Review the people, roles and service accounts
Compare the current access list with approved roles. Check leavers, transfers, privileged accounts, shared accounts, service accounts and conflicting responsibilities.
Ask whether each person still needs the access and whether the role can change or approve important records. Record the reviewer, evidence, exceptions and corrective actions.
Work from one record
Use the template below to record the system, review scope, current access, decisions and follow-up. Remove or correct inappropriate access through the approved process; the review itself does not change permissions.
Use the template on this page
Version 2.0 · Updated 2026-09-21 · Operations
Evaluate current user and service-account access against approved GxP roles, responsibilities, least privilege, and segregation of duties.
Adapt this template to your intended use, applicable requirements, and approved procedures.
When to use it
At the approved frequency and after role, employment, system, process, or access-model change.
Information needed before starting
- Current account/role export and approved role matrix
- Current job assignments and joiner/mover/leaver records
- Previous exceptions, service-account owners and removal evidence
Field instructions
- System and review period: Identify the system and account-export date, review period and account/role population in scope.
- Approved GxP and privileged roles: Identify the account or role, permitted actions and business justification. Check authorization, inappropriate combinations, inactive accounts and evidence of removal or correction.
- User or service account: Identify the account or role, permitted actions and business justification. Check authorization, inappropriate combinations, inactive accounts and evidence of removal or correction.
- Current job responsibility and owner: Identify the system/service or process, version and accountable roles. Specify the scope and supporting record rather than relying on a product name alone.
- Assigned access: Identify the account or role, permitted actions and business justification. Check authorization, inappropriate combinations, inactive accounts and evidence of removal or correction.
- Access appropriate: Compare assigned access with approved responsibilities; record the justified yes/no decision, exceptions and required corrective action.
- Segregation of duties: Identify the account or role, permitted actions and business justification. Check authorization, inappropriate combinations, inactive accounts and evidence of removal or correction.
- Inactive or terminated status: Identify the account or role, permitted actions and business justification. Check authorization, inappropriate combinations, inactive accounts and evidence of removal or correction.
- Exception and expiry: Record the issue, affected functions/records, impact, containment, action owner and resolution or expiry. Link correction and retest evidence; retain unfavorable results.
- Action and completion evidence: Record the remediation owner, due date and evidence that the access change was completed and checked.
- Reviewer and approver: Record the supported decision, restrictions, unresolved issues and rationale. Identify the accountable reviewer/approver and dated evidence under your procedure.
- Conclusion and next review: Record the supported decision, restrictions, unresolved issues and rationale. Identify the accountable reviewer/approver and dated evidence under your procedure.
Define the specific system, service, change, population, and intended use.
Complete each field from available records and accountable interviews; record unknowns rather than guessing.
Link conclusions to affected GxP functions, failure scenarios, controls, evidence, and approval.
Adapt the structure to the organization’s approved procedures and document-control process.
Completed fictional example
Fictional teaching example; this is not an executed or approved validation record.
| Field | Completed example |
|---|---|
| System and review period | Fictional eQMS; annual review |
| Approved GxP and privileged roles | Investigator, Quality approver, administrator, read only |
| User or service account | Former Quality reviewer now IT support |
| Current job responsibility and owner | Application support; IT manager |
| Assigned access | Quality approver and administrator |
| Access appropriate | No; approval is not required for support |
| Segregation of duties | Approval plus administration creates conflict |
| Inactive or terminated status | Active employee; employment alone does not justify role |
| Exception and expiry | Temporary support exception expires in five days |
| Action and completion evidence | Approval removed; ticket-based elevation retained; activity reviewed |
| Reviewer and approver | Process owner and Quality approval |
| Conclusion and next review | Appropriate after removal; next scheduled or role-change review |
Blank template
System / record ID: ____________________
Prepared by / date: ____________________
Required review / approval under local procedure: ____________________
| Field | Your entry |
|---|---|
| System and review period | ____________________ |
| Approved GxP and privileged roles | ____________________ |
| User or service account | ____________________ |
| Current job responsibility and owner | ____________________ |
| Assigned access | ____________________ |
| Access appropriate | ____________________ |
| Segregation of duties | ____________________ |
| Inactive or terminated status | ____________________ |
| Exception and expiry | ____________________ |
| Action and completion evidence | ____________________ |
| Reviewer and approver | ____________________ |
| Conclusion and next review | ____________________ |
Relevant regulations and guidance
These sources apply within their stated scope. The suggested worksheet fields, test designs and fictional decisions are practitioner recommendations, unless a source requirement is expressly identified. Completing a template does not establish compliance.
