Introduction

ISO 27001:2022 Annex A.5.18 requires that access rights be reviewed at regular intervals and when employment or contractual changes occur. The control is one of the most consistently cited sources of nonconformities in ISO 27001 certification audits because organisations either do not conduct reviews on a defined cadence, conduct them informally without producing structured evidence, or conduct a single review before the certification audit rather than maintaining a continuous review process.

The operating effectiveness standard that ISO 27001 auditors apply to A.5.18 requires evidence that reviews occurred throughout the certification period, not only at the point of assessment. A review conducted in the month before the certification audit produces a single evidence record. A review process that ran quarterly throughout the certification period produces four records per year, each demonstrating that the control operated at that point in time. Auditors sample from across the period. A single record does not satisfy sampling from multiple points.

The evidence quality requirement is equally important. Auditors examining A.5.18 evidence look for structured records showing which entitlements were reviewed, who made each decision, what decision was made, and whether revocations were actioned. Informal evidence including email threads where managers acknowledged a list of user access, spreadsheet trackers with no timestamps, and verbal confirmations with no documentary record do not constitute structured A.5.18 evidence.

This blog covers what A.5.18 requires technically, how access reviews must be structured to produce compliant evidence, what cadence satisfies the regular intervals requirement, and how the review process integrates with automated lifecycle management.

What A.5.18 Requires

A.5.18 has two distinct triggering conditions for access rights review: regular intervals and employment or contractual changes.

Regular interval reviews

The regular interval requirement means that all access rights across in-scope systems must be reviewed on a defined, recurring schedule. The control does not specify a minimum interval. ISO 27001 auditors typically consider quarterly reviews as demonstrating a robust periodic control. Annual reviews are the minimum that most auditors accept, but a single annual review produces only one evidence record per year, which limits the operating effectiveness evidence available for sampling.

Regular interval reviews must cover the full population of users with access to in-scope systems. A review that covers only senior administrators or only users with privileged access does not satisfy the full-population requirement. Every user with access to any in-scope system must be included in at least one review cycle per year.

Event-triggered reviews

Employment and contractual changes must trigger immediate access rights review rather than waiting for the next scheduled cycle. When an employee changes roles, their access from the previous role must be reviewed and entitlements no longer appropriate must be revoked. When a contractor’s engagement ends, all access must be removed. When an employee returns from extended leave, their access must be reviewed to ensure it remains appropriate.

Event-triggered reviews are in addition to regular interval reviews, not a substitute for them. An organisation that conducts event-triggered reviews for every role change but has no scheduled regular interval review does not satisfy A.5.18’s dual requirement.

What Structured A.5.18 Evidence Looks Like

The evidence standard for A.5.18 requires that the review process produces a structured record for every review cycle covering specific fields that an auditor can examine.

Review cycle record

Each review cycle must produce a record containing: the review scope covering which systems and which user populations were included, the review date and the period covered, the identity of each reviewer, the list of entitlements reviewed per user, the decision for each entitlement, certify or revoke, with the reviewer’s identity and a timestamp, and for revocations, a corresponding deprovisioning record showing the access was actually removed.

The deprovisioning record is the evidence gap that most organisations miss. A review cycle that produced revocation decisions but cannot show corresponding access removal records has incomplete evidence. The review decision and the access removal must be linked in the audit trail.

Reviewer accountability

A.5.18’s review must involve appropriate reviewers: typically the user’s direct manager for role-based entitlements and the system or data owner for sensitive system access. The reviewer must be a person with sufficient knowledge to assess whether the access remains appropriate, not an IT administrator who rubber-stamps a list.

The reviewer identity must be captured in the review record. A review log showing that entitlements were reviewed but not showing who made each decision does not satisfy the accountability requirement.

Evidence of revocation actioning

For every revocation decision in a review cycle, there must be a corresponding access removal record showing that the entitlement was actually removed, from which system, at what time, and through which mechanism. A review record showing that access was revoked but no corresponding deprovisioning record demonstrates that the review process operates but does not produce consistent follow-through, which is a control design weakness.

How to Structure the Review Process for A.5.18 Compliance

Implementing A.5.18 in a way that produces compliant evidence throughout the certification period requires a structured review workflow, not a periodic manual exercise.

Defining review scope and population

The review scope must be defined in the ISMS documentation. It must specify which systems are in scope, which user categories are included, the review cadence for each user category, and which reviewer roles are responsible for each system or user category.

