The rubber-stamp review
An access review where managers can only rubber-stamp, and the list still includes people who left.
(Illustrative scenario, not a real incident)
What the auditor wanted was the access review recordsfor every quarter of the past year.
At this seventy-person software company,IT searched every folder and found:two reviews with screenshots and a manager's reply;one with only screenshots;one never done at all.
More awkward still:on one list a manager had answered “looks fine,”there, plain as day,was an employee who had left long ago.
The manager wasn't careless.He was just too busy,and didn't have enough information in front of him,so all he could do was stamp it.
I used to think that once a review was done,it was done.Later I learnedthe point isn't whether it was done,but whether anyone was really looking.
The screenshots had no dates,the replies couldn't be found,and the access the review said to remove—nobody confirmed it was ever removed.
Every quarter started from zero.
The faintest ink outlasts the best memory.A steady processis more reliable than enthusiasm each time.
Give managers a review sheet that shows why each person needs each permission, so they aren't just stamping it; after the review, go back and confirm that what should be removed really was.