Lesson 4 of 5
Access reviews
9 min
Listen to this lesson
Access tends to accumulate. People change jobs and keep old roles, temporary cover becomes permanent, and accepted risks outlive the reason they were accepted. Periodic reviews are the detective control that catches this drift. SAP Access Control supports several kinds, each answering a different question.
| Review | Question | Reviewer | Driven by |
|---|---|---|---|
| User access review | Does this user still need each role? | Manager or role owner | MSMP workflow |
| SoD review | Is this user's SoD or critical risk still justified? | Manager or risk owner | MSMP workflow |
| Role reaffirm | Is this role still needed at all? | Role owner | Reaffirm date in the role definition |
| Role certification | Is the role's content still correct? | Role content approver | Certification date in the role definition |
Planning a user access review
A review campaign has a scope, reviewers, a schedule and a way to act on the results. For Contoso's first post-go-live review, Nadia and Dan plan: all users in CMP with finance or procurement roles, reviewed by line managers, with role owners as a second stage for high-risk roles. The review runs quarterly for privileged and high-risk access and twice a year for everything else; these frequencies are Contoso's own policy, set with the auditors, not an SAP default.
- Prepare dataSynchronize users, roles and the organizational data that determines reviewers.
- Generate requestsOne review request per reviewer, listing each user and role.
- ReviewReviewers approve or remove each assignment, with comments; risk information shown alongside.
- EscalateOverdue reviews are reminded and then escalated.
- DeprovisionRemovals are carried out in the target system and recorded.
- ReportCompletion, removals and exceptions go into the audit evidence pack.
Making reviews meaningful
The classic failure is rubber-stamping: a manager receives 400 lines of role technical names and approves them all. Reviews work when reviewers can understand what they are approving and are asked a manageable question. Contoso's role names and descriptions describe jobs in business words ("AP clerk, company code 1710"), and the review shows when each role was last used where usage data is available. Reviewers with large teams get the review in smaller batches.
- Use business-readable role names and descriptions; reviewers approve jobs, not technical objects.
- Show risk information and, where available, last usage, so obvious removals stand out.
- Require a comment when a high-risk assignment is kept.
- Track removals to completion: a removal decided but not provisioned is a finding.
- Measure: completion on time, number of removals, reviewers who approved everything without change.
SoD reviews follow the same pattern, but the question is about risk: is the accepted conflict still needed, and is its mitigating control still valid and performed? They are the natural place to re-approve mitigations whose validity is ending. Role reaffirm and certification look at roles rather than users and keep the role catalog itself from bloating.
Reviews and the role catalog
Role reaffirm and role certification keep the catalog behind the reviews healthy. If Contoso's role catalog grows by a few roles every month with nobody asking whether old ones are still used, user access reviews get harder each quarter, because reviewers face more and more names. Nadia sets a reaffirm date on every business role, so each role owner confirms once a year that the role is still needed, and a certification date on high-risk roles, so the content is checked against the current design.
What would you do?
After the first quarterly review, Nadia's report shows that one manager with 85 direct reports approved every assignment within four minutes, including two users who left the company last month. What should Nadia do?
- User access reviews, SoD reviews, role reaffirm and role certification answer different questions.
- Plan scope, reviewers, frequency, escalation and deprovisioning before launching a campaign.
- Business-readable roles and usage information prevent rubber-stamping.
- A removal decided but not provisioned is a finding; track it to completion.
- SoD reviews re-confirm accepted risks and their mitigating controls.
Check your understanding · not graded
Lesson check
1. Which review checks whether a role is still needed at all?
2. What is the most common way user access reviews fail?
3. A reviewer decides to remove a role, but it is never removed in CMP. How should this be treated?
4. Which review is the natural place to re-approve mitigating controls whose validity is ending?