Central finding: Offboarding access review is meaningful only when the separation date, system inventory, removal request, completion evidence, and exception owner are linked.
Scope and population
Define the separation population for a declared period and the systems in scope. Record the HR source, IT source, query date, and exclusions.
For each separation, record the last day, manager confirmation, access removal request, executor, completion time, and evidence.
Evidence and review method
Sample voluntary, involuntary, and contractor separations. Include rehires and transfers so the access history is not oversimplified.
Compare the separation record with active accounts and shared resources. A submitted ticket is a request, not proof of removal.
Findings and limitations
Report exceptions by system and cause: delayed notice, missing ticket, incomplete removal, shared account, or unverifiable evidence.
Do not conclude that access is fully removed from a sample. State the scope, limits, and remediation owners.
The review describes the sampled records, not the whole population. A closed status is not proof that the underlying question was resolved. Corrective actions need an owner and a retest date.
Method note
Define the separation population for a declared period and the systems in scope. Record the HR source, IT source, query date, and exclusions. For each separation, record the last day, manager confirmation, access removal request, executor, completion time, and evidence. Sample voluntary, involuntary, and contractor separations. Include rehires and transfers so the access history is not oversimplified. Compare the separation record with active accounts and shared resources. A submitted ticket is a request, not proof of removal. Report exceptions by system and cause: delayed notice, missing ticket, incomplete removal, shared account, or unverifiable evidence. Do not conclude that access is fully removed from a sample. State the scope, limits, and remediation owners.