Field Notes
Evidence packs that make access reviews less painful
Feb 3, 2026 · Neural API Hub faculty
Access reviews fail when the folder is a dump of screenshots with no index. Auditors then invent their own sampling logic, and finance spends evenings explaining filenames. An evidence pack is simply a predictable envelope: cover sheet, population, sample, reviewer attestation, exception log.
Population before pretty pictures
Export the user list from the identity provider and the ERP on the same day. Hash or checksum the files if your auditors care about integrity. Store the export definition — filters matter when someone asks why contractors were excluded.
Attestations need a verb
“Looks good” is not an attestation. Ask reviewers to confirm each privileged role against a job title table. When they revoke access, capture the ticket ID in the exception log the same day.
Retention without hoarding
Keep packs for the periods your external firm still samples — often seven years for some Korea-listed contexts, shorter for private diligence. Delete raw screenshots that duplicate the indexed PDF once the pack is sealed.
Module 5 of our flagship lab walks through a sample pack using a fictional billing admin role set.