact auditors ask for.

| Field | Value |
|-------|-------|
| System | [app / infra] |
| Review period | [quarter] |
| Reviewer | @name |
| Approver | @name (system owner) |
| Status | In progress / Complete |

## Review scope

- Population: N accounts pulled YYYY-MM-DD
- Criteria: least privilege, role match, employment status

## Findings

| Account | Role / access | Last active | Keep / Modify / Revoke | Reason |
|---------|---------------|-------------|------------------------|--------|
| @user | [role] | YYYY-MM-DD | | |
| @user | | | | |

## Actions taken

| Account | Action | Ticket | Done |
|---------|--------|--------|------|
| @user | Revoked [access] | [ticket] | [ ] |

## Summary

- Accounts reviewed: N
- Revoked: N
- Modified: N
- Exceptions noted: N

## Exceptions

| Account | Exception | Compensating control | Expiry |
|---------|-----------|----------------------|--------|
| @user | [why it stays] | [what makes it safe] | YYYY-MM-DD |

## Sign-off

| Reviewer | Approver | Date |
|----------|----------|------|
| @name | @name | YYYY-MM-DD |

Next review due: YYYY-MM-DD