User Access Review Standard Operating Procedure for IT Support in Education Compliance

Scope

Included

This SOP applies to Education teams carrying out User Access Review within the IT Support process area and Compliance department. It covers preparation, required inputs, execution, control checks, evidence, exceptions, approval or review where required, communication and closure.

The procedure should be adapted to the organisation's own systems, job titles, approval limits and record locations before operational use. Tasks outside the stated process, specialist decisions or circumstances requiring a different controlled procedure should be referred to the appropriate owner rather than forced through this workflow.

Outside this SOP

This SOP does not replace organisation-specific approval limits, specialist professional judgement, local legal requirements or site-specific controls.

Responsible roles

Primary owner: compliance officer. Supporting role: IT security owner. The primary owner coordinates and completes the operational record, the supporting role provides subject-specific input where required, and any designated reviewer or approver confirms that the control result and evidence are sufficient before closure.

Required information and systems

Primary working system or record location: the access-management record, approval workflow and controlled user or credential register. Required working information: current user-access report, systems and roles in scope, user or account owner, employment or engagement status, job role, privileged access, last-use information where available and manager or system-owner reviewer. Evidence retained at completion: access report, reviewer certification, removal or change tickets, exception approvals, privileged-access review and completion evidence. Use the current approved forms, system records and controlled documents used by the organisation for this procedure.

Procedure overview

User Access Review starts when the relevant request, event or scheduled activity is ready to be processed. The compliance officer first verifies the required inputs and scope, then completes the three core actions defined for this procedure: extract the current access population and confirm each account can be linked to a current user, role, service account owner or approved business purpose. compare granted permissions with current responsibilities and remove, reduce or investigate stale, excessive, orphaned or unauthorised access. obtain manager or system-owner certification, record approved exceptions and track removals or remediation until completed.

Before closure, the record must pass the principal control check: confirm every reviewed account has a valid owner and business need, privileged access is justified and inappropriate access has been removed or has an approved exception. Failed checks or unresolved exceptions remain open with a named owner. The procedure is complete only when the result, evidence, approvals where applicable, communications and follow-up actions accurately describe the final operational position.

How this SOP helps

This document gives the responsible team a consistent way to complete User Access Review, verify the result and retain evidence that the required process was followed.

Before using this procedure

Confirm that role names, systems, approval routes, record locations and escalation contacts match the organisation using this SOP. Adapt any local legal, contractual, privacy, safety or regulatory requirement before operational use.