IT, data & continuous
User Access Review (UAR)
A periodic audit process where user access rights on information systems are verified and certified by business managers (resource owners) as appropriate for the current role. UAR ensures compliance with the principle of least privilege and is a critical control against unauthorized access. Review frequency varies by sensitivity (privileged accounts monthly, standard accounts biannually to annually).
Source: IIA GIAS 2024, PCI DSS