Six weeks before the auditors arrive
The compliance analyst has a list of controls and a deadline. For the access control family she needs proof that quarterly reviews happened, that terminated employees lost access within policy, and that exceptions were approved. The proof is spread across Okta exports, Workday termination reports, ServiceNow tickets and a folder of manager emails that say “looks fine.”
She spends weeks stitching it together, and the result shows what the organization did months ago, not what it does now. Reviews happen quarterly because doing them more often by hand would be impossible. Between reviews, access drifts.
Reviews that run themselves
On the schedule you set, quarterly for most systems and monthly for the sensitive ones, Kinetic:
- Pulls current access from Okta, Active Directory and the connected applications and compares it with Workday. Accounts belonging to people who left, access that doesn’t match the current role and contractor access past its end date are flagged before a reviewer sees anything.
- Sends each manager a list of their people and what each person can reach, with the flags on top. They mark keep or remove.
- Reminds them before the deadline and escalates to their manager after it.
- Runs every “remove” through the same deprovisioning workflow used at offboarding, and records the result.
- Writes the completed review and any open findings back to Archer or your GRC platform.
Policy attestations and evidence requests work the same way: assigned to an owner, due on a date, chased until done, and stored with who did what and when.
Evidence as a byproduct
The bigger change is upstream. When access requests, offboarding and change approvals already run through Kinetic, each one leaves a timestamped record of the request, the approver and the change made in each system. Frameworks such as NIST 800-53, CMMC, SOX and HIPAA ask for exactly that kind of evidence. Audit preparation becomes a filtered export of records that already exist.
Kinetic doesn’t decide whether a control passes. People still review the evidence, and your auditors still form their opinion. What changes is how much of their time goes to finding things.
Most teams connect this to access request automation first, since that is where review findings come from, and then to cyber security and risk management workflows.