Access Reviews
A field guide for financial auditing guidance when the control is who can touch the money movement path — across ERP, banking, treasury, and payments platforms.
What “done” looks like
An access review is finished when a named owner has confirmed that each in-scope entitlement still matches a business need, exceptions are logged with dates, and the pack can be reopened without reconstructing folklore from chat threads.
App Network Hub treats that finish line as a teaching target. Screenshots alone rarely satisfy it; structured extracts and signed attestations usually do.
Scope the money path first
- Posting & master data GL post, vendor create/change, bank master edits, payment proposal release.
- External platforms Corporate banking portals, FX dealing screens, card-program consoles, payroll funding tools.
- Privileged overlays Break-glass IDs, shared service accounts, and contractor profiles with standing approvals.
Sampling without theater
Pick a method you can explain: risk-weighted for high-impact roles, random for the long tail, and 100% for tiny privileged sets. Document why dormant accounts were included or excluded.
Turn this guide into practiced muscle
The Finance Platform Access Audit Framework walks the full cycle with critique. Prefer a short conversation first? Write the desk.