Skip to content
Compliance & Audit agent

Access reviews

Once a quarter, each system’s users are matched to your HR records and sent to their owner to confirm. Anyone who’s left but still has a login goes to IT the same day.

  • $12,500 fixed
  • Live in 3 to 6 weeks
  • Yours to keep
Let’s build your agent How it works
The review screen for Access reviews: four items, three done, and one (Leaver active) waiting for the IT manager, who is asked: Leo Brandt left August 29 but is still an admin in accounting. Remove it today?
How it works

Left in August, still an admin. Found in review, not in the audit.

Here’s a typical run, step by step: what automation handles, what the agent does, and the calls that stay with your team.

The workflow for Access reviews, in 5 steps. It starts with “A review is due” and ends with “A signed review per system”. Each step lists what automation, the agent and your team do there.
Access reviewsA typical run
Starts withA review is dueThe quarterly review opens for the systems in scope, from accounting and the CRM to the cloud console.
Automation: Exports every account from the systems in scope, with role, status and last sign-in, and dates each list for the record.
~8h/mo

Step 1 of 5Pull the user lists

  • Automation

    Exports every account from the systems in scope, with role, status and last sign-in, and dates each list for the record.

    Each system can list its users on request. Pulling them is the same every quarter.

Reads
  • Business systems
Writes
  • Review tracker

~8 hours a month back

Where teams differQuarterly is common for systems that touch money or customer data. Others often get a yearly look.

The agent: Pairs each account with a person in your HR records, even when accounting says “lbrandt” and HR says Leonard Brandt.
~14h/mo

Step 2 of 5Match to real people

  • The agent

    Pairs each account with a person in your HR records, even when accounting says “lbrandt” and HR says Leonard Brandt.

    Usernames, old emails and nicknames rarely line up with the HR record. A rule sees strangers.

Reads
  • HR system
  • Review tracker
Writes
  • Review tracker

~14 hours a month back

The agent: Finds Leo Brandt, who left August 29 and is still an admin in accounting, plus two CRM accounts unused for 90 days.
~10h/mo

Step 3 of 5Spot what doesn’t fit

  • The agent

    Finds Leo Brandt, who left August 29 and is still an admin in accounting, plus two CRM accounts unused for 90 days.

    Leavers and idle accounts are easy to spot. Whether an admin role still fits a job means reading the title against it.

Reads
  • HR system
Writes
  • Review tracker

~10 hours a month back

Where teams differUnused might mean 30 days without a sign-in, or 90. Some teams skip that check entirely.

Automation: Anyone who has left but still has access goes to the IT manager the same day, with the system, the role and the leaving date.
IfYour team: Removes the account in accounting that day, or finds out first why it was kept open.
~4h/mo

Step 4 of 5Close the leaver out

  • Automation

    Anyone who has left but still has access goes to the IT manager the same day, with the system, the role and the leaving date.

    A leaver with a login is the one finding that shouldn’t wait for the quarter’s sign-offs.

  • Your teamIf a leaver is still active

    Removes the account in accounting that day, or finds out first why it was kept open.

    Changing access in a live system is a call for someone who knows what else depends on it.

Reads
  • Review tracker
Writes
  • IT tickets

~4 hours a month back

Automation: Sends each system’s owner their users to confirm, with the odd ones marked, and reminds them before the due date.
Your team: The controller confirms the 40 staff in accounting, and sales ops marks the two unused CRM accounts for IT to close.
~12h/mo

Step 5 of 5Owners sign off

  • Automation

    Sends each system’s owner their users to confirm, with the odd ones marked, and reminds them before the due date.

    Each system already has a named owner, so the lists and reminders go out without anyone assigning them.

  • Your team

    The controller confirms the 40 staff in accounting, and sales ops marks the two unused CRM accounts for IT to close.

    Only the owner knows whether someone still needs that level of access. Their sign-off is what auditors check.

Reads
  • Review tracker
Writes
  • Review tracker
  • Audit folder

~12 hours a month back

Ends withA signed review per systemEach owner’s sign-off, the user list and every change, filed as evidence for your auditors.
Total~48h/mo

What changes

Each owner confirms a short list with the odd accounts marked. IT hears the same day about anyone who has left and still has a login.

  • 3steps automated
  • 2steps for the agent
  • 2calls kept with your team

Pick any step to see what happens there and why it sits in that lane.

What it could be worth

~48 hours a month back

$34,600 a year in time

For a company reviewing access to about 12 systems every quarter, at $60 an hour. We work out yours from your own volumes before you sign.

Let’s build your agent
What we customize with you

One proven agent, plugged into how you work.

Every team does this job a little differently, so we set these five with the people who do it today. We’ve done this in dozens of businesses, so we know where teams usually differ and ask about those first.

The agent

Same for every client
  • Follows the same proven steps
  • A person on every exception
  • Every decision logged
  • Tested on your past work first
  • Never removes or grants access on its own

  1. Your systems

    Where the work comes in, and where the result goes.

    For this agentUser lists from each system in scope, staff records from your HR system.

  2. Your rules

    The limits and exceptions it works to.

    For this agentWhich systems are in scope, how often, and what counts as unused.

  3. Your team

    Who signs off, and who covers when they’re away.

    For this agentEach system’s owner signs their list, and IT makes the changes.

  4. Your channels

    Where your team hears from it.

    For this agentEmail or Slack to each owner, a summary for compliance.

  5. Your output

    What it hands back, in the format you already use.

    For this agentA signed review per system, every change logged and filed for audit.

Offboarding and control evidence are other agents in the catalog. Deciding who should have access stays with each system’s owner.

What you get

The agent, and everything that keeps it working.

  • The agentRunning on your systems, under your rules.
  • The review screenWhere the exceptions land for your IT manager and each system’s owner.
  • Your rulebookYour limits, exceptions and who signs off, in one place, often for the first time.
  • A test reportYour past access reviews, run through it and checked against the number.
  • The runbookHow it works, what to check, and what to do if it stops.
  • 30 days of tuningAfter it goes live, through a full month of your real access reviews.
The number we agree

Days from quarter end to every system’s review signed off. We measure your last review, then the first one it runs.

How we get there

Live in 3 to 6 weeks. About seven hours of your time.

We do the building. Your side: access, your last access review and the list of systems in scope, and a short weekly check-in.

  1. Before kickoff

    We send the access checklist.

    You, 2 hours. Access, an owner, and your last access review and the list of systems in scope.

  2. Weeks 1 to 2

    We connect your systems and set it up.

    You, 1 hour. Walk us through your rules.

  3. Weeks 2 to 4

    We test it on your past access reviews.

    You, 1 hour. Review what it flagged.

  4. Weeks 3 to 6

    It runs beside your team, then goes live.

    You, 1¼ hours. Work from the review screen.

Then 30 days of tuning, with a short check-in each week, about two hours of yours. At day 30 we show you the number and hand everything over.

After it’s live

It keeps running whether or not we stay.

  • It runs in your accounts

    Your cloud, your systems, and an AI account in your name, billed by the provider at their rates.

  • Changes in the first 30 days are included

    A new rule, a changed limit, someone new signing off. That’s what tuning is for.

  • After that, your call

    Your team edits the rulebook, the care plan covers it, or a bigger change is quoted first.

Questions

About this agent.

What if a system can’t export its users?
Most can, as a report or through a connection. If one can’t, its owner drops in an export each quarter and the rest runs the same.
Does it take away access?
No. It finds what should change and asks the right person. IT removes the access, and it checks the change took.
Will our auditors accept it?
Each review is filed with the user list, the date it was pulled, who signed and every change made, which is what auditors usually ask to see.
Our process isn’t quite like this. Will it still work?
That’s the usual case. The job looks the same in most businesses, but the details never do. We map how your team does it today, then set the rules, systems and approvals to match. That’s what most of the 3 to 6 weeks are for.
How do we agree the number?
Together, before any work starts. For this agent it’s the days from quarter end to every system’s review signed off. We measure your last review, then the first one it runs.
What does it cost to run once it’s live?
Hosting and AI, paid straight to the providers, not through us. It usually runs 5x to 25x cheaper than doing the same work by hand, and we work out your figure from your real volumes before you sign.

How many systems are in your next review?

Tell us how your team handles access reviews today. We’ll show you this agent on examples like yours, and whether it fits the fixed price.

Let’s build your agentBack to Compliance & Audit
New to Switchboard Agents? How it works, what’s included, and what it costs.
  • 3 to 6 weeksto live, then 30 days of tuning
  • $12,500fixed, per agent
  • Yours to keepno license fees
See the service
Switchboard Agents$12,500 fixed · live in 3 to 6 weeks How it works Let’s build your agent