User access review checklist: how to prepare a campaign auditors accept

Most failed reviews are not bad decisions. They are incomplete account populations or revocations that were approved and never carried out. Auditors test both.

The PCAOB's auditing standard AS 2201 tells auditors to understand how IT affects the company's flow of transactions, and access to financially significant systems is part of that. NIST SP 800-53 control AC-2 (j) asks organizations to review accounts for compliance at a defined frequency. Commission Delegated Regulation (EU) 2024/1774, the DORA technical standard, sets a floor of at least once a year for staff with access to ICT assets that support critical or important functions.

None of these is met by a campaign that only covered the applications a connector happened to reach.

1. Write the scope as a list of applications, not a list of connectors. Start from the systems in audit scope (financially significant systems for SOX, systems supporting critical or important functions for DORA), then mark which ones your IGA already reads.
2. Load accounts for the applications your IGA cannot read. Microsoft documents a manual path for apps without provisioning in Entra ID Governance: export the users to a CSV file, match them to Entra users, create role assignments, then run the review. Saviynt describes onboarding of disconnected applications into its IGA. Discovery tools such as Orchid Security state that they find unmanaged applications and the accounts inside them, then feed that context to the governance platform already in place. Whichever method you use, record the extraction date and who ran it.
3. Reconcile every account to a person or a named owner. Accounts that match no current employee or contractor are orphan candidates. Put them in the campaign with a flag rather than deleting them quietly beforehand. Microsoft's Entra what's new page lists Account Discovery, which shows accounts in connected apps that match no Entra user, as generally available in April 2026.
4. Separate local, service and break-glass accounts. The holder of these accounts is not a person with a manager, so they need an owner review. Give each one a named owner before the campaign starts. See local account.
5. Translate entitlements into plain language. A reviewer asked to approve an opaque group code will usually approve it. Add a short description for each entitlement in scope, starting with the privileged ones.

6. Match the campaign to the question. SailPoint documents Manager, Source Owner and Search campaigns. In practice, a manager campaign asks whether a person still needs their access, a source owner campaign asks who should have access to one application, and a search campaign targets a defined slice such as all privileged entitlements. Many programs run a manager campaign for broad access and a source owner campaign for each high-risk application.
7. Set a deadline and an escalation path. Decide in advance what happens to an item nobody decides on. A default of revoke is stricter; a default of keep needs a documented reason.
8. If low-risk items are approved automatically, write the rule down. SailPoint describes AI-driven certifications that auto-certify low-risk access, and Saviynt describes recommendations for reviewers. Auditors will ask how the rule was set and who approved it, so keep both in the evidence file.

9. Carry out and verify every revocation. For connected applications the IGA removes access. For disconnected ones someone removes it by hand or through a ticket; Microsoft's procedure includes an optional ServiceNow ticket for manual removal. Pull the account list again afterwards and confirm the revoked accounts are gone. NIST SP 800-53 AC-2 (f) covers disabling and removing accounts in line with policy, and AC-2(3) covers disabling accounts that are no longer associated with a user.
10. Assemble the evidence file: the scope list with extraction dates, reviewer assignments, each decision with its timestamp, the revocation records and the post-review account pull. The identity audit evidence guide sets out what SOX, NIST SP 800-53 and DORA each ask for.

Scores for each tool are on the comparison page, and the method each vendor describes for apps with no connector is in the Disconnected-App Coverage Ledger on the same page.