A user access review audit tests whether the entity's periodic review of who has access to financial systems operates as designed, by confirming the review actually occurred on the stated frequency with a complete population of users, that any access flagged for removal during the review was actually revoked within a reasonable period afterward rather than merely noted, and that access for employees who left the organisation or changed roles was removed on or near the termination or transfer date rather than lingering until the next scheduled review cycle.
Testing that the review itself happened, completely
- Obtain evidence of the review for the period under audit — a signed-off user list is a starting point, not sufficient evidence on its own — and confirm the population reviewed matches the full active user list from the system at that date, not a subset.
- Check the reviewer had the authority and knowledge to actually assess appropriateness of access — a review signed off by someone with no visibility into what a given access right actually permits is a review in name only.
- Confirm the review covered privileged and administrator-level access, not just standard user access — privileged accounts carry the highest risk and are sometimes excluded from the standard review population because they are managed by IT rather than the business.
Testing that flagged access was actually removed
| Check | Evidence | What it catches |
|---|---|---|
| Flagged-to-removed tracing | Review sign-off list, subsequent access change log | Access flagged as inappropriate during review but never actually revoked |
| Termination-to-revocation timing | HR exit date, access revocation timestamp | Access lingering for days or weeks after an employee's last working day |
| Role-change access cleanup | Transfer records, access change log | Old-role access retained alongside new-role access after an internal transfer |
| Privileged account coverage | Admin account list against the review population | Administrator or service accounts excluded from the regular review cycle entirely |
Common practice, not a requirement
Many entities run access reviews quarterly or semi-annually; the specific frequency is a design choice the entity makes based on its risk assessment, not a fixed external requirement for most financial-system access. What matters for audit purposes is that the chosen frequency is actually followed and that the review is demonstrably effective, not the specific interval chosen.
Access removed late for a terminated employee is a frequent finding precisely because the control usually looks sound on paper — a review happened, a sign-off exists — while the operative fact, how many days elapsed between the person's last day and their access actually being revoked, is the number that tells you whether the control works.
This is practical guidance written for audit teams, not an authoritative statement of any standard or statute. Standards, forms and timelines change. Check the current text issued by the ICAI and the relevant authority before relying on anything here in an audit file.
Related resources
- Internal audit & IFCIFC testing: internal financial controls over financial reportingHow IFC testing differs from a substantive statutory audit, what design versus operating effectiveness testing actually means in practice, and what the file needs to show for each.
- Internal audit & IFCBuilding a risk control matrix (RCM) for audit testingHow to structure an RCM so it actually drives testing, map it to financial statement assertions, and stop it from becoming the document nobody updates after the first year.
- Internal audit & IFCTesting segregation of duties: a practical approachThe classic SoD conflicts, how to test for them in a small finance team where perfect separation is not realistic, and how to document the compensating controls that stand in.
- Internal audit & IFCControl walkthrough documentation: what belongs in the fileWhat a control walkthrough has to establish beyond description, narrative versus flowchart formats, and the shortfalls that recur most often on file inspection.
Free tools, no signup
Each one reads a file entirely in your browser — or, for two of them, just answers a few questions — and nothing is ever uploaded.
- Purchase register checkDuplicate payments, round-sum amounts, weekend-dated invoices, incomplete records.
- GSTR-2B reconcilerMatches your purchase register against GSTR-2B — missing invoices either side, amount mismatches.
- Bank reconciliation checkerMatches your cash book against a bank statement — what's outstanding on each side.
- Fixed asset register checkDuplicate asset codes, missing location or useful life, negative net book value.
- Payroll red-flag scannerBank accounts shared across employees, and records missing an ID, PAN or salary.
- CARO applicability checkerAnswer a few questions about the company and see which CARO 2020 clauses likely apply.
- MSME payment delay checkerMSME-flagged invoices paid — or still unpaid — beyond the 45-day Section 22 limit.
- Related-party transaction screenerTransactions above a threshold you set with no approval reference, grouped by counterparty.
- Depreciation useful life checkerCompares a useful life in use against the Schedule II, Part C indicative figure.
- Materiality calculatorOverall and performance materiality against PBT, revenue, assets or equity, with reasoning shown.
- Sample size calculatorStatistical sample size for a test of controls or a substantive test of detail.