1. Agree the scope before collecting evidence
A review becomes slow and unreliable when teams collect screenshots before agreeing what they must demonstrate. Appropriate evidence depends on the actual framework, assessment period, organisational boundaries and controls in scope. A procurement security questionnaire may require different material from an internal access review or a certification assessment.
- Record the framework or questionnaire, review period, systems, entities and exclusions.
- Assign an accountable control owner and a reviewer for each requirement.
- Agree acceptable evidence formats, sampling rules and sign-off criteria with the review lead.
2. Reconcile assets, identities and application ownership
An inventory is useful only when its coverage and limitations are visible. Compare the relevant sources rather than assuming one list represents every device, account or application. Unmatched records can indicate missing ownership, stale data or a genuine control gap; investigate before classifying them.
- Check asset identifiers, assigned users, lifecycle status and the date of the latest observation.
- Separate employees, contractors, service identities, privileged accounts and disabled accounts.
- Name a business owner for each in-scope application and document unresolved ownership.
- Record missing sources and explain how they affect the review population.
3. Review access and supplier accountability
Access reviews should establish whether access remains appropriate, not merely whether an account exists. Supplier records should make it possible to identify the service, accountable owner and relevant contractual evidence. A completed checklist cannot substitute for investigating an unexplained privilege.
- Ask owners to approve, question or request remediation for access, with a dated rationale.
- Include privileged roles, shared access arrangements and relevant joiner, mover and leaver changes.
- Check supplier contacts, service purpose, data categories and available contractual documents.
- Track remediation separately from approval; a requested removal is not proof that access ended.
4. Connect policies, changes and evidence sources
For each control, connect the written expectation to evidence of operation. A policy describes intent; a change record, approval or source-system observation may help demonstrate what happened. Evidence must still be assessed for relevance, completeness and the period it covers.
- Confirm policy version, approval date, owner and applicability.
- Record evidence origin, collection date, covered period and any transformations.
- Link relevant changes to their approvals, implementation results and verification.
- Check retention requirements and restrict evidence access, especially where records contain personal data.
5. Use connected records without overstating assurance
Lojycal can help organise operational records, policies and evidence for review. Connection coverage depends on workspace configuration, provider permissions and plan or role gates. Append-only audit and signed evidence export mechanisms support traceability and integrity checks; they do not make every record immutable or establish certification or legal compliance.
Fictional example: Northbank Studio finds an application account assigned to a former employee. The reviewer records the mismatch, requests an authorised access check and keeps the issue open until a fresh source observation confirms the result. A linked record alone does not prove access was removed.
6. Close with explicit gaps and accountable sign-off
A credible review can contain unresolved gaps, provided they are visible and owned. Avoid turning unknowns into passing results simply to complete the report. Preserve the distinction between evidence collected, evidence accepted and remediation verified.
- List each gap, operational impact, responsible owner, target date and interim treatment.
- Document reviewer conclusions, exceptions and any authorised risk acceptance.
- Record final sign-off, scope limitations and the next review trigger.
- Evaluate Lojycal using one representative control: trace its inventory, approval, evidence and open issues, then confirm export and retention requirements with the team.