A user access review (UAR) is a control in which accountable reviewers verify that users' accounts and permissions remain appropriate. UARs are commonly required by internal policy, customer commitments, audit programs and regulatory frameworks.
A defensible UAR has complete scope, knowledgeable reviewers, useful context, recorded decisions, escalation, timely remediation and evidence that revoked access was actually removed.