For practical implementation, the review population should be segmented by risk level. Users with privileged access to critical systems require more frequent reviews than standard users with routine application access. A quarterly review for privileged access and an annual review for standard access is a common segmentation that balances thoroughness with operational workload.

Automated review campaign workflow

A manual review process where IT sends a spreadsheet to managers and collects responses does not produce the structured, timestamped evidence A.5.18 requires. An automated review campaign workflow sends structured certification requests to each reviewer, captures responses with timestamps, routes revocation decisions to automated deprovisioning workflows, and produces a complete campaign record linking every decision to the corresponding access change.

The automation requirement is not explicit in A.5.18, but the evidence quality standard that auditors apply in practice is difficult to achieve without automation at scale. An insurance company with 5,000 employees and 50 connected systems cannot produce per-entitlement, per-reviewer, timestamped evidence from a manual spreadsheet process.

Integrating event-triggered reviews

Event-triggered reviews for role changes and departures must be integrated with the regular interval review process, not managed as a separate workflow. When a user changes roles, the event-triggered review should operate through the same review campaign infrastructure as the regular interval review, producing the same evidence format. This ensures that the evidence from event-triggered reviews is comparable to and searchable alongside the evidence from regular cycle reviews.

How Akku Implements A.5.18 Access Review Campaigns

Akku’s IGA access review and re-certification campaign capability implements A.5.18 through a structured workflow that produces continuous, auditor-ready evidence throughout the certification period.

Campaign configuration

Review campaigns are configured with scope, cadence, reviewer assignments, and escalation rules. Scope defines which systems and user populations are included. Cadence defines when the campaign runs: quarterly, semi-annually, or annually per user category. Reviewer assignments map each entitlement to the appropriate reviewer: manager for role-based access, system owner for sensitive system access. Escalation rules define what happens when a reviewer does not respond within the defined period.

Review request and decision capture

When a campaign runs, Akku sends structured certification requests to each reviewer covering every entitlement in their review scope. Each request presents the user identity, the system, the access level, and the last authentication date. The reviewer makes a certify or revoke decision for each entitlement. Every decision is captured with reviewer identity and timestamp at the time of submission.

Automated deprovisioning for revocations

Revocation decisions automatically trigger deprovisioning workflows. Access is removed from the relevant system through SCIM or direct integration, and a deprovisioning record is generated and linked to the review decision record. The evidence chain from review decision to access removal is complete and auditable without manual follow-up.

Campaign evidence record

Each completed campaign produces a structured evidence record covering campaign scope, run date, reviewer assignments, every decision made with reviewer identity and timestamp, and deprovisioning records for all revocations. This record is stored in Akku’s append-only audit log and is available for auditor examination at any time.

Akku’s ISO 27001 mapping shows Identity and Access Governance addresses 16 clause references including Clauses 8.1, 8.1.a, 8.1.c, 8.1.d, 9.1, 9.1.c, A.8.1, A.8.2, A.8.4, A.9.4, A.9.6, A.11.5, A.15.3, A.16.3, A.16.6, and A.19.4, the highest single-module count in Akku’s ISO 27001 mapping. This reflects the centrality of access governance and review processes to ISO 27001 certification.

What ISO 27001 Certification Auditors Examine for A.5.18

Understanding what auditors examine helps organisations assess whether their current review process produces evidence that will satisfy certification.

Sampling approach

Auditors select a sample of review cycles from across the certification period. For a 12-month certification period with quarterly reviews, they may sample two or three cycles. For each sampled cycle, they examine the campaign record in detail: scope, reviewer identities, decision timestamps, and deprovisioning records for revocations.

They also select a sample of individual users and trace their access history across the sampled review cycles. For a user who changed roles during the period, they verify that an event-triggered review was conducted and that access from the previous role was appropriately revoked.

Evidence quality assessment

Auditors assess whether the evidence shows genuine reviewer engagement with the entitlements being reviewed. A review where every decision is certify with timestamps clustered in a two-minute window suggests that the reviewer approved a list without examining it. A review where decisions are spread across a realistic timeframe, with a mix of certify and revoke decisions and some revocations for identifiable reasons, demonstrates genuine engagement.

Nonconformity triggers

Common A.5.18 nonconformities include: no evidence of reviews during part of the certification period, reviews with no corresponding deprovisioning records for revocations, reviews with no reviewer identity captured, informal evidence such as email threads rather than structured records, and event-triggered reviews not conducted for documented role changes or departures.

