Glossary
Periodic review
A scheduled check that a validated system is still in its validated state: changes reviewed, access sane, audit trails functioning.
Validation decays. Changes accumulate, users come and go, integrations drift. Periodic review is the institutionalized look-back that confirms the validated state still holds: open changes assessed, access lists pruned, audit trail review effective, incidents trending nowhere alarming.
Frequency follows risk, commonly one to three years per system. The review earns its keep when it produces actions; a periodic review that has never once found anything is usually a form, not a review.
Related terms