How to Run Quarterly Access Reviews an Examiner Will Accept

A quarterly user access review checklist for RIAs and broker-dealers: which systems to include, how to run each cycle, and the dated evidence that shows an examiner your access controls work.

Sean Crowley

President & Co-Founder

October 30, 2026 · 4 min read

Key takeaways

Regulation S-P and the FTC Safeguards Rule require access safeguards but set no review frequency.
The SEC's fiscal year 2027 examination priorities name access controls and account management.
CIS Safeguard 5.1 calls for validating active accounts at least quarterly.
Good evidence is dated user lists, reviewer sign-off, a change log and proof the fixes took effect.
Entra access reviews automate recurring cycles but need an Entra ID Governance or Entra Suite license.

For a CCO at an RIA or broker-dealer, access reviews are easy to describe and easy to let slip. The SEC's fiscal year 2027 examination priorities list access controls and account management among the cybersecurity practices examiners will review. This user access review checklist covers how to run a quarterly review and what to keep so the evidence holds up.

What do the rules require for access reviews?

None of the rules that apply to financial firms prescribes a quarterly access review. They require safeguards against unauthorized access and leave the frequency to the firm's written policies and procedures.

Regulation S-P requires SEC-registered advisers and broker-dealers to adopt written policies and procedures that protect against unauthorized access to or use of customer information.
For financial institutions under FTC jurisdiction, the FTC Safeguards Rule requires implementing and periodically reviewing access controls, limited to the customer information each user needs.
FINRA Rule 3110 requires broker-dealers to maintain a supervisory system and written supervisory procedures, which is where the review process and its sign-off belong.
Both privacy regimes trace back to the GLBA safeguards obligation.

Because the rules set no cycle, the CIS Controls are a practical benchmark. Safeguard 5.1 calls for validating that all active accounts are authorized at least quarterly, and Safeguard 5.3 calls for disabling accounts after 45 days of inactivity where supported. A monthly sweep for stale accounts keeps the quarterly review short. Whatever frequency your policy states becomes the standard an examiner tests you against.

Which systems belong on your user access review checklist?

Every system that stores or can reach customer information, plus the identity system that controls access to the rest. Gaps usually come from the systems a firm forgot to include.

Microsoft 365 or Google Workspace, including admin roles, shared mailboxes and guest users.
The CRM and financial planning software.
Portfolio management, performance reporting and trading systems.
Custodian platforms and the API connections that link them to other tools.
Document management, e-signature and client portals.
The archive that holds books and records, including email and messaging.
AI tools connected to client data.
Accounts your IT provider and other vendors hold on firm systems.

How do you run a quarterly user access review, step by step?

Pull the lists, send them to the people who know who should have access, fix what they flag, and record the dates. Each step should leave a record an examiner can read.

Export the current user and role list from each in-scope system, saved with the export date.
Compare each list to the HR roster. Flag former employees, contractors past their end date, and accounts with no owner.
Send each department head the list for their team and ask them to confirm, reduce or remove each account in writing.
Review privileged roles separately. Admin access to Microsoft 365, custodian platforms and the CRM should belong to named individuals using separate admin accounts.
Check multi-factor authentication status for every remaining account and record any exceptions.
Make the changes, then export the lists again to show they took effect.
Have the CCO or designated reviewer sign and date a one-page summary.

In Microsoft 365, Entra access reviews can automate the cycle for groups, applications and admin roles, with weekly, monthly, quarterly or annual recurrence. The feature requires a Microsoft Entra ID Governance or Entra Suite license, so many smaller firms run the same steps from exported lists.

What evidence will an examiner accept?

Evidence that the review happened on schedule, covered every in-scope system, and produced changes that were completed. A policy that says quarterly with no dated records behind it gives an examiner an easy finding.

The written policy stating the review frequency, the systems in scope and who reviews.
Dated user lists for each system, before and after changes.
Reviewer confirmations, such as signed lists or approval emails.
A change log tying each removal or reduction to a ticket and a completion date.
A short list of exceptions, such as a shared account that cannot be removed, with the compensating control and an owner.
Termination records showing access was removed when people left, cross-checked against the review.

Keep each quarter's package in one folder so you can produce it quickly when an exam request list arrives.

What problems do access reviews usually uncover?

Accounts that outlived the people who used them, permissions that grew with each role change, and integrations nobody owns.

Former employees still active in vendor platforms that are not connected to single sign-on.
Staff who changed roles and kept their old access.
Shared logins on custodian or vendor portals.
API keys and app consents granted by people who have since left.
Guest users from past projects still present in Microsoft 365.

What should you set up this quarter?

