🔍 OasisPro · IFS Cloud Access Review · Governance · PermissionWorks
Your access review confirmed logins.
Your auditor wanted current roles.
An IFS Cloud access review that only confirms someone still has a login isn't a review. It's a headcount. What actually gets flagged during audit is access drift: people who changed roles, changed teams, or moved departments and quietly kept every permission from the job they don't do anymore.
That gap between "still has access" and "should still have that access" is exactly where most IFS Cloud access reviews fail, and it's exactly what shows up in a management letter when someone finally checks properly. It's also the exact gap frameworks like NIST's separation of duties control are built to catch.
Here are the 6 steps that catch drift before your auditor does.
An access review that stops at "does this person have a login" isn't checking for risk. It's confirming the exact thing that was never actually in question.
The real question is whether current access matches current job function. That's a completely different check, and it's the one that catches the permission somebody kept from a role they left eight months ago.
The 6-step IFS Cloud access review that actually catches drift
- 1. Pull current access as it exists today. Not what the org chart says it should be. What IFS Cloud actually has assigned, right now, for every user.
- 2. Cross-reference against current job function. Not the role someone had when access was originally granted. What they actually do today.
- 3. Flag every permission that doesn't match current function. This is access drift, and it's the single biggest category of audit finding in ERP access reviews.
- 4. Check joiner/mover/leaver history specifically. Anyone who changed roles or teams in the last 12 months is your highest-risk group, by a wide margin.
- 5. Get a named manager sign-off per person, not a blanket departmental approval. "My team looks fine" isn't evidence. A name against every individual line is.
- 6. Produce one certification record. A date, a reviewer, a decision, per user. That's the actual document your auditor wants, not a verbal assurance that a review happened somewhere.
Why drift is nobody's fault, but everyone's risk
Removing old access during an internal move isn't malicious neglect, it's just not built into most role-change processes. That's exactly why it has to be checked deliberately, not assumed away.
Why a blanket sign-off doesn't hold up
"My department's access looks fine" is a manager's impression, not evidence. Auditors want a decision against a specific name and a specific permission, not a department-wide shrug.
Why the annual cadence alone isn't enough
A role change in month two sits unreviewed for up to ten months under an annual-only cycle. Reviewing at every role change closes that window completely.
The finding auditors actually write up
Not "someone has an account they shouldn't." It's almost always "access was reviewed, but the review didn't compare it against current job function." That's a process finding, not a technical one, and it's entirely preventable with steps 2 and 3 above.
What a real IFS Cloud access review actually produces
Not a summary email saying the review happened. A certification record: every user, their current access, their current role, a flag on anything mismatched, and a named decision.
That record is what your auditor asks for. It's also what protects you if something does go wrong later, because it proves the review looked for the right thing, not just the easy thing.
Build it once, properly, and every future review gets faster, because the baseline is already established.
"They still have a login" was never the question. "Should they still have this access" always was.
What most IFS Cloud access reviews get wrong
They check presence instead of appropriateness, confirming access exists without asking whether it still matches the job.
They run once a year and miss the ten months of drift sitting in between, right where role changes actually happen.
They collect a department-wide sign-off instead of a per-person decision, which produces a document that looks complete and proves almost nothing.
We'll run the access review that actually catches drift.
PermissionWorks pulls current access, cross-references it against current role, flags every mismatch, and produces the certification record your auditor is actually looking for.
Understand the permission model this checks againstCatch access drift before your auditor writes it up.
Give us access to your current IFS Cloud user list and role assignments, and we'll flag every mismatch, every stale permission, and every role change that never got cleaned up.
What is the difference between an access review and an access certification?
A review is the process of checking what someone has against what they should have. A certification is the documented, signed-off record that a named reviewer did that check and made a decision, for a specific person, on a specific date. Auditors want the certification record, not just the review having happened somewhere informally.
How often should an IFS Cloud access review happen?
Annually at minimum, but an annual-only cadence misses drift that happens the other eleven months. Reviewing access at every role change, plus a full annual sweep, catches far more than an annual review alone.
What is the single biggest finding in IFS Cloud access reviews?
Access drift: employees who changed roles or teams and kept permissions from their previous position. It is rarely malicious, it is just nobody's job to remove old access when someone moves internally, so it accumulates quietly.
Can this be automated, or does it require manual review?
Pulling current access and flagging drift against current role can be automated. The sign-off decision itself still needs a named human reviewer, because only a person can judge whether a flagged permission is actually a legitimate business need.
Review roles, not logins
A login check confirms nothing your auditor actually cares about. A role match is the whole point.
Six steps. One certification record. Run it before the drift becomes the finding.