Computer Software Assurance for Production and Quality Management System Software ↗
Regulatory guidance / GMP guideline · United States · February 2026
Scope: Medical-device manufacturers assuring software used in production or their quality management system.
Relevance: For medical-device production or QMS software, supports selecting assurance activities from intended use, risk and available evidence. It is nonbinding guidance and does not determine other sectors’ obligations.
Status: Final / published · Checked 2026-09-21
Publication identity, scope and status checked against the linked official source. This is not an independent audit of every retained guide statement.
Read source details and applicability →EudraLex Volume 4, Annex 11 — Computerised Systems ↗
Regulatory guidance / GMP guideline · European Union · January 2011 revision
Scope: Computerised systems supporting activities in the applicable EU pharmaceutical GMP context.
Relevance: For computerised systems used in EU GMP activities, informs lifecycle, supplier and record controls. Confirm applicability to the actual activity; the example does not establish it.
Status: Final / published · Checked 2026-09-21
The Commission index confirms the January 2011 operative revision. The linked PDF could not be retrieved in this check; retained detailed section mappings need review against an authorized copy.
Read source details and applicability →21 CFR Part 11 — Electronic Records; Electronic Signatures ↗
Regulation · United States · Current eCFR text
Scope: Electronic records and signatures within FDA Part 11 scope, tied to the underlying required records.
Relevance: Assess applicability to electronic records required by FDA predicate rules and electronic signatures used in their place. The presence of an electronic record alone is not an applicability conclusion.
Status: Final / published · Checked 2026-09-21
Publication identity, scope and status checked against the linked official source. This is not an independent audit of every retained guide statement.
Read source details and applicability →Was this useful? Leave feedback
Was this resource useful?
Was this template clear and useful? Tell us which instruction or field could be improved.
Loading contribution options…
Suggest a correction
Sent privately to the editorial moderation queue. Your account email and correction are not published as a comment. Do not include confidential or personal information.
Resource: User Access Review
Loading sign-in status…
Detailed practice, examples and references
Prepare the review population
Identify the system, approved GxP roles, privileged roles, current users, current job responsibilities, assigned access, inactive or terminated users, service accounts, shared or emergency accounts, exceptions, owners, and approvers. Reconcile application access with authoritative identity and role information without assuming employment status proves appropriateness.
Review questions
For each account, ask whether access is required, least privilege is maintained, approval and execution duties remain appropriately separated, privileged access is justified and monitored, service-account ownership and credentials are controlled, and prior exceptions have expired or remain approved.
Completed fictional example
A former Quality reviewer moves to information-technology support and remains employed. The application report shows that the user retains CAPA approval, record-administration, and production-support roles. Current employment confirms identity status but not business need or segregation of duties.
The process owner removes CAPA approval, retains time-limited support access, requires ticket-based elevation for administration, and reviews activity during the overlap period. The exception and removal evidence are attached to the access-review record before Quality approval.
Regulatory and procedural context
Primary sources. 21 CFR Part 11 ↗ includes limiting system access to authorized individuals and authority checks for records and signatures within scope. EU GMP Annex 11 ↗ addresses security and access for applicable GMP systems.
Company procedure. The organization’s approved validation, change-control, supplier-management, information-security, data-integrity, records-retention, and Quality approval procedures determine the required records, roles, and approval route.
CSVtoCSA practitioner interpretation. Access review should test authorization against current responsibility and controlled process design, not merely confirm that the account belongs to an active employee. This is a recommended validation approach, not a statement that every listed activity is a direct regulatory requirement.
Practitioner guidance by Sandip Thorat · Simplified 17 September 2026. Apply the requirements and approved procedures relevant to your system. Report a correction.
Questions and discussion
Ask a question or share a perspective. Contributions are reviewed before publication.
Loading contribution options…