Automated quarterly access review in contract management reduced unauthorized access incidents by 90% in six months

We implemented automated quarterly access reviews for our Asset Lifecycle module to address audit findings and reduce security risks. Previously, our manual review process took 2-3 weeks per quarter with inconsistent follow-through on dormant accounts.

Using SuiteFlow, we built a workflow that automatically identifies users with asset lifecycle access, flags accounts with no activity in 60+ days, and routes review tasks to department managers. The workflow generates a comprehensive report showing all access grants, last login dates, and transaction history.

Quarterly review tasks now complete in 3-4 days instead of weeks. Dormant accounts are automatically disabled after manager approval, and we’ve reduced audit findings from 12 to 2 in our last compliance review. The system maintains a complete audit trail of all access decisions and automatically notifies security when high-risk permissions are detected.

Happy to share our SuiteFlow configuration and lessons learned from the implementation.

Good question. We use a 60-day inactivity threshold for most roles, but created exceptions for specific use cases like yours. In SuiteFlow, we added a custom field to tag ‘periodic access’ roles that only trigger review if inactive for 120 days. The workflow checks both login activity and actual transaction history in the Asset Lifecycle module - so someone who logs in but doesn’t touch assets still gets flagged. We also exclude service accounts and integration users from the dormant logic entirely.

Let me provide a comprehensive breakdown of our implementation for anyone looking to replicate this:

Quarterly Review Automation Architecture:

The SuiteFlow workflow triggers on the first day of each quarter (Jan 1, Apr 1, Jul 1, Oct 1) and executes a saved search identifying all users with Asset Lifecycle permissions. The search filters for roles containing ‘Asset Manager’, ‘Asset Coordinator’, or custom asset-related permissions.

Dormant Account Detection: We query both login history and transaction records. A user is flagged as dormant if: (1) No login in 60+ days for standard roles or 120+ days for periodic roles, OR (2) No asset-related transactions (creates, updates, disposals) in the review period. The workflow creates a custom record for each flagged account containing user details, last activity date, assigned assets, and risk score based on permission level.

Manager Review Process: SuiteFlow automatically routes review tasks to the user’s direct manager via workflow action. Each task includes: user profile summary, access history, list of accessible assets, and recommendation (retain/modify/remove). Managers can approve, request modification, or escalate for additional review. The system enforces our escalation SLA: 5 days to manager, then VP, then CISO with compliance notification.

Automatic Disabling: Once a manager approves removal, the workflow sets the user’s status to ‘Disabled for Review’ and removes Asset Lifecycle role assignments. We maintain a separate ‘Pending Reactivation’ status for users who might need seasonal access restored. All changes log to a custom audit record with timestamp, approver, and justification.

Audit Trail & Reporting: Every decision point creates an audit record: review initiated, task assigned, manager action, account disabled, exceptions granted. We built three key reports: (1) Quarterly compliance summary showing total reviews, approvals, removals, and open items, (2) Department-level completion dashboard updated real-time, (3) Trend analysis comparing quarterly metrics to identify systemic issues.

Reduced Audit Findings: Our external auditors previously cited 12 findings related to excessive access, lack of review documentation, and dormant accounts. After three quarters of automated reviews, this dropped to 2 findings (both related to emergency access procedures, not routine reviews). The automated audit trail eliminated ‘insufficient documentation’ findings entirely.

Implementation Lessons:

  • Start with a pilot department before full rollout
  • Over-communicate the process to managers - we held training sessions and created video guides
  • Build exception handling for legitimate use cases (contractors, seasonal workers, executives)
  • Integrate with HR systems to catch terminations that bypass normal offboarding
  • Create executive visibility early - it drives adoption faster than any technical solution

Technical Considerations: The SuiteFlow uses 15 workflow states, 8 custom fields on the Employee record, and 3 custom record types (Review Task, Audit Log, Exception Request). We also created a SuiteScript scheduled script that runs weekly between quarterly reviews to catch new high-risk permission grants and alert security immediately.

This system reduced our review cycle from 18 days average to 3.5 days, cut security admin workload by 60%, and gave us defensible audit documentation. The compliance team now spends time on risk analysis instead of chasing spreadsheets. Happy to answer specific technical questions about the SuiteFlow configuration or saved search criteria.

How do you handle the manager review process? Our biggest bottleneck is getting managers to actually complete their reviews. Do you have automatic escalation built in?

Yes, escalation was critical for us too. The SuiteFlow sends initial review tasks to direct managers with a 5-day SLA. If no response, it escalates to the department VP with CC to compliance. After another 3 days, it goes to the CISO with automatic notification to audit committee. We also built a dashboard showing completion rates by department, which created healthy competition between teams. First quarter we had 68% on-time completion, now we’re at 94%. The visibility really drove accountability - nobody wants their department highlighted as non-compliant in executive reports.

We kept the review workflow entirely in NetSuite to avoid synchronization issues, but we do have integration touchpoints with ServiceNow. When our SuiteFlow identifies an access issue or manager approves removal, it creates a ServiceNow ticket for the actual deprovisioning action. This maintains our ITSM audit trail while keeping the review logic centralized. The integration uses RESTlet endpoints to pass approval decisions and account status back to ServiceNow. One lesson learned: make sure your integration handles partial failures gracefully - we had early issues where NetSuite would complete the review but ServiceNow ticket creation failed, leaving orphaned approvals.

Did you integrate this with your ITSM system or keep everything in NetSuite? We use ServiceNow for access requests and I’m wondering about the handoff between systems.