Access reviews that end in evidence, not in a spreadsheet.
Run access and entitlement reviews inside the GRC program, so the outcome attaches to the control it satisfies — with joiner-mover-leaver events producing a record of what was granted and what was revoked.
Sound familiar?
Reviews start as an IdP export, get reviewed in a spreadsheet, and end without a link to any control.
Reviewers approve entire lists because there's no context on what each entitlement actually permits.
Revocations are recommended in the review and then executed — or not — somewhere else entirely.
Movers accumulate access: the new role's entitlements are added, the old role's are never removed.
The auditor asks for evidence of the last review and receives a spreadsheet with no provenance.
A review that nobody can evidence didn't happen.
Access review is one of the most commonly required controls across frameworks and one of the most commonly weak in practice. The mechanics are familiar: export the entitlements, distribute the lists, collect approvals, chase the stragglers, file the result. It looks like a control operating. What it often produces is a spreadsheet with no link to the control it satisfies, no record of what a reviewer was actually shown, and no confirmation that recommended revocations were carried out.
Reviewers deserve some sympathy here. Handed a list of group names and application roles with no description of what each one permits, approving everything is the rational response to an impossible request. And when a review recommends removing access, the removal happens in another system on another team's schedule, so the loop between recommendation and revocation stays open — sometimes indefinitely.
Talarity runs the review where the evidence needs to live. Campaigns run inside the program, reviewers see context on what they're approving, and the outcome attaches to the access control it satisfies with the reviewer, the decision, and the timestamp on the record. Joiner-mover-leaver events produce their own record of what was granted and revoked, so accumulation from role changes is visible rather than discovered during an audit.
The capabilities, in your context.
Governance, Risk & Compliance
Compliance
Review outcomes feed the access-control requirements of every framework that asks for them, evidenced once and sealed for chain-of-custody.
Explore ComplianceGovernance
Access controls owned, described, and linked to the policies that define who should have what — so a review has a standard to measure against.
Explore GovernanceRisk
Excess or stale entitlements raised as risks with owners and treatment rather than noted and forgotten.
Explore RiskAdd-on modules
Attach to GRC Professional or Enterprise Governance — same flat price on either.
Workforce Governance
Access and entitlement review campaigns, joiner-mover-leaver events, and revocation tracking — run inside the program, with the resulting evidence kept against the control.
AI Insights
Summarize campaign results into what actually needs attention — outliers, accumulation, and overdue revocations — each traced to the underlying record.
What you'll be able to say.
What changes when Talarity is the system of record for the program — not the spreadsheets surrounding it.
Produce access review evidence attached to the control it satisfies.
Close the loop between a revocation decision and the revocation itself.
See entitlement accumulation from role changes before an auditor does.
Give reviewers enough context that approval means something.
The mechanics, specifically.
Two review families, deliberately kept apart
Workforce Access Reviews certify the application and asset assignments a person holds. Access Certification is the entitlement-level review, and it can be pointed at Talarity itself. The two are fenced apart in code rather than by convention — their decision vocabularies differ, and a decision written into the wrong family is rejected rather than quietly recorded. That matters because a review whose results silently landed in the wrong campaign would still look complete.
Periodic, event-driven, or continuous
A campaign declares which it is when you create it, alongside its name, due date, scope filters and assigned reviewers. Scope is a filter over application, access level and status rather than a hand-built list, so the campaign picks up the access that exists at launch instead of the access someone remembered to type in.
Three decisions, and a flag is not a shrug
A reviewer certifies, revokes, or flags. Certify and revoke are self-explanatory. A flag carries the reviewer's stated reason and opens a follow-up investigation work item — it is a decision with a consequence, not a silent annotation that dies in the campaign record. Only campaigns that are active or in review accept decisions at all, so a closed campaign cannot be edited after the fact.
A revocation is tracked until access is actually gone
Completing a campaign advances every revoked assignment to pending revocation and emits a work item for each one, routed to the custodian and assigned with a notification. The work item type follows the asset: hardware and facilities become a recovery task, everything else becomes an access revocation. The fan-out is idempotent — an assignment that already has an open work item against it is skipped, so re-running a completion does not raise duplicates.
