Mechanisms exist to revoke user access rights following changes in personnel roles and duties, if no longer necessary or permitted.
Does the organization revoke user access rights following changes in personnel roles and duties, if no longer necessary or permitted?