Chapter 15 — Access reviews

Chapter 15 — Access reviews

Lesson map

Lesson 15 published. Map, example, EX057.

flowchart TD
  N0["Learning outcomes"]
  N1["15.1 Preparing"]
  N2["15.2 Guiding owners"]
  N3["15.3 Acting on results"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX057"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["15.1 Preparing"]
  N2["15.2 Guiding owners"]
  N3["15.3 Acting on results"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX057"]

[Learning outcomes]
    |
    v
[15.1 Preparing]
    |
    v
[15.2 Guiding owners]
    |
    v
[15.3 Acting on results]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX057]

Learning outcomes

You will (1) prepare a review; (2) guide owners through it; (3) act on results.

15.1 Preparing

Every quarter Millbrook reviews who has access to what. Tomas exports group memberships for the directory, dental records and payroll, and prepares one sheet per owner listing each member with their role and last sign-in. He removes noise such as disabled accounts so owners see only what needs a decision. Good preparation makes the review quick for busy dentists and managers, and a quick review is more likely to be completed carefully than one that takes hours. Tomas sends sheets a week before the deadline.

15.2 Guiding owners

Tomas gives each owner a short guide: keep access that the person's current role needs; remove anything you cannot explain; ask if unsure. He sits with the senior dentist for the first review, which takes twenty minutes. Owners mark each line keep or remove. Tomas explains that removals are expected and not a criticism of anyone, since access drifts naturally as people change roles and projects end. Other owners then complete their sheets alone, with Tomas available for questions. He records how long each review takes so the next quarter's schedule is realistic for the practice.

15.3 Acting on results

Tomas applies removals within a week, records each one and confirms with a fresh export that they took effect. In the first review, 64 lines are reviewed and 7 removed, including payroll read access for a former acting manager. He records completion and removals and compares them with the next quarter. Applying and verifying removals closes the loop; a review that records decisions but never applies them gives false assurance. Owners see the results so they know their decisions mattered. Tomas notes any slow reviews and agrees reminders for next time.

Worked example

The first quarterly review covers 64 lines with 7 removals, all applied within a week and verified with a fresh export.

Synthetic case. Reviews and figures are synthetic.

Errors and limits

Collecting review decisions without applying and verifying them gives false assurance.

Exercises

• EX057 — Noise removed. What noise is removed before review? Rubric: 3 = disabled accounts;; 2 = disabled;; 1 = owners;; 0 = none.
• EX058 — Owner guide. What does the guide say about unexplained access? Rubric: 3 = remove it;; 2 = remove;; 1 = keep;; 0 = none.
• EX059 — First result. How many lines were removed in the first review? Rubric: 3 = 7 of 64;; 2 = seven;; 1 = 64;; 0 = none.
• EX060 — Verification. How are removals confirmed? Rubric: 3 = fresh export;; 2 = export;; 1 = trust;; 0 = none.

Synthesis

Prepared sheets, guided owners and verified removals make access reviews effective.

Continue studying — chapter 15 of 18

← Chapter 14 (draft) · Course chapter index · Chapter 16 (draft) →