# User Access Review

Version 2.0 · Updated 2026-09-21 · Operations

Evaluate current user and service-account access against approved GxP roles, responsibilities, least privilege, and segregation of duties.

Adapt this template to your intended use, applicable requirements, and approved procedures.

## When to use it

At the approved frequency and after role, employment, system, process, or access-model change.

## Information needed before starting

- Current account/role export and approved role matrix
- Current job assignments and joiner/mover/leaver records
- Previous exceptions, service-account owners and removal evidence

## Field instructions

- **System and review period:** Identify the system and account-export date, review period and account/role population in scope.
- **Approved GxP and privileged roles:** Identify the account or role, permitted actions and business justification. Check authorization, inappropriate combinations, inactive accounts and evidence of removal or correction.
- **User or service account:** Identify the account or role, permitted actions and business justification. Check authorization, inappropriate combinations, inactive accounts and evidence of removal or correction.
- **Current job responsibility and owner:** Identify the system/service or process, version and accountable roles. Specify the scope and supporting record rather than relying on a product name alone.
- **Assigned access:** Identify the account or role, permitted actions and business justification. Check authorization, inappropriate combinations, inactive accounts and evidence of removal or correction.
- **Access appropriate:** Compare assigned access with approved responsibilities; record the justified yes/no decision, exceptions and required corrective action.
- **Segregation of duties:** Identify the account or role, permitted actions and business justification. Check authorization, inappropriate combinations, inactive accounts and evidence of removal or correction.
- **Inactive or terminated status:** Identify the account or role, permitted actions and business justification. Check authorization, inappropriate combinations, inactive accounts and evidence of removal or correction.
- **Exception and expiry:** Record the issue, affected functions/records, impact, containment, action owner and resolution or expiry. Link correction and retest evidence; retain unfavorable results.
- **Action and completion evidence:** Record the remediation owner, due date and evidence that the access change was completed and checked.
- **Reviewer and approver:** Record the supported decision, restrictions, unresolved issues and rationale. Identify the accountable reviewer/approver and dated evidence under your procedure.
- **Conclusion and next review:** Record the supported decision, restrictions, unresolved issues and rationale. Identify the accountable reviewer/approver and dated evidence under your procedure.

Define the specific system, service, change, population, and intended use.

Complete each field from available records and accountable interviews; record unknowns rather than guessing.

Link conclusions to affected GxP functions, failure scenarios, controls, evidence, and approval.

Adapt the structure to the organization’s approved procedures and document-control process.

## Completed fictional example

Fictional teaching example; this is not an executed or approved validation record.

| Field | Completed example |
| --- | --- |
| System and review period | Fictional eQMS; annual review |
| Approved GxP and privileged roles | Investigator, Quality approver, administrator, read only |
| User or service account | Former Quality reviewer now IT support |
| Current job responsibility and owner | Application support; IT manager |
| Assigned access | Quality approver and administrator |
| Access appropriate | No; approval is not required for support |
| Segregation of duties | Approval plus administration creates conflict |
| Inactive or terminated status | Active employee; employment alone does not justify role |
| Exception and expiry | Temporary support exception expires in five days |
| Action and completion evidence | Approval removed; ticket-based elevation retained; activity reviewed |
| Reviewer and approver | Process owner and Quality approval |
| Conclusion and next review | Appropriate after removal; next scheduled or role-change review |

## Blank template

System / record ID: ____________________

Prepared by / date: ____________________

Required review / approval under local procedure: ____________________

| Field | Your entry |
| --- | --- |
| System and review period | ____________________ |
| Approved GxP and privileged roles | ____________________ |
| User or service account | ____________________ |
| Current job responsibility and owner | ____________________ |
| Assigned access | ____________________ |
| Access appropriate | ____________________ |
| Segregation of duties | ____________________ |
| Inactive or terminated status | ____________________ |
| Exception and expiry | ____________________ |
| Action and completion evidence | ____________________ |
| Reviewer and approver | ____________________ |
| Conclusion and next review | ____________________ |

## Related guidance

- [Read the related practical guide](https://csvtocsa.com/learn/guidance/user-access-review)

Canonical page: https://csvtocsa.com/learn/guidance/user-access-review#template