ISO 27001 access review frequency must track risk, not convenience

At a glance

What this is: This article argues that ISO 27001 access review frequency must be set by documented risk, not by whatever cadence is easiest for the team to run.

Why it matters: For IAM and IGA teams, it shows why access review programmes need risk-tiered frequency, coverage evidence, and change tracking to satisfy audit expectations.

Context

ISO 27001 access reviews are not defined by a fixed calendar rule. The standard expects organisations to set review intervals that match the risk of the access being reviewed, then prove that the chosen cadence follows the risk assessment and remains consistent in operation.

The governance gap is that many programmes still treat access reviews as an annual administrative task rather than a risk control. That approach breaks down when high-risk systems, privileged access, third-party accounts, and service accounts all carry different exposure and require different review timing.

For IAM, IGA, and audit teams, the real test is whether access review frequency is justified, repeatable, and supported by evidence of continuous improvement. In practice, that shifts the conversation from convenience to control design, documentation, and coverage.

Key questions

Q: What breaks when ISO 27001 access reviews are set by convenience instead of risk?

A: The control becomes hard to defend because the organisation cannot show that review intervals follow the documented risk assessment. Auditors look for rationale, scope, and evidence that the cadence fits the actual exposure of each access population. When the same schedule is used for low-risk and high-risk systems, the programme signals process convenience, not risk governance.

Q: Why do high-risk access reviews need more justification under ISO 27001?

A: Because the standard expects intervals to be appropriate to the risk, not chosen by default. High-risk access to customer data, production systems, or privileged roles creates a stronger need to explain why the cadence is monthly, quarterly, or annual. Without that rationale, the organisation may complete the review but still fail the audit.

Q: How do security teams know when access review processes are not enough?

A: When reviews are happening but high-risk access, role creep, or orphaned accounts keep reappearing, the programme is checking records rather than controlling outcomes. A review process is effective only if it changes access state, removes conflict, and leaves a clear trail of decisions. If it does not, the process is cosmetic.

Q: Should organisations include service accounts in ISO 27001 access reviews?

A: Yes. Service accounts are access-bearing identities and can carry elevated privileges, long-lived credentials, and hidden dependencies that create real exposure. Excluding them leaves a gap between the control requirement and the actual identity estate. They should be reviewed with the same completeness discipline as user accounts.

Technical breakdown

Why ISO 27001 access review frequency is risk-based

ISO 27001 Control A.9.2.5 is intentionally non-prescriptive: it requires review intervals that are appropriate to the risk. That means the control is not satisfied by a universal quarterly or annual schedule unless the organisation can explain why that cadence fits each access population. The practical logic is simple. Access to customer data, production systems, privileged roles, and third parties does not present the same exposure as low-risk collaboration tools. Auditors therefore test whether the review cadence is derived from the risk assessment and documented in the ISMS, not chosen because it is easy to administer.

Practical implication: Map each access population to a risk tier before setting review intervals.

Why spreadsheet-based access reviews fail audit scrutiny

Spreadsheet-driven access reviews often collapse three governance requirements into one manual workflow: frequency justification, reviewer accountability, and completion evidence. The problem is not that a spreadsheet cannot list users. The problem is that manual compilation obscures completeness, makes rationales hard to defend, and leaves little proof that the process improved over time. If the same list, same cadence, and same email chain repeat every cycle, the programme can look static rather than controlled. That becomes a certification issue when the organisation cannot show that the process evolved in response to risk or operational findings.

Practical implication: Replace manual review evidence with a controlled workflow that preserves rationale, timestamps, and remediation proof.

How PDCA changes access review governance

ISO 27001 expects Plan-Do-Check-Act behaviour, so access reviews are not only about detecting excess access. They also need to show that the organisation learned from the last cycle and improved the next one. In practice, that means tracking metrics such as review effort, violations found, remediation time, and frequency adjustments after risk changes. A stable process is not automatically a mature one. If review results never affect cadence, scope, or remediation design, the ISMS is not demonstrating the continuous improvement the standard is looking for.

Practical implication: Use review metrics to justify cadence changes and document each improvement cycle.