Write down the in-scope systems and a named owner for each.
Put the review frequency in your written policies if it is not already there.
Connect as many systems as possible to single sign-on so one disable removes access everywhere.
Run the first review against the HR roster and record every fix.
Put the next three reviews on the compliance calendar now.
If your firm falls under the FTC Safeguards Rule, see how to show your access reviews meet the Safeguards Rule.

How can s90 help you run access reviews?

s90's Identity Posture service keeps account and admin rights inventories current across Microsoft 365 and connected systems, runs the quarterly review with your reviewers, and assembles the dated evidence package. Each cycle ends with an identity posture report your CCO can file with the review. Our agreements commit us to produce evidence within 24 hours. If you want to see where your current reviews stand, talk to our team.

Applies to

Industry

Financial Services

Compliance

GLBA SEC Regulation S-P FINRA FTC Safeguards Rule CIS Controls

Regulation reference

17 CFR 248.30(a)(1)–(a)(3)
Requires a written safeguards policy and a written incident response program. The rule does not designate an owner, approver, or signatory for either.
www.ecfr.gov/current/title-17/chapter-II/part-248/subpart-A/section-248.30
SEC Division of Examinations, Fiscal Year 2027 Examination Priorities (October 2026), Section VII.A
Staff priorities, not a rule. States that examinations will review cybersecurity policies and procedures covering governance, data loss prevention, access controls and account management; that staff will evaluate incident response policies and procedures under amended Regulation S-P; and that Regulation S-ID reviews will cover identification, detection and response to red flags.
www.sec.gov/files/2027-exam-priorities.pdf
16 CFR 314.4(c)(1) and (c)(5)
Requires implementing and periodically reviewing access controls that authenticate and permit access only to authorized users and limit each authorized user's access to the customer information needed to perform their duties. Requires multi-factor authentication for any individual accessing any information system, unless the Qualified Individual approves reasonably equivalent or more secure controls in writing. The rule does not set a review frequency.
www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314/section-314.4
FINRA Rule 3110(a) and (b)(1)
Requires each member to establish and maintain a system to supervise the activities of each associated person that is reasonably designed to achieve compliance with applicable securities laws and regulations and FINRA rules, and to establish, maintain and enforce written procedures to supervise the types of business in which it engages.
www.finra.org/rules-guidance/rulebooks/finra-rules/3110
15 U.S.C. 6801(b)
Directs federal and state regulators to establish administrative, technical and physical safeguards standards for financial institutions to insure the security and confidentiality of customer records and information, protect against anticipated threats or hazards to their security or integrity, and protect against unauthorized access or use that could result in substantial harm or inconvenience to any customer.
uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title15-section6801&num=0&edition=prelim
CIS Critical Security Controls v8.1, Safeguards 5.1, 5.3, 6.1, 6.2, 6.3 and 6.4
Maintain an inventory of all accounts with name, username, start and stop dates and department, validated at least quarterly (5.1); disable dormant accounts after 45 days of inactivity where supported (5.3); follow documented, preferably automated processes to grant and revoke access (6.1, 6.2); require MFA for externally exposed applications (6.3) and remote network access (6.4).
cas.docs.cisecurity.org/en/latest/source/Controls6/
Microsoft Learn, What are access reviews? (Microsoft Entra ID Governance)
Vendor documentation, not a rule. Access reviews cover group membership, enterprise application access, Entra and Azure resource roles through Privileged Identity Management, and access packages, recurring weekly, monthly, quarterly or annually with specified reviewers, owners, managers or self-review. Requires a Microsoft Entra ID Governance or Microsoft Entra Suite subscription; some capabilities may work with Entra ID P2.
learn.microsoft.com/en-us/entra/id-governance/access-reviews-overview

Related insights

All insights

Six identical closed Dell laptops stacked neatly on a pale wood table.

CIS Controls

How to Write an AI Acceptable Use Policy Your Tools Can Enforce

An AI acceptable use policy that nothing enforces documents a control that does not exist. Here is how to write each rule against a CIS safeguard you can configure, so the policy produces its own evidence.

October 30, 20266 min read

Stacked client folders and printed returns beside a monitor at an empty workstation.

AccountingFTC Safeguards Rule

AI DLP for CPA firms: how to keep AI out of client portals and email

AI now arrives inside the tools CPA firms already use: portal summaries, inbox assistants, attachment previews and browser extensions. Here is a checklist for keeping client tax documents away from AI you have not approved.

October 30, 20265 min read

A professional office reception counter after hours, with a visitor check-in tablet asleep on its stand and dusk through the glass entry doors.

CCPA

AI data exposure and the California data breach notification law: is it a breach?

An employee pastes client data into a consumer AI chatbot. Is it a breach under the California data breach notification law? A walk-through of section 1798.82, the 30-day clock, Reg S-P overlap and the facts a firm needs to decide.