Ask any assessor what they find most often, and stale accounts will come up early. A contractor's VPN login still works after the contract ended. A former nurse still has access to the EHR. A service account was created for a project in 2022, and nobody knows who owns it. None of these are exotic, but every one of them is a door that a stolen password can open.
This matters because attackers rarely need to break in when they can log in. An account that should have been disabled has the same access as a live one. Nobody is watching it, and no user is going to notice and report strange activity on it.
What reviewers actually look for: in federal and defense work, this is NIST SP 800-53 AC-2 (Account Management): accounts are approved, reviewed on a set schedule, and disabled when no longer needed. Under AC-2(3), inactive accounts are disabled after a defined period. PS-4 (Personnel Termination) connects HR separations to access removal. In healthcare, the HIPAA Security Rule asks for the same discipline in plainer words: termination procedures under 164.308(a)(3)(ii)(C) and information access management under 164.308(a)(4).
Reviewers aren't asking whether you bought an identity governance platform. They ask three questions. Can you show me who has access? Can you show me someone checked that list recently? And can you show me that when someone left, their access went with them?
A review you can actually sustain doesn't need a big program. You need a cadence and a paper trail.
1. Pull the list. Export users and their roles or groups from your identity provider and each critical system, such as email, the EHR or main business app, VPN, cloud console, and admin tools. A spreadsheet is fine.
2. Match it to HR. Compare the export against current staff and active contractors. Anyone who isn't on both lists gets flagged.
3. Have owners attest. Send each manager or system owner their list and ask for a simple keep, change, or remove for each entry. Their reply is your evidence.
4. Act and record. Disable what should go, and write down the date and who approved it. Pay extra attention to privileged and shared accounts; they deserve a monthly look, not a quarterly one.
5. Fix the leak at the source. If the same kinds of accounts keep turning up, the offboarding process is broken. Add a step to the HR separation checklist so access is removed the same day.
Quarterly reviews for standard users and monthly reviews for privileged accounts are a defensible starting point for most small and mid-sized organizations. Write the frequency into your policy so the reviewer can see you're doing what you said you would.
Service accounts deserve a name. Every non-human account should have a human owner, a documented purpose, and the least access it needs. If nobody will claim an account, disable it and see who complains. That's a legitimate way to find out who owns it.
The bottom line: an access review isn't glamorous, but it's one of the cheapest controls to run and one of the easiest to prove. It shrinks your attack surface, gives you clean evidence for AC-2 and HIPAA access requirements, and turns a recurring finding into a closed one.
If your last access review was "whenever someone remembered," start this quarter. The first one is the hardest; after that, it's a calendar invite.
Governance Guard Cyber helps organizations write access reviews into a program a reviewer can follow: who is covered, how often, and what evidence you keep. If that is the gap, request a consultation.