Diagnostic Questions

How many access review cycles has your organisation completed in the last 12 months, and is there a structured evidence record for each cycle showing reviewer identities, decision timestamps, and deprovisioning records for revocations?

For a sample of users who changed roles in the last 12 months, is there an event-triggered access review record showing that entitlements from the previous role were reviewed and that inappropriate access was revoked?

Does your review process capture a certify or revoke decision per entitlement per reviewer with a timestamp, or does it produce a bulk acknowledgment that the list was reviewed without per-entitlement decisions?

For revocations made in the last access review cycle, is there a corresponding deprovisioning record for each revocation showing that access was actually removed, from which system, and at what time?

Can your review process scale to cover all users with access to all in-scope systems within a single review cycle, or does the manual workload limit review coverage to a subset of the full user population?

CTAs

See how Akku’s IGA access review campaigns address ISO 27001 A.5.18 requirements with structured evidence, automated deprovisioning, and continuous certification period coverage.

Book a conversation with the Akku team to assess your current access review process against ISO 27001 A.5.18 certification requirements.

FAQs

How frequently must access reviews run to satisfy ISO 27001 A.5.18’s regular intervals requirement?

ISO 27001:2022 A.5.18 does not specify a minimum review frequency. The standard requires reviews at regular intervals and when employment or contractual changes occur. In practice, certification auditors consider quarterly reviews as demonstrating a robust periodic control. Annual reviews are generally accepted as the minimum, though a single annual review produces limited operating effectiveness evidence for auditors sampling across the certification period. Organisations with users holding access to high-sensitivity systems typically run quarterly reviews for those user populations and annual reviews for standard access, balancing thoroughness with operational workload.

What makes access review evidence structured rather than informal for A.5.18 purposes?

Structured access review evidence contains: a defined review scope showing which systems and users were included, reviewer identities for each entitlement reviewed, a certify or revoke decision per entitlement with a timestamp, and deprovisioning records for all revocations. Informal evidence including email threads where managers acknowledged a list, spreadsheet trackers with no timestamps, and verbal confirmations with no documentary record does not constitute structured evidence. The key distinguishing features are per-entitlement decisions with reviewer identity and timestamp, and a demonstrable link between revocation decisions and actual access removal.

Does A.5.18 require that every access right be reviewed in every cycle, or can reviews be risk-based?

A.5.18 requires that access rights be reviewed at regular intervals. A risk-based approach that reviews high-sensitivity access more frequently and standard access less frequently is consistent with the standard, provided the review cadence for each category is defined and consistently applied. What is not consistent with A.5.18 is reviewing only a subset of users within each cycle while deferring others to future cycles indefinitely. Every user must be included in at least one complete review cycle per defined interval.

What happens during an ISO 27001 certification audit if A.5.18 review records have gaps for part of the certification period?

Gaps in A.5.18 review records for part of the certification period will typically result in a nonconformity. If the certification audit covers a 12-month period and review records only exist for the last three months, the auditor cannot sample from the full period and will note the absence of evidence as a gap in operating effectiveness. The severity of the nonconformity depends on the extent of the gap. A minor gap may result in a minor nonconformity with a corrective action requirement. A systematic absence of reviews for most of the period may result in a major nonconformity that prevents certification or requires a follow-up audit.

How does A.5.18 interact with A.5.16 identity management and A.5.17 authentication information?

A.5.16 covers the identity management process: creation, maintenance, and deletion of identities. A.5.17 covers the management of authentication information including credentials. A.5.18 covers the periodic review of the access rights those identities hold. Together, the three controls address the full access lifecycle: A.5.16 governs how identities are created and removed, A.5.17 governs how credentials are managed, and A.5.18 governs how the access entitlements tied to those identities are kept current and appropriate. All three require structured evidence for certification, and gaps in any one of them will be identified during the access controls portion of the certification audit.

Can access review evidence from Akku be used for both ISO 27001 A.5.18 and SOC 2 CC6.3 certification simultaneously?

Yes. ISO 27001 A.5.18 and SOC 2 CC6.3 both require periodic review of access rights with documented outcomes. The access review campaign records generated by Akku’s IGA module contain reviewer identities, decision timestamps, entitlement scope, and deprovisioning records for revocations. This evidence satisfies both A.5.18’s structured evidence requirement and CC6.3’s system of record for entitlements requirement. Organisations pursuing both certifications simultaneously can run a single review campaign cadence and use the same evidence records for both audit processes, reducing the duplication of effort that separate compliance programmes create.