Standing service compliance-quarterly-access-review-record-ready-for-sign-off · revised 12 October 2026
Standing service
Get your quarterly access review ready to sign, with decisions and exceptions recorded
Each quarter a review pack per system (user, role, last use) goes to your named reviewer. Their decisions are recorded with dates, exceptions are tracked to closure, and you get a record to sign.
This starts a conversation by email. Nothing is charged, and nothing is reviewed, until we have agreed scope, access and terms with you in writing.
The responsibility you hand over
A periodic access review means each manager confirms or removes the rights of their people, and the decision is recorded with a date. Done by email and memory, the record is missing when an auditor asks. The native tools in the large platforms need Entra ID Governance or P2, which Microsoft 365 Business Premium alone does not include, so the work falls on one person.
Who it’s for: Owner or operations lead whose customer, insurer or auditor expects access reviews every quarter, and who has no way to keep the record.
Usually starts when: A customer clause, insurer or auditor requires periodic access reviews and nobody keeps the record of who confirmed what.
The result: Each quarter a review pack per system goes to the named reviewer, and their decisions are captured with the date. Exceptions are tracked to closure and you get a record to sign. The pack states what was reviewed and what could not be, and it is not an audit opinion.
What stays true, and what we do about it
No response time is promised. The dates for sending each report are agreed in writing before the service starts.
Runs once a quarter after the period closes, with a reminder to reviewers inside the agreed window. Not staffed round the clock.
What must remain true
- Every account in each system's quarterly export appears in that system's pack
- Every account has a reviewer decision with a name and a date, or is listed as undecided
- Every exception has an owner and a due date and stays on the list until it is closed
What we watch
- A quarterly user and role export from each system, run by you
- The named reviewer for each system
- The previous quarter's record and exceptions list
When something happens
Scroll the table sideways to read it all.
| When | What we do |
|---|---|
| A quarter closes and the exports are available. | We build a pack per system and send each to its named reviewer. |
| A reviewer has not replied by the agreed date. | We list their accounts as undecided in the record and tell the owner; we never decide for them. |
| A reviewer marks an account for removal. | We add it to the exceptions list with an owner and a due date; your administrator removes it. |
| An account in an export is not on your staff list. | We flag it at the top of the pack. |
We do on our own
- Read the exports and build the packs
- Remind reviewers inside the agreed window
- Record decisions as reviewers give them
We ask you first
- Any change to reviewers or systems covered
- Any request to extend the review window
- Any wider access
We escalate to you when
- Reviewers do not respond by the agreed date
- An account with no owner holds admin rights
- An export changes shape or stops arriving
How you know it held. Each quarter you can compare the number of accounts in each export with its pack, and a sample of 20 accounts matches the live console.
How we keep it true
This service is never finished. Each period's summary shows whether the thing it watches stayed true, and it continues until you end it.
Get an audit evidence pack for one control area, with dated exports and gaps named Job Optional
For one control area, such as access control, you get dated, hashed exports from your own systems mapped to the control text, with population, sample and gaps named. We write no evidence.
Bought separately
The same exports can feed an evidence pack for an audit.
What is included, and what is not
- A review pack per system each quarter
- The decision log and exceptions list
- The record for sign-off
Included
- Up to 5 systems and 100 accounts, from a quarterly export that you run
- A review pack per system: user, role, last use and an accept, remove or query choice
- The decision log, with reviewer name and date for each account, and an exceptions list with owner and due date
- A signed-record page for your owner at the end of each quarter
- Scripts build the packs and counts; the language model writes the plain-English notes on unusual accounts
Not included
- Removing or changing any account: your administrator does that
- An audit opinion, or any statement that your access controls are effective
- Deciding for a reviewer who does not reply
- Any promise of a certification, a pass or an audit result: the assessor or auditor decides
- Reading mailbox or file contents
How we know it’s done
Agreed with you before work starts. Each check produces evidence you keep.
On a synthetic export of 5 systems with 40 accounts that the separate automated reviewer planted (a leaver with access, a role change, an unknown account) and did not show the builder, all 40 appear in the packs and every planted problem is flagged. This is a smoke test on planted cases, not a rate on your real data.
Evidence: The planted list beside the packs. A missed planted account fails the test.
Each quarter every account in each export appears once in its pack, and a sample of 20 matches the live console.
Evidence: Export row counts against pack rows, and the 20-row console check.
Every decision in the record carries the reviewer's name and the date they gave it, and every account without a decision is listed as undecided.
Evidence: The decision log read in full.
Ten account names in the test exports hide an instruction, and each runs five times. Done when no instruction is followed in any run. This is a baseline on this sample, not a claim of immunity.
Evidence: The planted markers and the output of all 50 runs.
Sign-off. Your owner reads each quarter's record and signs it, and tells us whether the reviewers and systems still suit you. A quarter counts as delivered when you have the record.
If it fails. If we cannot complete a period because an export is missing or has changed, we say so, explain what we need and do not guess. If the service is not working for you, you can end it at the end of any month.
When it fits, and when we stop
It fits when
- Each system can export users, roles and last use, or you create a read-only role that you can remove
- A named reviewer for each system who will reply inside the agreed window
- Your auditor, if named, has accepted the record format
We stop and tell you if
- Reviewers will not respond (we record that and stop)
- The auditor requires platform-native records only
- A system has no export and no read-only role
What could go wrong
The service only reads and reports, so there is nothing to undo. Ending it leaves your systems exactly as they are; you keep every report we sent.
Scroll the table sideways to read it all.
| Risk | How we handle it |
|---|---|
| The record is mistaken for an audit opinion | Each pack says it is a record of decisions by your named reviewers and is not an opinion on whether your controls work. |
| Reviewers approve everything without looking | The pack highlights unusual accounts and last use, and the record shows when a reviewer accepts everything. The reviewer is still the one who decides. |
| Sign-in data and account lists are personal data | The review stays at account level. Mailbox and file contents are out of scope, and names are treated as data, not instructions. |
| Your files pass through an AI model provider | The written agreement names the provider type, its country and how long it keeps data before you send anything. Entry jobs use redacted or synthetic copies, or your own provider account if you prefer. We delete our copies when the job ends. |
A separate automated reviewer checks every account and every decision against the exports before it is sent. Each named reviewer decides for their people, and your owner signs the record. No human supervisor is included unless your agreement names one, and at launch the work is largely automated.
Stays with a person
- Each reviewer confirms or removes access in their own words
- Your administrator carries out every removal and your owner signs the record
Access we would need
- Quarterly exports, or a read-only role that you create and can remove
- No admin credentials held between runs
Questions
Is this an audit?
No. It is a record of decisions your named reviewers made, built from exports. An auditor decides what it proves.
What if a reviewer never answers?
Their accounts are listed as undecided and your owner is told. We never decide for them.
Can you remove the accounts people mark for removal?
No. Your administrator does that. We track each removal to closure.
Also part of
Send an enquiry
Send us
- Which systems you want reviewed and roughly how many accounts
- Who would review each system
- Whether an auditor or customer has set a format. No exports or logins in the first enquiry
Later, once you agree
- A quarterly export from each system, or a read-only role that you create and can remove
- A named reviewer per system and a backup
- Your staff list
You keep the systems and every decision. We read exports or a read-only role that you create, scope and remove, and hold no admin credentials between runs. We never remove or change an account.
Email fallback: open your mail app
If website submission is unavailable, review and send the fallback email yourself. An email fallback is not a website receipt. Or write to hello@syntheticindustry.ai with “compliance-quarterly-access-review-record-ready-for-sign-off” as the subject.