Audit Employee Access Rights

Does your organisation regularly audit employee access rights for all IT services (whether internal or third party based)?

Yes. Each service is on an automated schedule for access rights reviews. Depending on the level of risk associated with each service, these are 1x, 2x or 4x per year.

Services like AWS are reviewed quarterly, and services like Adobe (that holds no confidential or personal information) are reviewed annually.