--- title: Running an access review description: Freeze the current state of access, decide line by line, spot dormant access and close the review to keep dated evidence. url: "https://illizeo.com/en/centre-aide/governance-access-review/" updated: "2026-11-05" category: "Platform / Governance & security" --- # Running an access review An access review checks, at regular intervals, who has access to what in your space. Illizeo freezes the state of roles and their members, you decide line by line whether each access is still justified, then you close the review: it becomes dated evidence that you can produce during an inspection. Dormant access, unused for a long time, is flagged. This article is intended for administrators, the DPO and the HR managers in charge of the review. ## Before you start - You need the "View role cards" permission (Roles & permissions › Role management section of the role matrix) and "Settings — Access". - At the **Access** level, you can view reviews. At the **Execute** level, you can open a review, decide on its lines and close it. - By default, the Administrator role holds everything; HR Manager, Payroll Manager and Auditor have "View role cards" at the Access level, but not "Settings — Access". Permissions are set in **Settings › Manage Employees › Employee Roles** (see [Permissions & roles](https://illizeo.com/en/docs-category/platform-en/platform-roles-permissions/)). ## Opening a review 1. Open **Settings › Manage Illizeo › Access Review**. 2. Set the **Dormancy threshold**, between 30 and 730 days (90 by default): beyond this period without a sign-in, access is flagged as dormant. 3. Click **Open a review**. Illizeo freezes the current state of access rights and gives the review a reference such as REV-2026-01. ![The Access review page: Dormancy threshold field in days and Open a review button, then the Lines, To review, Dormant and Revoked counters and the first lines of the review](https://i0.wp.com/illizeo.com/wp-content/uploads/2026/11/governance-access-review-01.en_.png?resize=800%2C500&quality=80&ssl=1) Settings › Manage Illizeo › Access Review. The snapshot is frozen: a role added, removed or renamed afterwards does not change the review, and role and person names stay as they were when it was opened. This is what makes the review defensible: it covers the state you actually examined. ## What the snapshot contains The review has two kinds of lines: - **One line per role** (type "role"), with the number of permissions it grants. The question: does this role still carry the right permissions? Reconfirming a role with 4 permissions and one with 180 is not the same commitment. - **One line per person and per role they hold** (type "acteur"), with the role name and their last sign-in. The question: does this person still need this role? Roles given to everyone, such as "All employees", are included too. A line is marked **Dormant** when the person has not signed in since the chosen threshold, or has never signed in. Dormant lines come first: they are the ones that get obsolete access removed. Four counters summarise the review: **Lines**, **To review**, **Dormant** and **Revoked**. The bar below the counters shows the reference, the opening date and the threshold used. ## Deciding line by line 1. To focus on what matters, tick **Show dormant only**. 2. On a line, enter a **Reason (optional)** if needed. 3. Click **Confirm** if the access is still justified, or **Revoke** if it should be removed. The line then shows **Confirmed** or **To revoke**, with the decision date and the reason. ![An open review filtered on dormant access: lines marked Dormant with the role held and last sign-in, Reason (optional) field and Confirm and Revoke buttons](https://i0.wp.com/illizeo.com/wp-content/uploads/2026/11/governance-access-review-02.en_.png?resize=800%2C271&quality=80&ssl=1) Show dormant only, then Confirm or Revoke. As long as the review is open, you can change your mind: click the other button. The reason is replaced by whatever the field contains at that moment, and removed if the field is empty. ## "Revoke" does not remove access The decision is recorded in the review, but the role stays assigned. Remove it yourself afterwards, deliberately, from the role (**Authorized population** tab) or from the **Roles** tab of the employee's profile. See [Permissions & roles](https://illizeo.com/en/docs-category/platform-en/platform-roles-permissions/). This avoids a stray click during a review cutting off essential access, such as payroll access on payday. ## Closing and signing 1. When every line has been decided, the **Close and sign** block says "All lines have been examined.". While some remain, it shows how many and the button stays greyed out. 2. Enter a **Conclusion (optional)** if needed. 3. Click **Close and sign**. ![The Close and sign block of an open review: explanation that closing is refused while lines remain, Conclusion (optional) field, number of lines still to examine and greyed-out Close and sign button](https://i0.wp.com/illizeo.com/wp-content/uploads/2026/11/governance-access-review-03.en_.png?resize=800%2C115&quality=80&ssl=1) Close and sign: possible once every line has been decided. A closed review becomes dated evidence: it shows "Review closed", its closing date and its conclusion, and its decisions can no longer be edited. To re-examine, open a new review. When there are several, their references appear at the top of the page, followed by "open" or "closed": click a reference to display it. ## Good to know - The last sign-in is read from the [user logs](https://illizeo.com/en/centre-aide/governance-user-logs/), kept for 6 to 12 months. An older sign-in is no longer known: the line appears without a date, and therefore dormant. Choose a dormancy threshold shorter than the log retention period. - The screen shows the date of each decision and of the closure, but not the name of the person who decided or closed. - The review cannot be exported or scheduled: no reminder is sent. Set its frequency yourself, for example once a year. - The review does not flag combinations of incompatible roles: they are checked when a member is added, see [Separation of duties (SoD)](https://illizeo.com/en/centre-aide/governance-separation-of-duties/). ## FAQ ### The review has hundreds of lines. How do I get through it? Start with dormant lines (**Show dormant only**), then the role lines, which decide the permissions of many people at once. Roles given to all employees inflate the number of lines: confirm them once the role itself has been checked. ### Can a closed review be reopened? No. Open a new review: it starts from the current state of access rights. ### I revoked a line, but the person still has access. That is expected: the review records the decision, it removes nothing. Remove the role from the role itself or from the employee's profile. ### *Similaire*