SCHOOL ROLE ACCESS REVIEW

Use this sheet to test access for named roles in the exact product, edition and version under review.
Record observed evidence. Do not infer a permission from a role name or a sales description.

REVIEW DETAILS
School / review group:
Decision owner:
Test date:
Vendor contact:
Product, edition and version:
Environment tested:
Test account references:

ROLE INVENTORY
Role name:
Role purpose:
Who may receive the role:
Who approves the role:
Who provisions and removes it:
Default permissions:
Optional or elevated permissions:
Restrictions by class, year, location or record type:

PERMISSION TEST MATRIX
Resource or workflow:
Create: allowed / denied / not tested:
Read: allowed / denied / not tested:
Update: allowed / denied / not tested:
Delete: allowed / denied / not tested:
Export: allowed / denied / not tested:
Approve or administer: allowed / denied / not tested:
Observed result:
Evidence reference:

LIFECYCLE TESTS
New starter access request and approval:
Role or responsibility change:
Temporary or substitute access:
Account suspension:
School leaver or staff exit:
Time until access change took effect:
Residual access found:

CONTROL QUESTIONS
Authentication method shown:
Multi-factor requirement and scope:
Session timeout or device restrictions:
Shared-account prevention:
Privileged-access review frequency:
Audit log fields and retention shown:
Emergency-access process:

EXCEPTION TEST
Action that should be denied:
Role used:
Observed system response:
Alert or audit record produced:
Follow-up required:

FINDINGS
Confirmed permission:
Unconfirmed permission:
Risk or operational concern:
Evidence gap / owner / due date:
Decision and next test: