Access Reviews

ClaraRx performs periodic reviews to confirm that access remains appropriate and consistent with the Access Control Policy.

1. Review Schedule

The following schedule establishes the minimum internal review frequency:

Review	Frequency	Responsible Parties
Privileged and production access	Monthly	DevOps Engineer and authorized reviewer
User access across in-scope systems	Quarterly	DevOps Engineer and relevant system owners or Engineering Leads
RBAC Matrix	Quarterly and following material changes	DevOps Engineer and Engineering Leads
Service accounts and non-human identities	Quarterly	Relevant system owners and DevOps
Temporary access	At expiry and during applicable reviews	Access administrator and authorized reviewer

See Privileged Access and Service Accounts for requirements specific to those access types.

2. Review Procedure

Each review must include the following activities:

1. Obtain current user and permission records from the relevant systems.
2. Compare actual access against the Access Management Register.
3. Confirm that access remains necessary for each user's responsibilities.
4. Identify unrecognized accounts, excessive permissions, inactive accounts, and discrepancies.
5. Record a review decision for each relevant access assignment.
6. Create remediation tickets for access that must be modified or revoked.
7. Verify that required remediation has been completed.
8. Record the review outcome and retain supporting evidence.

Review decisions must identify whether access is retained, modified, revoked, or requires further investigation.

3. Review Evidence

Each completed review must record:

• The review period and completion date.
• The systems and access categories reviewed.
• The reviewer or reviewers.
• The records used to validate actual access.
• Decisions and exceptions identified.
• Associated remediation tickets.
• The status of corrective actions.

Where practical, individuals must not independently approve the continued necessity of their own privileged access.

Any exceptions must be documented and assigned to an authorized reviewer for resolution.