Workflow Template
User Access Review Workflow
Collects a user access review request, sets a 14-day due date, has the system owner certify access against least privilege, saves the certification outcome to the record, remediates any flagged access via IT with system-owner confirmation (looping until resolved), and closes the review with an outcome email.
Chasing system owners for access sign-off and then chasing IT to fix what they flag is a familiar headache for anyone running periodic access reviews. This workflow takes a submitted review request, sets a 14-day due date, assigns the system owner a task to certify each user's access against least privilege, and automatically routes anything flagged to IT for remediation with a confirmation loop back to the system owner. The team ends up with a single record per review that tracks status, certification outcomes, and remediation details from start to finish, with an outcome email sent automatically when it's closed.
Business Outcomes
- Helps keep access reviews moving with a built-in 14-day due date
- Reduces manual follow-up between system owners and IT on flagged access
- Makes it easier to see certification and remediation outcomes on one record
- Supports consistent handling of flagged access through a structured remediation loop
- Keeps review owners informed automatically with acknowledgement and outcome emails
Workflow Steps
Steps
- 1Create Access Review Recordcreate record
Registers the submitted review request as an access review record.
- 2Set Status In Review & Due Dateupdate record
Sets the record status to In Review and the due date to 14 days from now.
- 3Apply 14-Day Due Dateset due date
Sets the record's due date to 14 days from now for the certification stage.
- 4Send Acknowledgement Emailsend email
Emails the review owner an acknowledgement with the review reference number.
- 5System Owner: Certify User Accesscreate task
Assigns the system owner a task to certify each user's access against least privilege.
- 6Save Certification Results to Recordupdate record
Persists the certification outcome, including whether access was flagged, onto the access review record.
- 7Route on Flagged Access
Routes to remediation if access was flagged, otherwise proceeds to completion.
access_flagged: "Yes"→Set Status Remediationaccess_flagged: "No"→Set Status CompletedDefault→Set Status Completed - 8Set Status Remediationupdate record
Updates the record status to Remediation because access was flagged.
- 9IT: Revoke or Adjust Flagged Accesscreate task
Assigns IT a task to revoke or adjust the flagged access and record the changes made.
- 10Save Remediation Details to Recordupdate record
Persists the remediation changes made and the remediation date onto the access review record.
- 11System Owner: Confirm Remediationcreate task
Assigns the system owner a task to confirm whether the remediation changes are complete, with notes.
- 12Route on Confirmation Decision
Routes to completion if confirmed, or back to IT for further remediation if not complete.
confirmation_decision: "Confirmed"→Set Status Completedconfirmation_decision: "Not complete"→Loop Back to IT RemediationDefault→Loop Back to IT Remediation - 13Loop Back to IT Remediationrestart from step
Closes this iteration and restarts from the IT remediation task since changes were not complete.
- 14Set Status Completedupdate record
Updates the record status to Completed once certification (and any remediation) is finished.
- 15Send Outcome Email to Review Ownersend email
Emails the review owner the final outcome of the access review.
Fields
Show all 15 fieldsShow fewer fields
FormUser Access Review Request
- Review Owner Name*· Text
- Review Owner Email*· Email
- Review Name*· Text
- System or Application*· Text
- Scope of Review*· Long text
- List of Users and Entitlements (text)· Long text
- List of Users and Entitlements (upload)· File upload
TaskSystem Owner: Certify User Access
- Users Certified*· Long text
- Access Flagged for Change· Long text
- Was Any Access Flagged?*· Choice
TaskIT: Revoke or Adjust Flagged Access
- Changes Made*· Long text
- Date of Remediation*· Date
TaskSystem Owner: Confirm Remediation
- Confirmation of Remediation*· Choice
- Confirmation Notes· Long text
Other fields
- Review Status· Choice
- Review Owner Name*
- Review Owner Email*
- Review Name*
- System or Application*
- Scope of Review*
- List of Users and Entitlements (text)
Forms
User Access Review Request
7 fields
Data Views
Access Reviews
review_name, system_application, access_flagged, review_status
Dashboard Widgets
Recommended integrations
Setup the following integrations to extend workflow capability.
Send email in the workflow
AWS SES
Similar Workflows
Similar Categories
FAQs
Do I need to set up the 14-day due date manually each time?
No, the workflow sets the due date to 14 days from the request automatically as soon as the review record is created. This happens again at the certification stage, so the deadline is consistently applied without anyone having to calculate or enter it by hand.
Can my team customise who is assigned the certification and remediation tasks?
Yes, tasks in this workflow are assigned to team members within your workspace, such as the system owner for certification and IT for remediation. You can adjust who those tasks go to by editing the workflow steps, or by describing the change you want in plain English.
What happens if the system owner finds flagged access during certification?
When the system owner certifies access, they record whether any access was flagged for change. If flagged, the record status updates to Remediation and the workflow automatically routes the case to IT to revoke or adjust the access, rather than moving straight to completion.
How does the remediation loop work if IT's changes aren't confirmed as complete?
After IT makes changes, the system owner reviews and confirms whether the remediation is complete, adding notes. If it's marked not complete, the workflow loops back to the IT remediation task automatically, and this can repeat until the system owner confirms the changes are complete.
Is this workflow suitable for reviews involving file uploads, like entitlement lists?
Yes, the request form collects a list of users and entitlements as both free text and a file upload, so reviewers can submit the format that suits their system. Both are captured on the review record when the request is submitted.
Do review owners need an account to take part?
No, review owners interact with the process through a public request form to submit the review and through emailed messages, including the acknowledgement and final outcome email. They don't need to log in or hold an account at any point.
Can my team track the status of multiple access reviews at once?
Yes, each submitted review becomes its own record with a reference number, a status such as In Review, Remediation, or Completed, and a timeline of what's happened. Table views and dashboards let your team see all reviews grouped by status at a glance.
How do I change a step in this workflow, like adding an extra approval or notification?
You can update the workflow by describing the change you want in plain English, or by editing the steps directly in the workflow editor. Earlier versions of the workflow are kept, so you can review or revert changes if needed.
What gets recorded when the review is closed?
The record captures the certification outcome, any remediation changes made, the remediation date, and the confirmation decision from the system owner, all visible in the record's timeline. Each business should confirm what level of detail meets its own audit or compliance requirements.
Ready to use this workflow?
Create a free account and customise this workflow for your business.