> For the complete documentation index, see [llms.txt](https://docs.securepass.me/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.securepass.me/documentation/end-user-guide/participating-in-access-reviews.md).

# Participating in access reviews

If you manage people or own an application, you will periodically be asked to confirm whether the access other people hold is still access they need. This is an access review, and completing it on time is what keeps your organisation's access from quietly growing year after year.

## Finding your reviews

You will get a notification with a link when a review is assigned to you. You can also open the reviews section in the portal at any time to see what is waiting.

## Reviewing access

Open each item and decide whether the person still needs it.

| Decision | What it means                                                |
| -------- | ------------------------------------------------------------ |
| Approve  | They still need it. The access stays.                        |
| Revoke   | They no longer need it. The access is removed automatically. |
| Delegate | Someone else is better placed to judge. It passes to them.   |

Add a comment where the decision is not obvious. Whoever reads this later — an auditor, or you at the next review — will not remember the context.

Submit your decisions before the deadline. Reminders are sent as it approaches.

## Reviewing properly

The point of the review is the second look, so give it one:

* **Approving everything defeats the purpose.** If nothing in your list is ever revoked, the review is recording a rubber stamp rather than a decision.
* **Watch for access from a previous role.** People keep what they had when they moved teams. This is the most common thing a review catches.
* **Revoking is not a punishment.** If someone needs it again they can request it, and that request will be quick because you are the person who approves it.
* **Delegate rather than guess.** If you genuinely do not know whether someone needs a system, pass it to someone who does.

## What happens next

Approved access stays as it is. Revoked access is removed automatically — you do not need to raise anything with IT.

The people affected are not told item by item, so if you have revoked something a colleague relies on, a word to them saves a confused support call.