SOC 2 access reviews: how often, and what auditors test
Updated
SOC 2 does not set an access review interval. The interval that gets tested is the one in your own access control policy, so the real question is which cadence you can keep for the whole period. Quarterly is the figure the sources below use most often for critical systems. This guide sets out what each says, how to choose by risk, what a review record contains and the mistakes to avoid. The sources are vendors and a community post, not the AICPA, so your CPA firm has the final say.
Short answer: the criteria set no interval, your policy does
Zluri, an identity management vendor, says SOC 2 "typically requires quarterly for critical systems", adds that it varies by Trust Services category and control design, and recommends agreeing expectations with your auditor (Zluri). Vanta's maintenance guide recommends recurring reviews "at least quarterly" (Vanta). Treat both as vendor guidance. What the auditor tests is whether you did what your policy says, on the schedule it says.
What the sources say, side by side
| Source | What it recommends |
|---|---|
| Vanta guide | Recurring reviews, at least quarterly (Vanta) |
| Vanta community post (Kareem M., 8 Apr 2026) | Most auditors expect quarterly; a steady cadence, not one review before the audit (post) |
| Bastion documentation | Quarterly for critical systems and privileged access, semi-annual for standard systems, annual for low-risk (Bastion) |
| Zluri (Aditi Sharma, updated 27 Apr 2026) | Four tiers: monthly or continuous for critical access, quarterly for standard, semi-annual or annual for low-risk, plus framework minimums (Zluri) |
They agree that quarterly is the norm for the riskiest access and differ at the edges. Zluri also mentions SOX, which it says requires at least quarterly reviews for financial systems; that is a different regime from SOC 2 (Zluri). Each source is selling or documenting a review feature.
Choose the cadence by risk
Start with the systems where a stale account does the most damage: production infrastructure, source code, identity administration and anything holding customer data. Bastion and Zluri both put privileged and admin access on the shortest interval (Bastion) (Zluri). Collaboration tools and read-only access can wait for a longer cycle. Bastion notes that its page does not define how to classify a system as critical, standard or low-risk, so write your own definition into the policy.
Commit only to what you can keep
The Vanta community post stresses a consistent cadence rather than one review just before the audit (post). An interval you miss is worse than a longer one you meet, because in a Type 2 examination the missed run is visible. See the observation period guide for how the window works and exceptions for what a miss turns into.
What a review record holds
Bastion's documentation lists the audit evidence as the review scope and methodology, complete decision records, remediation evidence, and timestamps and reviewer identities (Bastion). In practice that is one row per account with a keep or remove decision, the ticket or log showing the removal happened, and the reviewer's name and date. The evidence checklist places it among the rest of the evidence.
Pitfalls
The Vanta community post lists three (post):
- Reviews run yearly instead of quarterly.
- Decisions left in informal Slack threads instead of a formal record.
- Former employees missed because they had direct application logins outside single sign-on.
The third is the one a tool catches: the access review tool flags leavers still active, inactive accounts, admins and MFA gaps from your exports.
What the Policyseed Access Control Policy sets
Policyseed sells a kit, so read this as one example rather than a requirement. The generated Access Control Policy says, in item 4.10:
Access is reviewed at least quarterly for production, source code, identity administration and any system holding Restricted data, and at each annual review for all other systems. Reviewers attest to each account and privileged role, and removals are completed within five business days.
That is a default for a small team, not a SOC 2 rule. Change the intervals to what you will actually run, then run the first review with the free tool and keep the result on the access review template. For leavers, use the offboarding checklist, and log any deviation in the exception register. MFA on the accounts under review is covered in does SOC 2 require MFA.
Frequently asked questions
- How often are SOC 2 access reviews required?
- The Trust Services Criteria do not name an interval. The sources below mostly describe quarterly as the norm for critical systems, and the cadence an auditor tests is the one written in your own access control policy. Pick one you can keep for the whole period and confirm it with your CPA firm.
- Is an annual access review enough for SOC 2?
- Some sources accept it for low-risk systems: Bastion's documentation lists annual for low-risk access. For production, source code and admin access the sources recommend quarterly or more often, and a Vanta community post calls a yearly review a common gap. Your CPA firm decides what it will accept for your scope.
- Do I have to review every system quarterly?
- Not according to the sources. Bastion's documentation puts standard systems on a semi-annual cycle, and Zluri puts everyday business applications on a quarterly one. The common thread is that riskier access is reviewed more often. Whatever tiers you choose, write them into the policy and follow them.
- What do auditors look at for an access review?
- Bastion's documentation lists the evidence as the review scope and method, a decision record for each account, proof that removals happened, and timestamps with the reviewers' names. A Vanta community post adds that decisions left in a Slack thread are a common weakness.
- What if I miss a quarterly review?
- A control that did not run on its stated schedule is visible to the auditor in a Type 2 examination, and a review cannot be recreated afterward. Run it late and keep the dated record, tell your CPA firm, and consider whether the cadence in your policy was realistic. See the guide to SOC 2 exceptions.
- Can I use a spreadsheet for access reviews?
- Yes. Nothing in the criteria requires software. The free access review tool builds a workbook from your identity provider, GitHub and AWS exports with a decision column and sign-off, and the blank template is a plain sheet.
Policyseed provides governance policy templates and AI tailoring. It is not legal advice and not a compliance guarantee. Management adopts the policies; the CPA firm performs the SOC 2 examination.