One significant aspect of user account management involves keeping user access authorizations up to date. Users often are required to perform duties outside their normal scope during the absence of others. This requires additional access authorizations. Although necessary, such extra access authorizations should be granted sparingly and monitored carefully, consistent with the need to maintain separation of duties for internal control purposes. Also, they should be removed promptly when no longer required.
Permanent changes are usually necessary when employees change positions within an organization.
In this case, the process of granting account authorizations will occur again. At this time, however, is it also important that access authorizations of the prior position be removed. This practice is inconsistent with the principle of least privilege. It is necessary to periodically review user account management on a system. Whereas the SA can verify that users only have those accesses that their managers have specified, because access requirements may change over time, it is important to involve the application manager, who is often the only individual in a position to know current access requirements.