NHI Mgmt Group analysis

Risk-based frequency is the control, not the calendar. ISO 27001 access reviews succeed when the review interval follows the risk of the access being governed. Annual or quarterly cadence is only defensible when it is tied back to a documented risk assessment, and that applies differently to customer data, privileged production access, contractors, and service accounts. The implication is that review frequency is part of control design, not an administrative preference.

Convenience-based review programmes create evidence gaps as soon as auditors ask for rationale. A team can complete every annual review and still fail certification if it cannot explain why that cadence is appropriate for high-risk systems. The missing evidence is not only the review list, but the documented logic that connects asset criticality, privilege level, and breach impact to a chosen interval. Practitioners should treat that rationale as a control artefact in its own right.

Continuous improvement is what separates mature ISO 27001 operations from repeatable paperwork. A process that looks identical year after year signals static governance, even if the reviews were completed on time. The stronger signal is measurable change in coverage, remediation speed, and operational efficiency after each cycle. Practitioners should expect auditors to read process metrics as maturity evidence, not as an optional reporting layer.

Service accounts expose the gap between human-centric review habits and full access governance. Many review programmes are built around employee accounts and forget non-human accounts that still hold privileged access. That blind spot shows why lifecycle governance must extend across all access-bearing identities, not only named users. The implication is clear: if service accounts are outside the review population, the control is incomplete.

Access review frequency becomes a governance signal when it changes with risk changes. When a new application, higher-risk data set, or third-party access path changes the exposure profile, the review cadence should change with it. That makes the programme adaptive rather than ceremonial. Practitioners should treat cadence changes as a measurable sign that the ISMS is being governed, not merely operated.

What this signals

Risk tiering has to reach the review cadence itself. Many programmes still risk-rate systems but leave access review timing unchanged, which means the cadence is not truly derived from the risk model. When that happens, the access review becomes a calendar task instead of a governance control, and auditors will notice the mismatch.

Coverage is the hidden failure mode in manual review programmes. Spreadsheet workflows can produce a list of reviewed users without proving that the list was complete in the first place. The practical lesson for identity teams is that discovery, scope definition, and review execution need to be linked, or the review results will always be incomplete.

Review frequency should change when the access landscape changes. New applications, new third-party access, and shifts in privilege level should trigger a cadence review, not just a new ticket. That is where ISO 27001 meets day-to-day identity governance: a control only stays credible if the programme updates it when risk changes.

For practitioners

• Define review cadence by risk tier Classify systems and access paths by asset criticality, privilege level, user population, and breach impact, then assign each tier a review interval that is documented in the ISMS.
• Document the rationale for every interval Write down why monthly, quarterly, semi-annual, or annual reviews are appropriate for each access population so auditors can trace the decision back to the risk assessment.
• Track PDCA evidence across cycles Measure review effort, violations found, remediation time, and process changes so the next cycle shows actual improvement rather than a repeated workflow.
• Include service accounts in the scope Treat service accounts, integration accounts, and automation identities as review subjects with the same coverage discipline as human users, especially when they carry privileged access.
• Reassess cadence when risk changes Increase or decrease review frequency when new applications, new data classes, or third-party access change the exposure profile, and record that decision in the risk register.

Key takeaways

• ISO 27001 access review frequency is defensible only when it follows documented risk, not calendar convenience.
• Manual annual reviews can still fail certification if the organisation cannot prove rationale, completeness, and continuous improvement.
• The strongest programmes tie cadence changes, service-account coverage, and remediation evidence back to the ISMS and risk register.

Key terms

• Risk-Based Access Review Frequency: The cadence at which access rights are revalidated based on the risk posed by the system, data, and privilege level. In ISO 27001, frequency is not fixed by default. It must be justified by documented risk assessment and adjusted when the risk landscape changes.
• PDCA cycle: Plan, Do, Check, Act is the continuous improvement loop used by ISO 27001. For access reviews, it means designing the control, operating it, measuring outcomes, and then changing the process when risks, findings, or operating conditions shift.
• Access review coverage: Access review coverage measures how much of the real application estate is actually included in certification workflows. A review can be executed correctly and still fail if it only covers integrated tools, because untracked applications remain outside the decision set and outside accountability.
• Service Account Governance: The set of policies and operational controls used to manage non-human accounts across their full lifecycle. It covers provisioning, access scope, rotation, revocation, and review, with the goal of preventing long-lived credentials from becoming persistent paths into critical systems.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.