Reviewers get a queue, not an inbox
Each reviewer sees only their own open decisions, and can record them one at a time or in bulk. The campaign carries its own running counts, updated atomically as decisions land, so progress is a fact about the campaign rather than a number someone recalculates.
The evidence is a by-product, not a second exercise
A completed campaign exports a compliance attestation report: the campaign detail, every decision with a snapshot of the entitlement as it stood when it was reviewed, and the summary statistics. The snapshot is the part auditors care about — it shows what the reviewer was actually looking at, not what the entitlement happens to look like today.
Workforce Access Reviews: common questions.
What is a user access review?
A user access review — also called access certification or entitlement recertification — is a periodic check that each person still needs the access they hold. A reviewer who knows the person and the system looks at each entitlement and either certifies it, revokes it, or flags it for investigation. Auditors ask for them because access accumulates: people change roles, projects end, and permissions granted for a good reason in March are still there in November with no one accountable for them.
How often do access reviews need to run?
Quarterly is the common cadence for privileged and financially significant access, annually for everything else, but the driver is your control language rather than a universal rule — SOX ITGC programmes typically commit to quarterly for in-scope systems. Talarity supports periodic, event-driven and continuous review types, so the cadence is a property of the campaign rather than a calendar reminder someone owns.
What happens to the access that gets revoked?
The assignment moves to pending revocation and a work item is opened against it, routed to the custodian with a notification. That is the difference between a review that produces a decision and a review that produces a change: until the work item closes, the revocation is visibly outstanding. Re-running the completion will not raise a second work item for an assignment that already has one open.
Can we review who has admin rights inside the GRC tool itself?
Yes, and it needs no configuration. Talarity can generate the entitlement rows for its own users and groups out of the org's own records, so certifying platform administrator rights does not mean hand-typing them out of a system you are already signed into. Those entitlements use the same shape as any other, so every existing campaign, decision and export path works on them unchanged.
What evidence does an access review produce for an auditor?
A completed campaign exports an attestation report containing the campaign details, every decision, and a snapshot of each entitlement as it stood at the moment it was reviewed, plus summary statistics. The snapshot matters more than the decision list: it establishes what the reviewer was shown, which is the question an auditor asks when a decision is challenged a year later.
Frameworks for Workforce Access Reviews.
Enterprise Governance
Everything in GRC Professional, plus govern a portfolio of companies from one command center.
Packages move up as your program does. Seats, storage, vendors, frameworks, and entities scale with add-ons.
Further reading for Workforce Access Reviews
Practitioner walkthroughs from the Talarity library.
- Compliance·9 min readSave a security package once, send it on demandA prospect's security team asks for your SOC 2, your pen test, and your current security policies — again. Package Templates save that set as a reusable definition of pinned items plus rules like 'every current SOC 2 report', resolve it fresh each time you send, and hand it over as a redacted, watermarked, time-limited copy with a record of who received what.
- Compliance·6 min readSystem Configuration — turn a completed assessment into enforceable, drift-tracked baselinesEvery safeguard you scored in an assessment becomes an enforceable expected value. Talarity re-checks the observed state, flags drift, opens remediation automatically, and lets you attach evidence per control — so your controls stay implemented, not just documented once.
- Governance·6 min readExport and verify your audit trail for SOC 2Pull your full audit trail as a SOC 2 evidence file in any format, then prove it wasn't altered with a one-click tamper-evidence check — backed by a per-row hash chain and a Merkle root your auditor can re-verify offline.
- Governance·6 min readCatch toxic access combinations with Segregation of DutiesDefine the pairs of duties no single person should hold — approve and disburse, accept a risk and own its control — and Talarity flags every user who holds both, with ten framework-mapped starter rules out of the box.
Ready to see Talarity for Workforce Access Reviews?
Start 60 days of early access and see it on your own frameworks — then buy online in-app when you're ready.