An email summary from the IT director listing review dates

An organization chart showing the review committee structure

Management's written assertion that quarterly reviews are performed

Auditor sampling of completed review documents from the GRC system with traceability to user terminations