Access reviews that find the problems.
Reconcile HR people records against every system's access exports with a deterministic, rule-based analysis. It surfaces leavers with access, dormant users and generic and service accounts in one identity census.
Owner notified by email · Due in 5 days · Full history retained for audit.
3 gaps identified; 2 map to existing risks, 1 proposed as a new finding. Approve or reject each before accepting.
Illustration with sample data
What User Access Review does
User access reviews are among the most-requested pieces of audit evidence and among the most tedious to perform. Upload CSV or Excel exports from HR and IT systems, or pull them from Azure, and give each file a role: Master People Record, Base Technical Record or Top-up Record. Each role can hold several files.
A fixed, rule-based pipeline works out each identity's user, people and top-up status. Where a role has several files, an identity must be present in every designated file, so one stray export can't hide a problem. Results appear as one census table with a row per identity, column filters and the actions that apply to it. Eligible service accounts can be sent straight to NHI & NHA Governance for ownership and certification.
Key capabilities
Upload or connect
CSV or Excel exports, or a pull from Azure.
Record roles
Master People, Base Technical and Top-up records, several files each.
Deterministic analysis
Fixed rules decide each identity's status, with no guesswork.
AND logic across files
An identity must appear in every designated file of a role.
Identity census
One row per identity with filters and resizable columns.
Send to NHI governance
Eligible service accounts move to the NHI register.
The business case.
Efficiency, multi-framework alignment, reduced complexity and streamlined processes: what User Access Review changes for your programme.
Less reconciliation effort
Automated cross-checking replaces spreadsheet lookups across systems.
Access rights reviewed
Documented periodic reviews support access-control requirements across frameworks.
Orphaned access removed
HR-to-system reconciliation finds terminated users who still have access.
Many frameworks
The same review evidence supports ISO 27001, PCI DSS, SOC 2 and ITGC.
Efficiency figures compare the effort of each workflow cycle in RiskVantis with the same work done manually or in a traditional GRC tool. Your result depends on your starting point; we will model it with you in a demo.
From setup to outcome.
Create a review
Start a review for the assessment date.
Load files
Upload exports or pull from Azure.
Assign roles
Designate master, technical and top-up records.
Analyse
Review the census, act and send service accounts to NHI.
Supports your obligations.
User Access Review contributes evidence and coverage to these frameworks and regulations.
Common questions.
Is the analysis AI-based?
No. A fixed, rule-based pipeline decides each identity's status, so results are repeatable and explainable.
Can a role have several files?
Yes. Each role can hold several files, and an identity must be present in every designated file.
What happens to service accounts found in a review?
Eligible accounts can be sent to NHI & NHA Governance for ownership, risk scoring and certification.
Works better together.
NHI & NHA Governance
Service accounts, app registrations, managed identities and API keys now outnumber people. Give each one an owner, an explainable risk rating, live policy checks and a…
Learn more →Platform, Security & IntegrationsIdentity, SSO & Access Governance
Single sign-on with your directory, MFA, and one permission engine for personas, deny rules, field-level security and segregation of duties. Access reviews, break-glass…
Learn more →Risk ManagementFindings Management
Track every gap raised by audits, assessments, scans, control tests and connected systems. Give each one owners and an approved remediation plan, and let AI turn…
Learn more →See User Access Review in action.
Book a 30-minute walkthrough tailored to your frameworks, vendors and team.