Access reviews are one of the few controls every framework asks for, and one of the most common places teams get partial credit. The work is usually done. The record of it usually is not.
This runbook covers the four steps and, more importantly, the four artifacts each step has to leave behind.
What is in it
The in-scope test, and a typical system list
Step-by-step: capture the population, review, remediate, close
The four artifacts an auditor samples, and how each one commonly fails
Framework references for SOC 2, ISO 27001 and HIPAA
Why the population export matters most
It is the step people skip, because at the time it feels redundant, you can always pull the list again. You cannot. Pulling it in October tells you nothing about who had access in June, and a reconstructed population is treated as unreliable, correctly.
Download it directly. It is a Markdown checklist, so you can drop it straight into a ticket or a wiki and tick items off in place. ::