Which control governs the process to validate and authorize changes to user access?

Which control governs the process to validate and authorize changes to user access?

• A. Approval processes
• B. Audit controls
• C. Compliance monitoring
• D. Access transformation initiatives

Answer: (A)

Approval processes are the mechanism that ensures any change to who can access systems is reviewed and signed off by the right people before the change is made. This kind of workflow enforces governance by requiring validation from managers, data owners, or IAM administrators, checks for alignment with least privilege, and creates an auditable trail of who approved what and when. Without this gate, access could be granted or modified without proper oversight, increasing risk. Audit controls, by contrast, focus on recording and examining what happened after the fact rather than approving changes beforehand. Compliance monitoring looks at overall adherence to policies but doesn’t by itself enforce the step of obtaining authorization for each change. Access transformation initiatives relate to evolving how access is managed or implemented, not the approval gate that governs changes to user access.

Approval processes are the mechanism that ensures any change to who can access systems is reviewed and signed off by the right people before the change is made. This kind of workflow enforces governance by requiring validation from managers, data owners, or IAM administrators, checks for alignment with least privilege, and creates an auditable trail of who approved what and when. Without this gate, access could be granted or modified without proper oversight, increasing risk.

Audit controls, by contrast, focus on recording and examining what happened after the fact rather than approving changes beforehand. Compliance monitoring looks at overall adherence to policies but doesn’t by itself enforce the step of obtaining authorization for each change. Access transformation initiatives relate to evolving how access is managed or implemented, not the approval gate that governs changes to user access.