Identity Audit Checklist Form
Mark the review tasks completed for your organization’s identity and access management audit.
Organization or team name
*
Organization or team identified in audit records
Audit review period
*
Review period documented in audit records
Review period confirmed with the audit owner
Inventory of user accounts and identity providers reviewed
*
User account inventory reviewed
Identity provider inventory reviewed
Inventory scope and review date documented
Joiner, mover, and leaver account lifecycle processes reviewed
*
New starter account provisioning reviewed
Role or team change access updates reviewed
Departure account removal or disablement reviewed
User access rights and least-privilege assignments reviewed
*
User access rights reviewed against current responsibilities
Excess or unnecessary access identified
Least-privilege assignments verified or updated
Privileged and administrator accounts reviewed
*
Privileged and administrator account inventory reviewed
Access necessity and authorization checked
Privileged access review outcomes documented
Multi-factor authentication coverage reviewed
*
Coverage across in-scope accounts and systems assessed
Exceptions or gaps identified and documented
Follow-up actions for coverage gaps recorded
Authentication and credential policies reviewed
*
Authentication policy requirements reviewed
Credential management and protection practices reviewed
Policy exceptions and review outcomes documented
Inactive, duplicate, and orphaned accounts identified and addressed
*
Inactive accounts identified and disposition reviewed
Duplicate accounts identified and disposition reviewed
Orphaned accounts identified and disposition reviewed
Actions taken or follow-up recorded
Audit findings and remediation actions documented
*
Findings recorded with supporting context
Remediation actions and owners documented
Target dates or follow-up status recorded
Submit Checklist
Should be Empty: